Power business behavior non-perception monitoring method and system based on zero interference
By employing lightweight design and dynamic resource management, combined with kernel hook technology and network bypass monitoring, an invisible power business behavior monitoring system is constructed. This solves the problems of high resource consumption and insufficient adaptability of traditional monitoring modes, and achieves high stability and high accuracy monitoring of core power businesses.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-03-13
AI Technical Summary
Traditional monitoring methods cannot achieve accurate perception of the behavior of the core power business system at all levels without interrupting business or affecting performance, and they also suffer from high resource consumption and insufficient adaptability.
It adopts a lightweight design and dynamic resource management, captures behavioral data and network bypass monitoring through kernel hook technology, builds an invisible security awareness base, realizes unobtrusive monitoring and structured processing of cross-node traffic, and constructs a complete behavioral chain through multi-source data fusion and global resource scheduling analysis.
Without disrupting business continuity, it enables precise capture of all levels of power system behavior, reduces resource consumption, improves monitoring accuracy, adapts to complex architectures, identifies hidden threats, and reduces deployment and maintenance difficulty.
Smart Images
Figure CN121664482A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the technical field of network security monitoring, and in particular to a method and system for non-perceptible monitoring of power business behavior based on zero interference. Background Technology
[0002] Currently, core systems such as power dispatch automation and distributed energy management serve as the "nerve center" of power grid operation. Their stability and continuity are directly related to energy supply security. Any interruption, delay, or performance fluctuation may trigger a chain of accidents. Therefore, there are extreme requirements for "zero-interference" monitoring of core power business systems.
[0003] With the escalation of cybersecurity threats, the power industry is facing severe challenges from covert threats such as APT attacks and ransomware. These threats are characterized by "precise targeting and covert behavior," making them easily identifiable and evaded by attackers using traditional monitoring methods, thus hindering effective detection and further highlighting the urgency of strengthening security monitoring. Meanwhile, the complex architecture of power systems involves multiple operating systems, proprietary protocols, and security partitions, with significant differences in technical characteristics across different environments, creating inherent obstacles to comprehensive security monitoring coverage and adaptation. There is a deep-seated contradiction between the special attributes of core power business systems and the limitations of traditional security monitoring technologies. For example, traditional explicit deployment methods often require code injection, network configuration modifications, or shutdown operations to achieve monitoring functions, directly interfering with business continuity; balancing resource consumption and monitoring accuracy is difficult, with heavy proxies or full data collection consuming excessive CPU and memory resources, while reducing the collection scope reduces monitoring accuracy; furthermore, traditional solutions lack adaptability to heterogeneous environments, often resulting in data loss or adaptation failures due to protocol incompatibility and difficulties in cross-partition data flow, failing to meet the monitoring needs of the complex power system architecture. Summary of the Invention
[0004] To address the problem that the traditional monitoring mode of "explicit deployment, high consumption, and strong interference" in existing technologies can no longer meet the dual requirements of "high stability and high continuity" for core power business and "comprehensive perception and accurate identification" for security monitoring, this application provides a zero-interference, non-perceptible monitoring method and system for power business behavior. It can achieve accurate perception of behavior at all levels of "business-data-system-user" without interrupting business or affecting performance, and build an "invisible and low-interference" security perception foundation for the power system.
[0005] Firstly, the above-mentioned inventive objective of this application is achieved through the following technical solution: A zero-interference, non-perceptible monitoring method for power service behavior, the method comprising: Acquire power business behavior data from the power business system and perform data preprocessing to obtain key behavior data and corresponding load status. The key behavior data includes system call behavior, process behavior, and permission change behavior. The key behavioral data is monitored across nodes without being noticed, and the monitored network traffic data is processed in a structured manner to obtain structured behavioral traffic data. The key behavioral data and the behavioral traffic data are integrated to construct a complete behavioral chain and analyze the corresponding data integration resource requirements. Global resource scheduling analysis is performed on the real-time load status and resource usage data during the construction of the complete behavior chain, and the data acquisition frequency and priority of the entire link are coordinated and scheduled to obtain monitoring data of power business behavior.
[0006] In a preferred embodiment, this application can be further configured as follows: the step of acquiring power business behavior data from the power business system and performing data preprocessing to obtain key behavior data and corresponding load status specifically includes: When the power business activity occurs, the power business activity is bypassed and mirrored to obtain independently replicated key behavior data; Obtain the host load status and determine whether the host load is overloaded; if overloaded, obtain the load occupancy status of the key behavior data. Based on the load status, determine the balance between monitoring needs and host performance, and release the resources occupied during the copying of the key behavioral data through a preset scheduling strategy.
[0007] In a preferred embodiment, this application can be further configured as follows: The cross-node service traffic monitoring of the key behavioral data is performed without the user's awareness, and the monitored network traffic data is structured to obtain structured behavioral traffic data, specifically including: The key traffic data of the key behavior data is copied in real time through a pre-configured mirror port and synchronized to a preset micro-isolation probe to obtain cross-node business traffic monitoring data without being noticed. The uninformed monitoring data is decoded and semantically restored to transform unstructured traffic into structured traffic data.
