Host asset loss detection method and device, computer equipment, storage medium and program product
By vectorizing the operational status data of host assets and calculating Euclidean distance, the conditions for loss of host assets are dynamically determined, which solves the problems of high difficulty and poor adaptability in host asset loss detection and achieves detection with low complexity and high accuracy.
Patent Information
- Application Number
- CN202511737411.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-03-03
AI Technical Summary
In existing technologies, detecting host asset loss is difficult. Traditional methods require a large amount of diverse historical data for training and are difficult to adapt to complex environments, resulting in frequent false alarms and false negatives.
By acquiring the operational status data of the host asset and vectorizing it to obtain the target state vector, the Euclidean distance is used to compare with the historical state vectors to dynamically determine the failure conditions, thus avoiding reliance on large-scale training data and model updates.
It achieves low-complexity host asset compromise detection, improves detection accuracy and adaptability, and reduces false positives and false negatives.
Smart Images
Figure CN121603264A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, computer equipment, storage medium, and program product for detecting host asset loss. Background Technology
[0002] Mainframe assets refer to the computer systems owned by an enterprise used for data storage, processing, and analysis, including hardware, operating systems, and application software. Mainframe asset compromise refers to the state in which a system is successfully compromised and controlled by an unauthorized third party. Mainframe asset compromise can lead to serious consequences such as data breaches, service interruptions, and identity theft, posing a significant threat to an organization's security and operations. Therefore, detecting compromise incidents is a crucial part of security defense.
[0003] Traditionally, machine learning-based predictive models are used to detect compromised host assets. However, these predictive models require extensive and diverse historical data for training, and they need to be continuously updated over time to ensure sensitivity to new threats. This makes it challenging to use predictive models for host asset compromise detection. Summary of the Invention
[0004] Therefore, it is necessary to provide a host asset loss detection method, apparatus, computer equipment, storage medium, and program product that is relatively easy to implement, addressing the aforementioned technical problems.
[0005] In a first aspect, this application provides a method for detecting host asset loss, comprising: acquiring the operating status data of the host asset; performing vectorization processing on the operating status data to obtain the target state vector of the host asset; determining whether the host asset meets the loss condition based on the target state vector and the historical state vector corresponding to the historical operating status data of the host asset; and outputting the loss detection result if it is determined that the host asset meets the loss condition.
[0006] In one embodiment, determining whether a host asset meets the loss condition based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset includes: obtaining the historical state vectors of the host asset at multiple time points within the target historical period; calculating the distance between the target state vector and each historical state vector to obtain multiple first distance values; filtering the multiple first distance values to obtain a target distance value; and determining whether the host asset meets the loss condition based on the target distance value.
[0007] In one embodiment, filtering a plurality of first distance values to obtain a target distance value includes: filtering a plurality of first distance values to obtain a maximum distance value; and using the maximum distance value as the target distance value.
[0008] In one embodiment, determining whether a host asset meets the compromise condition based on a target distance value includes: if the target distance value is greater than or equal to a compromise threshold, then the host asset is determined to meet the compromise condition; if the target distance value is less than the compromise threshold, then the host asset is determined not to meet the compromise condition.
[0009] In one embodiment, the method further includes: for every two time points among multiple time points within the target historical period, calculating a second distance value based on the historical state vector corresponding to the two time points; and selecting the largest second distance value from among the multiple second distance values as the loss threshold.
[0010] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0011] Secondly, this application also provides a host asset loss detection device, which includes:
[0012] The acquisition module is used to acquire the operating status data of the host assets;
[0013] The vectorization processing module is used to vectorize the runtime status data to obtain the target status vector of the host asset.
[0014] The determination module is used to determine whether the host asset meets the loss condition based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, and output the loss detection result if the host asset meets the loss condition.
[0015] In one embodiment, the determining module is specifically used to obtain historical state vectors corresponding to multiple time points within a target historical period for the host asset; calculate the distance between the target state vector and each historical state vector to obtain multiple first distance values; filter the multiple first distance values to obtain a target distance value; and determine whether the host asset meets the compromise condition based on the target distance value.
