Process anomaly detection method and system based on flexible gray measurement and calculation

Abstract

The invention discloses a process anomaly detection method and system based on flexible gray scale measurement, and the method comprises the steps: obtaining the task execution behavior and process resource use condition of each task process in the operation process of a power grid, obtaining the process information of a host, and obtaining the process information of the host according to the power resource calling sequence of each power grid task; constructing a corresponding task process tree in combination with the process running information and the hidden process information, analyzing a process inheritance relationship between adjacent processes of the task process tree, and according to the process resource consumption information and the process inheritance relationship, carrying out process behavior portraying on each task process and detecting an abnormal behavior in the process. And obtaining an abnormal process behavior of the current task process, performing abnormal gray calculation on the current task process according to the abnormal process behavior, and evaluating whether the current task process is an abnormal process or not to obtain abnormal process detection data. The method and the device have the effects of improving the detection accuracy of the abnormal process behavior and reducing the probability of false alarm and missing alarm of abnormal detection.

Description

A process anomaly detection method and system based on flexible grayscale measurement Technical Field

[0001] This invention relates to the technical field of process detection, and in particular to a method and system for detecting process anomalies based on flexible grayscale measurement. Background Technology

[0002] Currently, with the digital transformation of power grid enterprises, the information management architecture and business logic of the power grid are also growing exponentially. Given the complexity and interaction between the power grid organization and business logic, whether the main power grid process is running normally has become one of the key factors affecting the normal operation of the entire power grid.

[0003] Existing process anomaly detection typically relies on fixed rules applied to external security boundaries. These rules capture specific behaviors by setting fixed parameters and trigger alerts when processes exhibit behavior matching these parameters. However, this approach is problematic when different applications, processes, and business logic differ, user behavior changes frequently, or user access behavior significantly deviates from the set process detection rules. This makes it difficult to detect process anomalies promptly using fixed-parameter rules, and it is prone to false positives and false negatives. Therefore, the aforementioned technologies suffer from the drawback of being prone to false positives and false negatives in process anomaly detection. Summary of the Invention

[0004] To address the issues of false positives and false negatives in process anomaly detection in existing technologies, this application provides a process anomaly detection method and system based on flexible grayscale calculation, which can improve the detection accuracy of abnormal process behavior and reduce the probability of false positives and false negatives in anomaly detection.

[0005] Firstly, the above-mentioned inventive objective of this application is achieved through the following technical solution: a process anomaly detection method based on flexible grayscale calculation, comprising: acquiring the task execution behavior and process resource usage of each task process during power grid operation to obtain host process information, wherein the host process information includes process running information, hidden process information, and process resource consumption information; acquiring the power resource call order of each power grid task, constructing a corresponding task process tree by combining the process running information and the hidden process information, and analyzing the process inheritance relationship between adjacent processes in the task process tree; performing process behavior profiling on each task process according to the process resource consumption information and the process inheritance relationship, and detecting abnormal behavior in the process to obtain the abnormal process behavior of the current task process; performing abnormal grayscale calculation on the current task process according to the abnormal process behavior, evaluating whether the current task process is an abnormal process based on the abnormal grayscale calculation result, and obtaining abnormal process detection data.

[0006] In a preferred embodiment, this application can be further configured as follows: the step of performing anomaly grayscale calculation on the current task process based on the abnormal process behavior, and evaluating whether the current task process is an abnormal process based on the anomaly grayscale calculation result to obtain abnormal process detection data, specifically includes: obtaining historical host process information for each task process; constructing a normally operating historical task process tree based on the historical host process information to obtain a grayscale calculation model for simulating the real operating environment of the power grid; performing grayscale simulation operation on the abnormal process behavior through the grayscale calculation model to obtain a simulated running process tree of the abnormal process behavior; comparing the process behavior with the pre-trained historical task process tree of the same process in the grayscale calculation model according to the process unique identifier code to obtain abnormal process information; predicting the abnormal deviation trend between the abnormal process information and the historical task process tree, and evaluating whether the current task process is an abnormal process based on the abnormal deviation trend to obtain abnormal process detection data.

[0007] In a preferred embodiment, this application can be further configured as follows: obtaining historical host process information for each task process, constructing a historical task process tree under normal operation based on the historical host process information, and obtaining a grayscale measurement model for simulating the real operating environment of the power grid, specifically includes: comparing all historical host process information of the same task process to obtain common process characteristics and corresponding process behavior indicators of the same task process; comparing the historical task process tree of the same task process to analyze the process tree inheritance relationship under normal operation, and constructing a grayscale measurement model by combining the common process characteristics and the process behavior indicators.