[0008] In a preferred embodiment, this application can be further configured as follows: after performing cross-node business traffic monitoring on the key behavioral data and structuring the monitored network traffic data to obtain structured behavioral traffic data, it also includes... The micro-segmentation probes are deployed in an independent logical network area through a preset network logical isolation mechanism to isolate traffic from the business network; The micro-segmentation probe encrypts and transmits the collected service traffic data from each partition, and after integrity verification, aggregates the partition service traffic data for cross-regional monitoring.
[0009] In a preferred embodiment, this application can be further configured as follows: the fusion of the key behavioral data and the behavioral traffic data for data integration, constructing a complete behavioral chain and analyzing the corresponding data integration resource requirements, specifically includes: Obtain behavioral operation records from the power business system logs, and perform timestamp alignment processing on the key behavioral data, behavioral flow data, and behavioral operation records according to the event occurrence time to obtain time-series consistent multi-source calibration data; The core identifiers of power business behaviors are obtained and used as semantic anchors to construct a semantic anchor mapping mechanism. The multi-source calibration data are associated and aggregated to restore the complete path and context of the behavior, thereby obtaining structured behavior data with business semantics. The structured behavioral data is integrated to construct a complete behavioral chain and the resource requirements during the data integration process are analyzed.
[0010] In a preferred embodiment, this application can be further configured such that: the step of fusing the key behavioral data and the behavioral traffic data to integrate the data, construct a complete behavioral chain, and analyze the corresponding data integration resource requirements also includes: The monitoring components for key behavioral data and behavioral traffic data employ a smooth switching mechanism for continuous data collection, and are installed and initialized using a preset one-click deployment script or container image.
[0011] In a preferred embodiment, this application can be further configured as follows: The real-time load status and resource usage data during the construction of the complete behavior chain are analyzed using global resource scheduling, and the data acquisition frequency and priority of the entire link are coordinated and scheduled to obtain monitoring data of power business behavior. Specifically, this includes: Obtain real-time load status and resource usage data during the construction process of the complete behavior chain, and construct a multi-dimensional resource evaluation model; The multi-dimensional resource assessment model evaluates whether the real-time resource occupancy data is close to a set threshold, and triggers a cross-level collaborative strategy to perform resource collaborative scheduling when the set conditions are met. Obtain the data collection frequency and priority of the entire chain, and according to the set resource priority rules, prioritize the supply of monitoring resources in key business scenarios to form a resource scheduling strategy; According to the resource scheduling strategy, the data acquisition frequency and priority of the entire link are coordinated and scheduled to obtain monitoring data of power business behavior, including reducing the frequency of non-critical protocol parsing and suspending non-real-time fusion tasks.
[0012] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solutions: A zero-interference, non-perceptible monitoring system for power service behavior, wherein the system is applied to the aforementioned zero-interference, non-perceptible monitoring method for power service behavior, and the system comprises: The low-intrusion behavior acquisition layer is used to capture key host behaviors through lightweight agents and kernel hooks, and push the collected key behavior data to the end-to-end transparent integration layer, and synchronize the load status to the dynamic collaboration and security layer. The passive link awareness layer is used to obtain network traffic data through micro-segmentation probes and protocol parsing engines, and transmit it to the end-to-end transparent integration layer after timestamp alignment, and receive resource scheduling instructions from the dynamic coordination and security layer. The end-to-end transparent integration layer is used to merge data from the low-intrusion behavior acquisition layer and the passive link perception layer to form a complete behavior chain, and feeds back the fusion results and resource requirements to the dynamic collaboration and security layer. The dynamic collaboration and security layer is used to receive status feedback from each layer in real time, and coordinate the data acquisition frequency and data processing priority of each layer through global resource scheduling, providing end-to-end encryption support and concealment strategies.
[0013] Thirdly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for non-perceptible monitoring of power business behavior based on zero interference.
[0014] Fourthly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for non-perceptible monitoring of power business behavior based on zero interference.