[0016] In one embodiment, the determining module is specifically configured to filter out the maximum distance value from a plurality of first distance values; and use the maximum distance value as the target distance value.
[0017] In one embodiment, the determining module is specifically configured to determine that the host asset meets the loss condition if the target distance value is greater than or equal to the loss threshold; and to determine that the host asset does not meet the loss condition if the target distance value is less than the loss threshold.
[0018] In one embodiment, the determining module is further configured to calculate a second distance value for every two time points among multiple time points within the target historical period, based on the historical state vectors corresponding to the two time points; and select the largest second distance value from the multiple second distance values as the loss threshold.
[0019] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0020] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any one of the first aspects above.
[0021] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects above.
[0022] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects above.
[0023] The aforementioned host asset loss detection method, apparatus, computer equipment, storage medium, and program product acquire the host asset's operational status data, vectorize this data, and obtain a target state vector for the host asset. Then, based on the target state vector and the historical state vectors corresponding to the host asset's historical operational status data, it determines whether the host asset meets the loss criteria. If the host asset meets the loss criteria, it outputs the loss detection result. This method, by vectorizing the host asset's operational status data and then determining whether the host asset is lost based on the vectorized target state vector, avoids dependence on large-scale training data and eliminates the need for continuous model updates, making host asset loss detection easier to implement. Attached Figure Description
[0024] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0025] Figure 1 This is an application environment diagram of a host asset loss detection method in one embodiment;
[0026] Figure 2 This is a flowchart illustrating a host asset loss detection method in one embodiment;
[0027] Figure 3 This is a flowchart illustrating a host asset loss detection method in another embodiment;
[0028] Figure 4 This is a flowchart illustrating the host asset loss detection method in yet another embodiment;
[0029] Figure 5 This is a structural block diagram of a host asset loss detection device in one embodiment;
[0030] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0031] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0032] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.
[0033] Existing methods for detecting compromised host assets mainly include the following: First, relying primarily on continuous monitoring of specific indicators, typically using preset static thresholds to judge anomalies; once a monitoring indicator exceeds the set range, an alarm mechanism is triggered. Second, focusing on in-depth analysis of full traffic data to detect threats by identifying malicious characteristics. Third, using predictive models based on machine learning to enhance detection capabilities.
[0034] However, static threshold mechanisms lack flexibility and struggle to adapt to dynamic changes in asset status within complex environments, easily leading to numerous false positives or false negatives. Single-dimensional monitoring limits status assessment; most monitoring systems only monitor a single performance indicator, failing to integrate and analyze multi-dimensional data, resulting in missed or false positives for abnormal asset states. Threat detection based on identifying malicious characteristics heavily relies on a robust rule base and may disrupt normal business operations. Machine learning-based predictive model detection requires extensive training, demanding large amounts of diverse historical data, significant computational resources, and considerable time. Furthermore, because predictive models depend on historical data, they struggle to quickly detect unknown or emerging threats. Therefore, continuous model updates are necessary to ensure sensitivity to new threats, making the implementation of host asset compromise detection based on predictive models quite challenging.
[0035] Therefore, it is necessary to propose effective technical means to solve the above problems.
[0036] The host asset loss detection method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on other network servers. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.
[0037] In one exemplary embodiment, such as Figure 2 As shown, a method for detecting host asset loss is provided, which is then applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps 201 to 203. Wherein:
[0038] Step 201: Obtain the operating status data of the host asset.
[0039] Host assets typically refer to computer systems used for data storage, processing, and analysis, including components such as hardware, operating systems, and application software. Host asset operational status data includes status data across multiple asset dimensions, such as CPU (Central Processing Unit) utilization, memory usage, disk read / write speed, network traffic, number of processes, and number of network interface cards (NICs).
[0040] In one possible implementation, the terminal obtains the runtime status data of the host assets through the command-line tool typeperf.