[0008] In a preferred embodiment, this application can be further configured as follows: the step of creating a process behavior profile for each task process based on the process resource consumption information and the process inheritance relationship, and detecting abnormal behavior in the process to obtain a process behavior profile of the abnormal process behavior of the current task process, specifically includes: constructing a process behavior baseline based on the process resource consumption information and the process inheritance relationship, analyzing the process behavior characteristics of the process behavior baseline and marking their importance, to obtain a process behavior profile of the corresponding task process.

[0009] In a preferred embodiment, this application can be further configured as follows: the process of creating a process behavior profile for each task process based on the process resource consumption information and the process inheritance relationship, and detecting abnormal behavior in the process to obtain the abnormal behavior detection process of the current task process, specifically includes: predicting the next access process of the current task process according to the process behavior profile, associating the prediction results of all next access processes, and combining them with the process inheritance relationship to obtain the predicted access path of the current task process; obtaining the real-time access path of the current task process, comparing the real-time access path with the predicted access path one by one starting from the root process to obtain the abnormal access processes that deviate from the predicted access path; predicting the abnormal deviation trend of subsequent processes based on the abnormal access processes, obtaining the access behavior of all access child processes along the abnormal deviation trend, and obtaining the abnormal behavior detection result of the current task process.

[0010] In a preferred embodiment, this application can be further configured as follows: predicting the abnormal deviation trend of subsequent processes based on the abnormal access process, obtaining the access behavior of all accessing child processes on the abnormal deviation trend, and obtaining the abnormal behavior detection result of the current task process, specifically includes: constructing a deviation isolation tree of all accessing child processes on the abnormal deviation trend based on the abnormal deviation trend, and scoring the deviation isolation tree for abnormal deviation, wherein the abnormal deviation scoring expression is as follows: (1) Among them, This indicates an abnormal deviation from the score. Indicates the process from the root process to the child process. Path length The average value, Indicates the number of child processes accessed. Path length The average value; according to the abnormal deviation score, the isolated access behavior of all accessing subprocesses on the abnormal deviation trend is marked as abnormal, and the abnormal behavior detection result of the current task process is obtained.

[0011] In a preferred embodiment, this application can be further configured as follows: obtaining the power resource call order of each power grid task, constructing a corresponding task process tree by combining the process running information and the hidden process information, and analyzing the process inheritance relationship between adjacent processes in the task process tree, specifically includes: obtaining the parent process code segment and power resource call code segment of each power grid task; searching for target child processes that inherit the parent process code segment and the previous power resource call code segment among all child processes of the same task process; sequentially associating the target child processes according to the power resource call order to construct a task process tree; and analyzing the process inheritance relationship between adjacent processes according to the code segment sharing state in the task process tree.

[0012] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solution: a process anomaly detection system based on flexible grayscale calculation, wherein the system is applied to the above-mentioned process anomaly detection method based on flexible grayscale calculation, the system comprising: an information acquisition module, used to acquire the task execution behavior and process resource usage of each task process during power grid operation, and obtain host process information, wherein the host process information includes process running information, hidden process information and process resource consumption information; a process tree construction module, used to acquire the power resource call order of each power grid task, construct a corresponding task process tree in combination with the process running information and the hidden process information, and analyze the process inheritance relationship between adjacent processes in the task process tree; an abnormal behavior analysis module, used to profile the process behavior of each task process according to the process resource consumption information and the process inheritance relationship, and detect abnormal behavior in the process to obtain the abnormal process behavior of the current task process; and an abnormal process detection module, used to perform abnormal grayscale calculation on the current task process according to the abnormal process behavior, evaluate whether the current task process is an abnormal process according to the abnormal grayscale calculation result, and obtain abnormal process detection data.

[0013] Thirdly, the above-mentioned objective of this application is achieved through the following technical solution: a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-mentioned process anomaly detection method based on flexible grayscale measurement.

[0014] Fourthly, the above-mentioned objective of this application is achieved through the following technical solution: a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned process anomaly detection method based on flexible grayscale measurement.