[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. This application, through a lightweight and stealthy technical design, enhances security awareness capabilities while ensuring the continuity of core power services. By employing core technologies such as kernel-level seamless data collection and network bypass monitoring, it fundamentally solves the pain point of traditional monitoring's "explicit deployment interfering with services." At the host layer, kernel hook technology captures behavioral data at the operating system kernel level without injecting into business processes or modifying application code, ensuring "zero modification" to core business logic such as scheduling command execution and sensitive file access. At the network layer, port mirroring technology replicates traffic without consuming business bandwidth or altering existing routes, avoiding interference with network topology. At the business layer, a mirror copy is generated through "shadow behavior flow" for monitoring; the copy data does not participate in the original business process, ensuring that business results are unaffected. This "stealthy" deployment mode completely eliminates the business interruption risks caused by code injection, configuration modification, or shutdown operations in traditional monitoring, meeting the extreme requirements of high stability and high continuity for core power systems. 2. This application effectively resolves the contradiction between "high resource consumption" and "low monitoring accuracy" in traditional monitoring through lightweight design and dynamic resource management. After functional trimming, the host agent component's size is controlled to within 5MB, its startup memory usage is ≤10MB, its CPU utilization is maintained below 5% under normal conditions, and its disk I / O frequency is ≤10 times / second, far lower than the resource consumption of traditional heavy-duty agents. Simultaneously, the dynamic scheduling algorithm can automatically reduce the collection frequency or pause the collection of non-critical indicators when the host load exceeds a threshold, prioritizing business operations. Based on low resource consumption, through kernel-level deep collection and full network traffic mirroring, it can still achieve accurate capture of behaviors across the entire "business-data-system-user" hierarchy, balancing comprehensive monitoring with system performance stability. 3. This application addresses the complex architecture of power systems with "multiple systems, multiple protocols, and multiple security zones." This method, through cross-platform, multi-protocol adaptation and distributed deployment capabilities, solves the problem of insufficient adaptability in traditional monitoring. The host agent supports Linux, Windows, and domestic operating systems such as Kylin, achieving compatibility across different kernel calls through a unified interface abstraction layer. The network probe can parse power-specific protocols such as IEC 61850 and Modbus, as well as general protocols such as TCP / IP, restoring encrypted or customized traffic to structured data. Simultaneously, it supports the deployment of independent probes in different security zones such as production and dispatching areas, aggregating data through encrypted tunnels to achieve collaborative monitoring of cross-zone behavior. This full-scenario adaptability ensures that the monitoring scope covers key scenarios such as power dispatching centers and substation automation systems, avoiding monitoring blind spots caused by adaptation failures in traditional solutions. 4. This application constructs an "invisible and highly accurate" security awareness foundation for the power system through multi-source data fusion and monitoring concealment design. Multi-source data from host agents, network probes, and log systems, after timestamp alignment and semantic anchor mapping, can form a complete behavioral chain of "user operation - network transmission - system response - data interaction," providing panoramic data support for anomaly detection. The monitoring components do not expose service ports or identification information and interact with the central platform using anonymized communication protocols, preventing attackers from discovering them through scanning or traffic analysis, ensuring the "invisibility" of the monitoring intent. This capability can accurately identify covert threats such as APT attacks and multi-hop chain attacks, while ensuring the security of the monitoring system itself, providing reliable awareness support for the power system. 5. This application employs a smooth switching mechanism for continuous data acquisition, achieving smooth switching through hot-swappable deployment. All components support "plug and play," requiring no restart of business systems or modification of network configurations. Deployment is rapid via one-click scripts or container images, with service interruption time ≤10 seconds, significantly lower than the downtime deployment costs of traditional solutions. This low-intrusive deployment and operation mode reduces the implementation difficulty and business risks for power companies during system upgrades and monitoring expansion, making it easier to promote and apply in core power business scenarios. In summary, this method, through its technical characteristics of "invisible deployment, lightweight design, full-scenario adaptation, and high-precision perception," ensures the continuous and stable operation of core power businesses while enhancing the ability to identify hidden threats, providing a "win-win" solution for power system network security protection. Attached Figure Description
[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.
[0017] Figure 1 This is a flowchart illustrating the implementation of the zero-interference-based, non-perceptible monitoring method for power service behavior in this embodiment.
[0018] Figure 2 This is a flowchart illustrating the implementation of step S10 of the power business behavior non-perceptible monitoring method in this embodiment.
[0019] Figure 3 This is a flowchart illustrating the implementation of step S20 of the power business behavior non-perceptible monitoring method in this embodiment.
[0020] Figure 4 This is a flowchart illustrating the implementation of step S30 of the non-perceptible monitoring method for power business behavior in this embodiment.
[0021] Figure 5 This is a flowchart illustrating the implementation of step S40 of the power business behavior non-perceptible monitoring method in this embodiment.
[0022] Figure 6 This is a structural block diagram of the zero-interference, non-perceptible monitoring system for power business behavior in this embodiment.
[0023] Figure 7 This is a schematic diagram of the internal structure of a computer device used to implement a method for non-perceptible monitoring of power business activities. Detailed Implementation
[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0025] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0026] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0027] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0028] In one embodiment, such as Figure 1 As shown, this application discloses a zero-interference, non-perceptible monitoring method for power business behavior, which specifically includes the following steps: S10: Obtain power business behavior data from the power business system and perform data preprocessing to obtain key behavior data and corresponding load status. Key behavior data includes system call behavior, process behavior, and permission change behavior.