[0041] Step 202: Vectorize the running status data to obtain the target status vector of the host asset.
[0042] Vectorization is a technique that converts non-numerical data into numerical vector representations. It is widely used in many fields such as mathematics, physics, geographic information science, and natural language processing, and helps with data analysis, modeling, and visualization.
[0043] Since the operational status data includes status data from multiple asset dimensions, the target status vector obtained by vectorizing the operational status data is a multi-dimensional vector. For example, the target status vector A = [CPU_usage, Memory_usage, Disk_IO, Network_traffic, Process_NUM, NIC_NUM]; where CPU_usage represents CPU utilization, Memory_usage represents memory usage, Disk_IO represents disk read / write speed, Network_traffic represents network traffic, Process_NUM represents the number of processes, and NIC_NUM represents the number of network interface cards (NICs).
[0044] Optionally, the vectorization process for operational status data may include uniform scaling of status data across multiple asset dimensions. This is because the dimensions and orders of magnitude of different asset dimensions vary greatly (e.g., CPU is a percentage of 0-100, while network traffic may be millions of bytes / s), which can lead to distance calculations being dominated by large numerical features.
[0045] Step 203: Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, determine whether the host asset meets the loss condition, and if the host asset meets the loss condition, output the loss detection result.
[0046] The historical operational status data of the host asset includes historical status data across multiple asset dimensions, and correspondingly, the historical status vector is also a multi-dimensional vector. It can be understood that the historical status vector and the target status vector have the same dimension. The terminal can periodically record the status data of the host asset, forming a set of historical status vectors {H1, H2, H3, ..., Hn}, which serves as the basis for subsequent calculations.
[0047] It can be understood that the operational status data of the host asset acquired by the terminal is the current operational status data of the host asset, and the resulting target state vector is the current state vector corresponding to the host asset. The terminal can determine whether the host asset is currently compromised based on the distance between the current state vector and the historical state vectors.
[0048] In one possible implementation, the difference between the target state vector and the historical state vector corresponding to the target historical moment is calculated, and the host asset is determined to meet the sabotage condition based on this difference. Specifically, the difference between the target state vector and the historical state vector can be measured by calculating the Euclidean distance between them.
[0049] Euclidean distance is a general concept of distance between two points in n-dimensional space. In two-dimensional space, Euclidean distance is the straight-line distance between the two points. Suppose there are two points A(x1, y1) and B(x2, y2), then the Euclidean distance d between them can be calculated using the following formula:
[0050]
[0051] In another possible implementation, historical state vectors of the host asset at multiple points in time within the target historical period are obtained; the distance between the target state vector and each historical state vector is calculated to obtain multiple first distance values; and the host asset is determined to meet the trapping condition based on the multiple first distance values. In one example, the average of the multiple first distance values could be taken, and the host asset's trapping condition could be determined based on the average value.
[0052] If the host asset meets the compromise criteria, a compromise detection result is output, including alarm information used to trigger an anomaly alarm. Further security checks can be performed on the host to obtain security analysis results, and a compromise detection result including these results is output.
[0053] The aforementioned host asset loss detection method acquires the operational status data of the host asset, vectorizes this data to obtain the target state vector of the host asset. Then, based on the target state vector and the historical state vectors corresponding to the historical operational status data of the host asset, it determines whether the host asset meets the loss criteria. If the host asset meets the loss criteria, it outputs the loss detection result. This method, by vectorizing the operational status data of the host asset and then determining whether the host asset is lost based on the vectorized target state vector, avoids dependence on large-scale training data and eliminates the need for continuous model updates, making host asset loss detection easier to implement.
[0054] In addition, since the operational status data includes status data from multiple asset dimensions, vectorizing this operational status data enables the integrated analysis of multiple asset status indicators, improving the comprehensiveness and accuracy of asset status assessment, thereby reducing the underreporting or misjudgment rate of abnormal asset status.