[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. By collecting host process information, this application comprehensively understands the possible hidden processes and process resource consumption, and constructs a task process tree in conjunction with the power resource call order and analyzes the process inheritance relationship between adjacent processes. This helps to analyze process behavior more intuitively, further refines the abnormal analysis indicators of process behavior through process behavior profiling, performs multi-faceted detection of abnormal behavior in processes, improves the accuracy of judging abnormal process behavior, evaluates and judges abnormal processes by combining gray-scale measurement, and performs double authentication on the abnormal process detection results, improving the accuracy of abnormal process behavior detection and reducing the probability of false alarms and missed alarms in abnormal detection; 2. This application constructs a historical task process tree through historical host process information, builds a gray-scale measurement model through the historical task process tree under normal operation, improves the realism of abnormal process behavior analysis by simulating the real operating environment of the power grid, and constructs a simulated running process tree related to abnormal process behavior through gray-scale simulation of abnormal process behavior. Abnormal processes are obtained through process behavior comparison. The application analyzes process behavior characteristics based on a process behavior baseline and labels them according to the importance of process behavior to obtain a process behavior profile of the task process. It then predicts the next access process based on the process behavior profile and obtains the predicted access path of the current task process according to the prediction results and process inheritance relationship. By comparing the real-time access path with the predicted access path, the application obtains abnormal access processes that deviate from the predicted access path. This provides data support for the determination of abnormal access processes that are consistent with the process behavior profile. Based on the abnormal deviation trend prediction results, the access behavior of all access subprocesses on the abnormal deviation trend is regarded as abnormal behavior, and the abnormal behavior detection results are obtained, which helps to improve the accuracy of abnormal behavior detection. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 is a flowchart of the process anomaly detection method based on flexible grayscale measurement in this embodiment.

[0018] Figure 2 is a flowchart of step S20 of the process anomaly detection method in this embodiment.

[0019] Figure 3 is a flowchart of step S30 of the process anomaly detection method in this embodiment.

[0020] Figure 4 is a flowchart of step S304 of the process anomaly detection method in this embodiment.

[0021] Figure 5 is a flowchart of step S40 of the process anomaly detection method in this embodiment.

[0022] Figure 6 is a flowchart of step S401 of the process anomaly detection method in this embodiment.

[0023] Figure 7 is a structural block diagram of the process anomaly detection system based on flexible grayscale measurement in this embodiment.

[0024] Figure 8 is a schematic diagram of the internal structure of a computer device used to implement a process anomaly detection method based on flexible grayscale measurement. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0027] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0028] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] In one embodiment, as shown in FIG1, this application discloses a process anomaly detection method based on flexible grayscale calculation, which specifically includes the following steps: S10: during the operation of the power grid, the task execution behavior and process resource usage of each task process are obtained to obtain host process information, which includes process running information, hidden process information and process resource consumption information.

[0030] Specifically, during the operation of the power grid, the task execution behavior and process resource usage of power production, operation and dispatch management tasks are obtained through host logs. Process resource usage includes the use of resources such as telecommunications traffic and computing power. According to the process running status, it is divided into running process running information and hidden process information in dormant or not started state, as well as the corresponding process resource consumption information, to obtain host process information.

[0031] S20: Obtain the power resource call order for each power grid task, construct the corresponding task process tree by combining process running information and hidden process information, and analyze the process inheritance relationship between adjacent processes in the task process tree.

[0032] Specifically, as shown in Figure 2, step S20 includes: S201: Obtain the parent process code segment and power resource call code segment of each power grid task, and search for the target child process that inherits the parent process code segment and the previous power resource call code segment among all child processes of the same task process.

[0033] Specifically, based on the power transmission and distribution tasks of the power grid, when the corresponding power grid task is created, the parent process code segment and the code segment corresponding to the power resource call task are obtained. According to the power resource scheduling order, the target child process that inherits the parent process code segment and the previous power resource scheduling code segment is searched among all child processes of the same task process.

[0034] S202: Construct a task process tree by sequentially associating the target subprocesses according to the order of power resource call, and analyze the process inheritance relationship between adjacent processes according to the code segment sharing state in the task process tree.

[0035] Specifically, according to the order of power resource allocation, the target child processes are sequentially associated to construct a task process tree. Through the coherent inheritance of parent process inheritance and power resource allocation order, a unique task process tree that conforms to the current power dispatching task is constructed, improving the authenticity and uniqueness of the task process tree. Furthermore, according to the code segment sharing status in the task process tree, such as the parent process code segment being shared between the parent process and the next child process, or the power resource dispatching code segment of the previous child process being shared between adjacent child processes, the process inheritance relationship between adjacent processes is obtained based on the code segment sharing status.

[0036] S30: Based on process resource consumption information and process inheritance relationships, create a process behavior profile for each task process, detect abnormal behavior in the process, and obtain the abnormal process behavior of the current task process.

[0037] Specifically, as shown in Figure 3, step S30 includes: S301: Constructing a process behavior baseline based on process resource consumption information and process inheritance relationship, analyzing the process behavior characteristics of the process behavior baseline and marking their importance, and obtaining a process behavior profile of the corresponding task process.