[0029] Specifically, the core objective of the basic perception layer is to accurately capture key behavioral data such as system calls, process behavior, and permission changes without interfering with the operation of host services. While accurately acquiring this key behavioral data, the impact on the business system is minimized, providing underlying support for the stable operation of core power services. Furthermore, to avoid excessive consumption of host resources, a lightweight component architecture design is adopted, with deep pruning of proxy components. Only core collection functions such as system call tracing, process behavior recording, and sensitive permission change monitoring are retained, while unnecessary modules such as log analysis and real-time alarms are eliminated. The size of a single component is strictly controlled to within 5MB, and the memory usage at startup is ≤10MB. This architecture reduces the frequency of interaction between components and the host system, physically reducing the risk of resource contention for business processes and ensuring that the monitoring components themselves do not become a burden on host performance. Figure 2 As shown, step S10 includes: S101: When a power business activity occurs, the power business activity is bypassed and mirrored to obtain independently replicated key behavior data.
[0030] Specifically, kernel hook technology is used to capture behavioral data at a low level, completely avoiding interference with business logic. Hook functions are set up at the operating system kernel level. When critical behaviors occur, these functions copy power business behavior data in real time via bypass mirroring, forming an independent monitoring data stream and obtaining independently copied critical behavior data. The entire process does not inject into any business process address space, does not modify application code or configuration files, and has no intrusive intervention in the business execution flow, ensuring "zero modification" of business logic and accuracy of results.
[0031] S102: Obtain the host load status and determine whether the host load is overloaded, and obtain the load occupancy status of key behavioral data when overloaded.
[0032] Specifically, this embodiment uses an intelligent scheduling algorithm to balance monitoring needs with host performance, achieving fine-grained control over resource usage. Under normal circumstances, the algorithm keeps the CPU utilization of the proxy component stable below 5%, and the disk I / O operation frequency ≤ 10 times / second, avoiding resource contention for core host services. The algorithm acquires the host load status in real time and determines whether the host load exceeds a preset threshold. When the host load exceeds the preset threshold, it indicates that the host is overloaded, and key behavioral data on the host's load usage status is acquired during overload.
[0033] S103: Based on the load status, determine the balance between monitoring needs and host performance, and release the resources occupied during the replication of critical behavioral data through a preset scheduling strategy.
[0034] Specifically, based on the load status, the system determines the balance between monitoring needs and host performance, obtains the load status of power business activities at all levels and the corresponding monitoring needs, coordinates the monitoring needs at multiple levels with host performance, prioritizes reducing the data collection of non-critical indicators and reduces the collection frequency of core indicators through preset scheduling strategies, releases resources to the business system, and automatically resumes full data collection after the host load returns to normal, ensuring business continuity is prioritized.
[0035] This embodiment addresses the heterogeneous environment of power systems where Linux, Windows, and domestic operating systems such as Kylin and NeoKylin coexist. A unified interface abstraction layer is designed to achieve cross-platform compatibility. The abstraction layer encapsulates the kernel call differences between different operating systems, providing consistent behavioral data acquisition capabilities to the upper-layer acquisition logic through standardized interfaces. For example, for Linux systems, it adapts to their kernel module loading mechanism; for Windows systems, it is compatible with their driver signing specifications; and for domestic operating systems, it deeply integrates with kernel interface documentation, ensuring stable kernel-level behavioral capture across different system environments. This adaptation method eliminates the need to develop dedicated components for different systems, reducing deployment complexity while ensuring consistency and reliability of cross-platform data acquisition.
[0036] It's important to note that for monitoring core business operations, a "shadow behavior flow" technology is employed to achieve parallel processing of business execution and monitoring analysis. When a core business operation is triggered, the system generates a mirror copy—the "shadow behavior flow"—in real time, completely identical to the original operation, without interfering with the original business process. This copy data is independent of the original business chain and serves only as input material for monitoring and analysis; it does not participate in business logic judgments, result storage, or subsequent interaction processes. Through this "dual-track parallel" mechanism, it ensures that the original results of the business operation are unaffected by monitoring behavior while fully capturing key behavioral characteristics during business execution, achieving "zero interference" between monitoring and business operations.
[0037] S20: Perform cross-node business traffic monitoring on key behavioral data without the user's awareness, and perform structured processing on the monitored network traffic data to obtain structured behavioral traffic data.
[0038] Specifically, this embodiment achieves seamless monitoring of cross-node service traffic and behavior links without altering the network topology or consuming service bandwidth, providing complete network layer data support for abnormal behavior detection and security threat tracing. For example... Figure 3 As shown, step S20 includes: S201: Real-time replication of critical traffic data for key behaviors through pre-configured mirror ports, and synchronization to preset micro-segmentation probes, to obtain seamless monitoring data of cross-node business traffic.
[0039] Specifically, critical traffic data is copied in real time through pre-configured mirror ports to achieve non-intrusive traffic capture. Micro-segmentation probes are deployed at key nodes of the power core network. By configuring the mirror ports of the devices, critical traffic flowing through the core business links is copied in real time to the monitoring ports of the probes, resulting in seamless monitoring of cross-node business traffic. Throughout the process, the transmission path, bandwidth usage, and routing strategy of the original business traffic remain unchanged. The probes act only as "observers," receiving the mirrored traffic, avoiding any delays or interference to the original network communication, and ensuring the real-time and continuous transmission of business data.