[0055] In one exemplary embodiment, such as Figure 3 As shown, another method for detecting host asset loss is provided. Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, it determines whether the host asset meets the loss conditions, including steps 301 to 304, wherein:
[0056] Step 301: Obtain the historical state vectors of the host asset at multiple points in time within the target historical period.
[0057] The target historical period can be a time period selected based on a month-on-month strategy (comparing data with data from the most recent period), a time period selected based on a year-on-year strategy (comparing data with data from the previous period), or a fixed time period. The specific time period can be selected according to the current business scenario, and there are no restrictions here.
[0058] In one optional implementation, historical operating status data of the host asset at multiple time points within the target historical period are obtained, and the historical operating status data at each time point is vectorized to obtain the historical status vector at each time point.
[0059] For example, the historical operating status data of database server B at multiple points in time within the target historical period is shown in Table 1:
[0060] Table 1
[0061]
[0062] The historical operational status data at each time point is vectorized to obtain the historical status vectors for each time point as follows:
[0063] Time point 1: H1=[45,16,50,300,100,5];
[0064] Time point 2: H2=[50,18,55,320,110,5];
[0065] Time point 3: H3=[48,17,52,310,105,5].
[0066] Step 302: Calculate the distance between the target state vector and each historical state vector to obtain multiple first distance values.
[0067] Calculating the distance between the target state vector and each historical state vector can be achieved by calculating the Euclidean distance between the target state vector and each historical state vector.
[0068] For example, if the current time is time point 4, the target state vector is the state vector corresponding to time point 4. The target state vector A = [52, 19, 60, 330, 119, 6]; the distances between the target state vector and the historical state vectors corresponding to time points 1, 2, and 3 are as follows:
[0069] ;
[0070] ;
[0071] .
[0072] Step 303: Filter the multiple first distance values to obtain the target distance value.
[0073] In one possible implementation, the maximum distance value is obtained by filtering from multiple first distance values; the maximum distance value is then used as the target distance value.
[0074] Based on the previous example, the target distance value is the distance between the target state vector and the historical state vector corresponding to time point 1, which is 37.42.
[0075] Step 304: Determine whether the host asset meets the sabotage conditions based on the target distance value.
[0076] In one possible implementation, if the target distance value is greater than or equal to the loss threshold, the host asset is determined to meet the loss condition; if the target distance value is less than the loss threshold, the host asset is determined not to meet the loss condition.
[0077] The loss threshold can be calculated based on the historical state vectors corresponding to multiple time points within the target's historical period. In this way, the loss threshold is no longer a fixed value and can adapt to the dynamic changes in asset status in complex environments, thereby avoiding a large number of false alarms or missed alarms caused by static thresholds.
[0078] In one example, for every two time points within a target historical period, a second distance value is calculated based on the historical state vectors corresponding to the two time points; the largest second distance value is selected from the multiple second distance values as the loss threshold.
[0079] Based on the previous example, the distances between the historical state vectors at time point 1 and time point 2, the distances between the historical state vectors at time point 2 and time point 3, and the distances between the historical state vectors at time point 1 and time point 3 are as follows:
[0080] ;
[0081] ;
[0082] ;
[0083] The maximum value is the distance between the historical state vector corresponding to time point 1 and the historical state vector corresponding to time point 2. Therefore, the distance between the historical state vector corresponding to time point 1 and the historical state vector corresponding to time point 2 is taken as the loss threshold, which is 23.54.
[0084] The target distance value of 37.42 exceeds the compromise threshold of 23.54, therefore the host asset is considered to be under threat and requires further analysis. The compromise detection result is then output.
[0085] In one embodiment, such as Figure 4 As shown, a method for detecting host asset loss is provided, including the following steps:
[0086] The system acquires operational status data of the host asset, which includes status data across multiple asset dimensions. This operational status data is then vectorized to obtain the target status vector of the host asset.
[0087] Obtain the historical state vectors of the host asset at multiple time points within the target historical period; calculate the distance between the target state vector and each historical state vector to obtain multiple first distance values, and filter the multiple first distance values to obtain the target distance value.
[0088] For each pair of time points within a target historical period, a second distance value is calculated based on the historical state vectors corresponding to the two time points; the largest second distance value is selected from the multiple second distance values as the loss threshold.
[0089] If the target distance value is greater than or equal to the trapping threshold, the host asset is determined to meet the trapping condition, and the trapping detection result is output.
[0090] In summary, by using vectorization and Euclidean distance, asset status can be tracked and evaluated in real time, adapting to complex and dynamic network environments and quickly detecting potential threats. Furthermore, the compromise threshold is dynamic, enhancing the ability to detect anomalies in dynamic assets in complex environments.
[0091] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.
[0092] Based on the same inventive concept, this application also provides a host asset loss detection device for implementing the host asset loss detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more host asset loss detection device embodiments provided below can be found in the limitations of the host asset loss detection method described above, and will not be repeated here.
[0093] In one exemplary embodiment, such as Figure 5 As shown, a host asset loss detection device 500 is provided, comprising: an acquisition module 501, a vectorization processing module 502, and a determination module 503, wherein:
[0094] The acquisition module 501 is used to acquire the operating status data of the host asset;
[0095] The vectorization processing module 502 is used to perform vectorization processing on the running status data to obtain the target status vector of the host asset.
[0096] The determination module 503 is used to determine whether the host asset meets the loss condition based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, and output the loss detection result if the host asset meets the loss condition.
[0097] In one embodiment, the determining module 503 is specifically used to obtain the historical state vectors of the host asset at multiple time points within the target historical period; calculate the distance between the target state vector and each historical state vector to obtain multiple first distance values; filter the multiple first distance values to obtain the target distance value; and determine whether the host asset meets the loss condition based on the target distance value.
[0098] In one embodiment, the determining module 503 is specifically used to filter out the maximum distance value from a plurality of first distance values; and to use the maximum distance value as the target distance value.
[0099] In one embodiment, the determining module 503 is specifically used to determine that the host asset meets the loss condition if the target distance value is greater than or equal to the loss threshold; and to determine that the host asset does not meet the loss condition if the target distance value is less than the loss threshold.
[0100] In one embodiment, the determining module 503 is further configured to calculate a second distance value for every two time points among multiple time points in the target historical period, based on the historical state vectors corresponding to the two time points; and select the largest second distance value from the multiple second distance values as the loss threshold.
[0101] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0102] Each module in the aforementioned host asset loss detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.
[0103] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for detecting host asset loss. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.
[0104] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0105] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0106] Obtain operational status data of host assets;
[0107] The runtime status data is vectorized to obtain the target status vector of the host asset;
[0108] Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, determine whether the host asset meets the loss condition, and output the loss detection result if the host asset meets the loss condition.
[0109] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining historical state vectors of the host asset at multiple time points within the target historical period; calculating the distance between the target state vector and each historical state vector to obtain multiple first distance values; filtering the multiple first distance values to obtain a target distance value; and determining whether the host asset meets the trapping condition based on the target distance value.
[0110] In one embodiment, when the processor executes the computer program, it further performs the following steps: filtering from a plurality of first distance values to obtain the maximum distance value; and using the maximum distance value as the target distance value.
[0111] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the target distance value is greater than or equal to the trapping threshold, it determines that the host asset meets the trapping condition; if the target distance value is less than the trapping threshold, it determines that the host asset does not meet the trapping condition.
[0112] In one embodiment, when the processor executes the computer program, it further performs the following steps: for every two time points among multiple time points in the target historical period, a second distance value is calculated based on the historical state vector corresponding to the two time points; the largest second distance value is selected from the multiple second distance values as the loss threshold.
[0113] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0114] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0115] Obtain operational status data of host assets;
[0116] The runtime status data is vectorized to obtain the target status vector of the host asset;
[0117] Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, determine whether the host asset meets the loss condition, and output the loss detection result if the host asset meets the loss condition.