[0040] S202: Decode the traffic and perform semantic restoration on the uninformed monitored data to transform unstructured traffic into structured traffic data.
[0041] Specifically, considering the complex protocol types in power systems, a parsing engine compatible with multiple protocol types is designed to achieve structured reconstruction of heterogeneous traffic. The engine incorporates a dedicated protocol parsing module for the power industry, supporting deep parsing of proprietary protocols such as IEC 61850, Modbus, and DNP3, extracting core business fields such as instruction IDs, operation parameters, device status codes, and response times. It also integrates general protocol parsing capabilities, decoding traffic for common protocols such as TCP / IP, HTTP, and HTTPS to reconstruct user operation sequences and data interaction content. For encrypted or customized traffic, semantic reconstruction is achieved through protocol feature matching and session context analysis, transforming unstructured traffic into structured traffic data containing operation subjects, objects, time, and results, providing a data foundation for reconstructing cross-network behavior chains.
[0042] In this embodiment, step S20 further includes: S203: Deploy micro-segmentation probes in an independent logical network area through a preset network logical isolation mechanism to isolate traffic from the business network.
[0043] Specifically, a pre-defined network logical isolation mechanism achieves physical decoupling between the probe and the business network, eliminating security risks associated with monitoring components. VLAN virtual LAN segmentation technology is used to deploy the probe in an independent logical network area, forming strict traffic isolation from the business network. The probe is only granted traffic reception permissions, without any write, control, or configuration modification permissions to the business network, and cannot actively interfere with business devices or communication links. Simultaneously, the probe itself is designed with the principle of least privilege, closing unnecessary service ports and disabling remote login functionality. Firmware hardening and signature verification are used to prevent malicious tampering, avoiding becoming a potential entry point for attackers to intrude into the business network, and ensuring the security and controllability of network layer monitoring activities.
[0044] S204: The micro-segmentation probe encrypts and transmits the collected service traffic data from each partition, and after passing integrity verification, aggregates the partition service traffic data for cross-regional monitoring.
[0045] Specifically, for the partitioned and isolated architecture of the power system, a distributed probe deployment and centralized data aggregation model is adopted to achieve cross-regional monitoring. Independent micro-isolated probes are deployed within each security partition to collect business traffic within that partition. Probes are logically separated through physical isolation or unidirectional gateways to avoid direct data interaction across partitions. Data collected by each partition probe is transmitted to the central analysis platform via encrypted tunnels and security boundary protection equipment. The tunnels employ high-strength encryption algorithms to ensure data confidentiality and integrity verification mechanisms to prevent data tampering. The central platform aggregates data from all partitions, facilitating subsequent timestamp alignment, spatial correlation analysis, and the construction of a complete behavioral chain across security partitions, enabling global monitoring and collaborative analysis of distributed power services.
[0046] S30: Integrate key behavioral data and behavioral traffic data to build a complete behavioral chain and analyze the corresponding data integration resource requirements.
[0047] Specifically, step S30 provides comprehensive data support for anomaly detection, ensuring the continuity of core power operations and providing high-quality comprehensive data support for security monitoring, effectively improving the ability to identify hidden threats, such as... Figure 4 As shown, step S30 includes: S301: Obtain the behavior operation records in the power business system log, and perform timestamp alignment processing on the key behavior data, behavior flow data and behavior operation records according to the event occurrence time to obtain time-series consistent multi-source calibration data.
[0048] Specifically, relevant behavioral operation records are obtained from the operation logs of the power business system. Based on the time of the event, high-precision timestamp alignment technology is used to perform timestamp alignment processing on key behavioral data captured by the host agent, behavioral traffic data collected by the network probe, and behavioral operation traces recorded in the logs. This calibrates the multi-source data to a unified time dimension, ensuring the temporal consistency of behavioral events and obtaining time-consistent multi-source calibration data.
[0049] S302: Obtain the core identifier of power business behavior and use it as a semantic anchor to build a semantic anchor mapping mechanism. Perform correlation and aggregation on multi-source calibration data, restore the complete path and context of behavior, and obtain structured behavior data with business semantics.
[0050] Specifically, core identifiers of power business behaviors, such as "user ID," "equipment number," and "instruction ID," are acquired. These core identifiers are then used as semantic anchors to establish a semantic anchor mapping mechanism. Fragmented multi-source calibration data scattered across different data sources are then correlated and aggregated to reconstruct the complete path and context of the behavior. Through this fusion approach, previously isolated data is transformed into structured behavioral data with business semantics, providing a panoramic analytical basis for anomaly detection models.
[0051] S303: Integrate structured behavioral data, construct a complete behavioral chain, and analyze the resource requirements during the data integration process.
[0052] Specifically, structured behavioral data is integrated to construct a complete behavioral chain of "user operation - network transmission - system response - data interaction", and the resources required in the data integration process are analyzed.
[0053] Step S30 in this embodiment further includes: S304: The monitoring components for key behavioral data and behavioral traffic data use a smooth switching mechanism for continuous data collection, and the components are installed and initialized through a preset one-click deployment script or container image.