[0118] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining historical state vectors of the host asset at multiple time points within the target historical period; calculating the distance between the target state vector and each historical state vector to obtain multiple first distance values; filtering the multiple first distance values to obtain a target distance value; and determining whether the host asset meets the trapping condition based on the target distance value.
[0119] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: filtering from a plurality of first distance values to obtain the maximum distance value; and using the maximum distance value as the target distance value.
[0120] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the target distance value is greater than or equal to the loss threshold, it is determined that the host asset meets the loss condition; if the target distance value is less than the loss threshold, it is determined that the host asset does not meet the loss condition.
[0121] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: for every two time points among multiple time points in the target historical period, a second distance value is calculated based on the historical state vector corresponding to the two time points; the largest second distance value is selected from the multiple second distance values as the loss threshold.
[0122] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0123] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:
[0124] Obtain operational status data of host assets;
[0125] The runtime status data is vectorized to obtain the target status vector of the host asset;
[0126] Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, determine whether the host asset meets the loss condition, and output the loss detection result if the host asset meets the loss condition.
[0127] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining historical state vectors of the host asset at multiple time points within the target historical period; calculating the distance between the target state vector and each historical state vector to obtain multiple first distance values; filtering the multiple first distance values to obtain a target distance value; and determining whether the host asset meets the trapping condition based on the target distance value.
[0128] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: filtering from a plurality of first distance values to obtain the maximum distance value; and using the maximum distance value as the target distance value.
[0129] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the target distance value is greater than or equal to the loss threshold, it is determined that the host asset meets the loss condition; if the target distance value is less than the loss threshold, it is determined that the host asset does not meet the loss condition.
[0130] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: for every two time points among multiple time points in the target historical period, a second distance value is calculated based on the historical state vector corresponding to the two time points; the largest second distance value is selected from the multiple second distance values as the loss threshold.
[0131] In one embodiment, the operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
[0132] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0133] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0134] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A method for detecting the loss of host assets, characterized in that, The method includes: Obtain operational status data of host assets; The running status data is vectorized to obtain the target status vector of the host asset; Based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, determine whether the host asset meets the loss condition, and if the host asset meets the loss condition, output the loss detection result.
2. The method according to claim 1, characterized in that, The step of determining whether the host asset meets the compromise conditions based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset includes: Obtain the historical state vector of the host asset at multiple points in time within the target historical period; Calculate the distance between the target state vector and each of the historical state vectors to obtain multiple first distance values; The target distance value is obtained by filtering the plurality of first distance values; Based on the target distance value, determine whether the host asset meets the conditions for being compromised.
3. The method according to claim 2, characterized in that, The step of filtering the plurality of first distance values to obtain the target distance value includes: The maximum distance value is obtained by filtering from the plurality of first distance values; The maximum distance value is used as the target distance value.
4. The method according to claim 2, characterized in that, Determining whether the host asset meets the compromise criteria based on the target distance value includes: If the target distance value is greater than or equal to the loss threshold, then the host asset is determined to meet the loss condition; If the target distance value is less than the compromise threshold, then the host asset is determined not to meet the compromise condition.
5. The method according to claim 4, characterized in that, The method further includes: For each pair of time points within the target historical period, a second distance value is calculated based on the historical state vector corresponding to the two time points. The largest second distance value among multiple second distance values is selected as the loss threshold.
6. The method according to claim 2, characterized in that, The operational status data includes status data across multiple asset dimensions; both the target status vector and the historical status vector are multi-dimensional vectors.
7. A device for detecting the loss of host assets, characterized in that, The device includes: The acquisition module is used to acquire the operating status data of the host assets; A vectorization processing module is used to perform vectorization processing on the running status data to obtain the target status vector of the host asset. The determination module is used to determine whether the host asset meets the loss condition based on the target state vector and the historical state vector corresponding to the historical operating state data of the host asset, and output the loss detection result if the host asset meets the loss condition.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.