[0054] In this embodiment, to meet the high availability requirements of the power system, all monitoring components adopt a "plug-and-play" hot-swappable design, completely eliminating the impact of deployment on business operations. Deployment requires no restart of the business system, no modification to the network topology or application configuration; component installation and initialization can be quickly completed in the existing environment using pre-built one-click deployment scripts or container images. After startup, the components automatically connect to the monitoring network and establish a connection with the central platform through a dynamic service discovery mechanism. The entire deployment process strictly controls the business interruption time to within 10 seconds. For scenarios requiring expansion or upgrades, online component replacement is also supported. A smooth switching mechanism ensures the continuity of data collection, avoids monitoring blind spots caused by deployment operations, and guarantees the continuous and stable operation of the business system.
[0055] Specifically, through a preset smooth switching mechanism, the monitoring components corresponding to key behavioral data and behavioral traffic data are continuously collected, and the components are installed and initialized through a preset one-click deployment script or container image.
[0056] S40: Perform global resource scheduling analysis on real-time load status and resource usage data during the construction of the complete behavior chain, and coordinate the data acquisition frequency and priority of the entire link to obtain monitoring data of power business behavior.
[0057] Specifically, step S40 bears the core responsibility of technical coordination and linkage at all levels, global resource optimization, and security protection of the monitoring system itself. It provides core support for the stable operation of the entire stealth monitoring system, ensuring continuous performance of security awareness capabilities while guaranteeing the continuity of power services. For example... Figure 5 As shown, step S40 includes: S401: Obtain real-time load status and resource usage data during the construction process of the complete behavior chain, and build a multi-dimensional resource evaluation model.
[0058] Specifically, to balance the resource consumption and business needs of the low-intrusion behavior acquisition layer, passive link awareness layer, and end-to-end transparent integration layer, a global dynamic resource scheduling system is constructed to achieve intelligent allocation and elastic adjustment of monitored resources. The system collects resource usage data of components at each level in real time and establishes a multi-dimensional resource assessment model based on the real-time load status of the business system.
[0059] S402: When the real-time resource occupancy data is evaluated by a multi-dimensional resource assessment model and approaches a set threshold, a cross-level collaborative strategy is triggered to perform resource collaborative scheduling when the set conditions are met.
[0060] Specifically, a multi-dimensional resource assessment model is used to evaluate whether real-time resource usage data is approaching a set threshold. In this embodiment, a safety threshold range is set to determine whether the resource usage data falls within this range. When resource usage at a certain level approaches the threshold, the scheduling system automatically triggers cross-level collaborative strategies: for example, reducing the frequency of non-critical protocol parsing by network probes to release computing resources; or suspending non-real-time fusion tasks at the data layer to prioritize the collection and transmission of core behavioral data. Simultaneously, preset resource priority rules ensure the supply of monitoring resources in critical business scenarios, achieving a dynamic balance of "no business interruption, no monitoring degradation."
[0061] S403: Obtain the data acquisition frequency and priority of the entire link, and according to the set resource priority rules, prioritize the supply of monitoring resources in key business scenarios to form a resource scheduling strategy.
[0062] Specifically, the frequency and priority of full-link data collection for the complete behavior chain are obtained. According to the set resource priority rules, monitoring resources in key business scenarios are given priority, while the frequency of non-critical protocol parsing or non-real-time fusion tasks and data collection tasks are reduced or suspended, thus forming a resource scheduling strategy.
[0063] S404: Coordinate the data acquisition frequency and priority of the entire link according to the resource scheduling strategy to obtain monitoring data of power business behavior, including reducing the frequency of non-critical protocol parsing and suspending non-real-time fusion tasks.
[0064] Specifically, the data acquisition frequency and priority of the entire chain are coordinated and scheduled according to the resource scheduling strategy. For example, the data monitoring priority of key behaviors is increased and monitoring resources are given priority, while the frequency of non-critical or non-real-time tasks is reduced. Coordinated scheduling is carried out in the entire chain of data acquisition and processing to obtain monitoring data of power business behaviors.
[0065] To address the partitioned and isolated architecture of the power system, an end-to-end encrypted transmission system is constructed to ensure the security of data flow across regions and levels. At the data acquisition end, raw behavioral data collected by host agents and network probes is locally encrypted using lightweight encryption algorithms to prevent data theft at host memory or network interfaces. During data transmission, an IPSec VPN encrypted tunnel is used to aggregate data across security partitions. The tunnel supports dynamic key negotiation and periodic updates to ensure the transmission link's resistance to interception. For control command interactions between the central platform and various monitoring components, the TLS 1.3 protocol is used for two-way authentication and data encryption to prevent command tampering or forgery. In the data storage stage, the merged behavioral data is encrypted and stored using an encrypted storage engine, and the keys are managed by a hardware security module to prevent unauthorized access, forming a secure closed loop of end-to-end encryption.
[0066] To prevent the monitoring system from becoming a target for attackers or being evaded, multi-layered anonymity techniques are employed to ensure the "stealth" and "anti-probe" nature of the monitoring behavior. Regarding component identification anonymity, all monitoring components use anonymous naming rules, containing no characteristic fields that could identify their function, and do not expose service ports or communication identifiers. Communication with the central platform is achieved through dynamic port mapping technology, avoiding detection by port scanning. Regarding traffic feature anonymity, monitoring data transmission employs "business traffic mimicry" technology, ensuring that the size, frequency, and protocol characteristics of monitoring data packets are consistent with normal business traffic. Traffic obfuscation algorithms hide the unique patterns of monitoring behavior, preventing attackers from identifying the monitoring link through traffic analysis. Regarding behavioral feature anonymity, resource usage fluctuations of monitoring components are controlled within the range of normal business processes, avoiding abnormal behavior alarms caused by sudden high CPU / memory usage. Simultaneously, the active probing function of components is disabled, collecting data only through passive listening, reducing active interaction with business systems and lowering the risk of detection through behavioral patterns.
[0067] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0068] In one embodiment, a zero-interference-based, non-perceptible monitoring system for power service behavior is provided, which corresponds one-to-one with the zero-interference-based, non-perceptible monitoring method for power service behavior described in the above embodiments. For example... Figure 6 As shown, this zero-interference, non-intrusive monitoring system for power business behavior includes a low-intrusion behavior acquisition layer, a passive link sensing layer, a full-link transparent integration layer, and a dynamic coordination and security layer. Detailed descriptions of each functional module are as follows: The low-intrusion behavior acquisition layer is used to capture key host behaviors through lightweight agents and kernel hooks, and push the collected key behavior data to the end-to-end transparent integration layer, and synchronize the load status to the dynamic collaboration and security layer. The passive link awareness layer is used to obtain network traffic data through micro-segmentation probes and protocol parsing engines, and transmit it to the end-to-end transparent integration layer after timestamp alignment, and receive resource scheduling instructions from the dynamic coordination and security layer. The end-to-end transparent integration layer is used to merge data from the low-intrusion behavior acquisition layer and the passive link perception layer to form a complete behavior chain, and feeds back the fusion results and resource requirements to the dynamic collaboration and security layer. The dynamic collaboration and security layer is used to receive status feedback from each layer in real time, and coordinate the data acquisition frequency and data processing priority of each layer through global resource scheduling, providing end-to-end encryption support and concealment strategies.
[0069] This method achieves seamless monitoring of core power business behaviors through a full-link design of "layered acquisition - data integration - collaborative assurance". The four core modules do not operate independently, but form an organic whole through data interaction, resource linkage, and policy coordination: The low-intrusion behavior acquisition layer captures key host behaviors through lightweight proxy and kernel hook technology, pushes the data to the full-link transparent integration layer, and synchronizes the load status to the dynamic collaboration and security layer; the passive link awareness layer obtains network traffic data based on micro-segmentation probes and protocol parsing engines, transmits it to the full-link transparent integration layer after preliminary timestamp alignment, and simultaneously receives resource scheduling instructions from the dynamic collaboration and security layer; the full-link transparent integration layer integrates the data from the low-intrusion behavior acquisition layer and the passive link awareness layer to form a complete behavior chain, and feeds back the integration results and resource requirements to the dynamic collaboration and security layer, whose deployment configuration and transmission security are managed by the dynamic collaboration and security layer; the dynamic collaboration and security layer acts as the central hub, receiving real-time status feedback from each layer, coordinating the acquisition frequency and data priority of each layer through global resource scheduling, and providing full-link encryption support and concealment strategies. Ultimately, through the collaborative operation of the four modules, a closed-loop, end-to-end stealth monitoring system was achieved, encompassing everything from the host to the network, and from data acquisition to security assurance. This provides the core power system with accurate and continuous behavioral perception capabilities without interfering with business operations.
[0070] Specific limitations regarding the zero-interference-based seamless monitoring system for power business behavior can be found in the limitations of the zero-interference-based seamless monitoring method for power business behavior described above, and will not be repeated here. Each module in the aforementioned zero-interference-based seamless monitoring system for power business behavior can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0071] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores non-intrusive monitoring data of power business activities. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a zero-interference, non-intrusive monitoring method for power business activities.
[0072] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the steps of a method for non-perceptible monitoring of power business behavior based on zero interference.
[0073] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application of the technical solution and the constraints involved. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.
[0074] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.
[0075] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0076] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.
[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.
Claims
1. A method for non-perceptible monitoring of power business behavior based on zero interference, characterized in that, The method includes: Acquire power business behavior data from the power business system and perform data preprocessing to obtain key behavior data and corresponding load status. The key behavior data includes system call behavior, process behavior, and permission change behavior. The key behavioral data is monitored across nodes without being noticed, and the monitored network traffic data is processed in a structured manner to obtain structured behavioral traffic data. The key behavioral data and the behavioral traffic data are integrated to construct a complete behavioral chain and analyze the corresponding data integration resource requirements. Global resource scheduling analysis is performed on the real-time load status and resource usage data during the construction of the complete behavior chain, and the data acquisition frequency and priority of the entire link are coordinated and scheduled to obtain monitoring data of power business behavior.
2. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 1, characterized in that, The process of acquiring power business behavior data from the power business system and performing data preprocessing to obtain key behavior data and corresponding load status specifically includes: When the power business activity occurs, the power business activity is bypassed and mirrored to obtain independently replicated key behavior data; Obtain the host load status and determine whether the host load is overloaded; if overloaded, obtain the load occupancy status of the key behavior data. Based on the load status, determine the balance between monitoring needs and host performance, and release the resources occupied during the copying of the key behavioral data through a preset scheduling strategy.
3. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 1, characterized in that, The process of performing seamless cross-node business traffic monitoring on the key behavioral data and structuring the monitored network traffic data to obtain structured behavioral traffic data specifically includes: The key traffic data of the key behavior data is copied in real time through a pre-configured mirror port and synchronized to a preset micro-isolation probe to obtain cross-node business traffic monitoring data without being noticed. The uninformed monitoring data is decoded and semantically restored to transform unstructured traffic into structured traffic data.
4. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 1, characterized in that, The process of performing seamless cross-node business traffic monitoring on the key behavioral data, and then structuring the monitored network traffic data to obtain structured behavioral traffic data, further includes... The micro-segmentation probes are deployed in an independent logical network area through a preset network logical isolation mechanism to isolate traffic from the business network; The micro-segmentation probe encrypts and transmits the collected service traffic data from each partition, and after integrity verification, aggregates the partition service traffic data for cross-regional monitoring.
5. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 1, characterized in that, The process of integrating the key behavioral data and the behavioral traffic data to construct a complete behavioral chain and analyze the corresponding data integration resource requirements specifically includes: Obtain behavioral operation records from the power business system logs, and perform timestamp alignment processing on the key behavioral data, behavioral flow data, and behavioral operation records according to the event occurrence time to obtain time-series consistent multi-source calibration data; The core identifiers of power business behaviors are obtained and used as semantic anchors to construct a semantic anchor mapping mechanism. The multi-source calibration data are associated and aggregated to restore the complete path and context of the behavior, thereby obtaining structured behavior data with business semantics. The structured behavioral data is integrated to construct a complete behavioral chain and the resource requirements during the data integration process are analyzed.
6. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 5, characterized in that, The process of integrating the key behavioral data and the behavioral traffic data to construct a complete behavioral chain and analyze the corresponding data integration resource requirements also includes: The monitoring components for key behavioral data and behavioral traffic data employ a smooth switching mechanism for continuous data collection, and are installed and initialized using a preset one-click deployment script or container image.
7. The method for non-perceptible monitoring of power business behavior based on zero interference according to claim 1, characterized in that, The process of constructing the complete behavior chain involves global resource scheduling analysis of real-time load status and resource usage data, and coordinated scheduling of data acquisition frequency and priority across the entire chain to obtain monitoring data for power business behavior. Specifically, this includes: Obtain real-time load status and resource usage data during the construction process of the complete behavior chain, and construct a multi-dimensional resource evaluation model; The multi-dimensional resource assessment model evaluates whether the real-time resource occupancy data is close to a set threshold, and triggers a cross-level collaborative strategy to perform resource collaborative scheduling when the set conditions are met. Obtain the data collection frequency and priority of the entire chain, and according to the set resource priority rules, prioritize the supply of monitoring resources in key business scenarios to form a resource scheduling strategy; According to the resource scheduling strategy, the data acquisition frequency and priority of the entire link are coordinated and scheduled to obtain monitoring data of power business behavior, including reducing the frequency of non-critical protocol parsing and suspending non-real-time fusion tasks.
8. A zero-interference, non-perceptible monitoring system for power business behavior, characterized in that, The system is applied to the zero-interference, non-perceptible monitoring method for power service behavior based on any one of claims 1-7, and the system comprises: The low-intrusion behavior acquisition layer is used to capture key host behaviors through lightweight agents and kernel hooks, and push the collected key behavior data to the end-to-end transparent integration layer, and synchronize the load status to the dynamic collaboration and security layer. The passive link awareness layer is used to obtain network traffic data through micro-segmentation probes and protocol parsing engines, and transmit it to the end-to-end transparent integration layer after timestamp alignment, and receive resource scheduling instructions from the dynamic coordination and security layer. The end-to-end transparent integration layer is used to merge data from the low-intrusion behavior acquisition layer and the passive link perception layer to form a complete behavior chain, and feeds back the fusion results and resource requirements to the dynamic collaboration and security layer. The dynamic collaboration and security layer is used to receive status feedback from each layer in real time, and coordinate the data acquisition frequency and data processing priority of each layer through global resource scheduling, providing end-to-end encryption support and concealment strategies.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the zero-interference-based non-perceptible monitoring method for power service behavior as described in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the zero-interference-based non-perceptible monitoring method for power business behavior as described in any one of claims 1 to 7.