[0038] Specifically, based on process resource consumption information and process inheritance relationships, a process behavior baseline for current power resource scheduling is constructed. All power scheduling behaviors on the process behavior baseline are obtained, and power scheduling behavior features are extracted and tagged according to importance. For example, the importance of power scheduling behavior takes precedence over personnel scheduling behavior of management or operation personnel, and the priority of power scheduling behavior during peak electricity consumption takes precedence over the priority of power scheduling behavior during off-peak or flat-peak electricity consumption. A process behavior profile is obtained based on the tagging of process behavior features.

[0039] Specifically, step S30 also includes: S302: predict the next access process of the current task process according to the process behavior profile, associate the prediction results of all next access processes, and combine them with the process inheritance relationship to obtain the predicted access path of the current task process.

[0040] Specifically, the next access process of the current task process is predicted based on the process behavior profile. For example, the highest priority power dispatch behavior is taken as the next access process. The prediction results of all the next access processes are sequentially associated according to the importance labels. The prediction results of the next access processes are adjusted in combination with the process inheritance relationship so that the prediction results of the next access processes conform to the process inheritance relationship, thus obtaining the predicted access path of the current task process.

[0041] S303: Obtain the real-time access path of the current task process, and compare the real-time access path with the predicted access path one by one, starting from the root process, to obtain the abnormal access process that deviates from the predicted access path.

[0042] Specifically, the real-time access path of the current power dispatch task process is obtained. Starting from the root process when the power dispatch task is created, the process behavior differences between the real-time access path and the predicted access path are compared one by one. Processes with different behaviors are marked as abnormal to obtain abnormal access processes that deviate from the predicted access path.

[0043] S304: Based on the abnormal access process, predict the abnormal deviation trend of subsequent processes, obtain the access behavior of all accessing child processes along the abnormal deviation trend, and obtain the abnormal behavior detection result of the current task process.

[0044] Specifically, as shown in Figure 4, step S304 includes: S3041: Based on the abnormal deviation trend, construct a deviation isolation tree for all accessing child processes along the abnormal deviation trend, and score the deviation isolation tree for abnormal deviation. The abnormal deviation scoring expression is as follows: (1) Among them, This indicates an abnormal deviation from the score. Indicates the process from the root process to the child process. Path length The average value, Indicates the number of child processes accessed. Path length The average value.

[0045] Specifically, based on the abnormal deviation trend, all access child processes along the abnormal deviation trend are obtained, and all access child processes are associated according to the process inheritance relationship to construct a deviation isolation tree.

[0046] S3042: Based on the abnormal deviation score, mark the isolated access behavior of all accessing subprocesses on the abnormal deviation trend as abnormal, and obtain the abnormal behavior detection results of the current task process.

[0047] Specifically, based on the abnormal deviation score, the isolated access behavior of all accessing subprocesses on the abnormal deviation trend is marked as abnormal. For example, isolated access behavior with an abnormal deviation score exceeding the preset deviation threshold is marked as abnormal. The deviation threshold can be dynamically set according to the actual situation, thereby obtaining the abnormal behavior detection results of the current task process.

[0048] S40: Perform abnormal grayscale calculation on the current task process based on the abnormal process behavior, evaluate whether the current task process is an abnormal process based on the abnormal grayscale calculation results, and obtain abnormal process detection data.

[0049] Specifically, as shown in Figure 5, step S40 includes: S401: Obtaining the historical host process information of each task process, constructing a historical task process tree that is running normally based on the historical host process information, and obtaining a grayscale measurement model for simulating the real operating environment of the power grid.

[0050] Specifically, as shown in Figure 6, step S401 includes: S4011: Compare all historical host process information of the same task process to obtain common process characteristics and corresponding process behavior indicators of the same task process.

[0051] Specifically, the historical host process information of each task process of the power dispatching task during the power grid operation is obtained, and the historical host process information of the same task process is compared, such as the process behavior comparison of each sub-process. Based on the comparison results, the common process characteristics of the same task process and the process behavior indicators of each common process characteristic are obtained.

[0052] S4012: Compare the historical task process trees of the same task process, analyze the process tree inheritance relationship under normal operation, and construct a gray-scale measurement model by combining common process characteristics and process behavior indicators.

[0053] Specifically, historical host process information is constructed into a historical task process tree. Under normal power grid operation, the process tree inheritance relationship of the historical process tree is analyzed. By comparing and analyzing the child processes of multiple historical task process trees of the same task process, the process tree composed of the child process with the most inheritance times is selected for process tree inheritance relationship analysis. The code segment sharing relationship between adjacent child processes with the most inheritance times is used as the process tree inheritance relationship. Combining common process characteristics and process behavior indicators, data association is performed with the corresponding child processes to construct a gray-scale measurement model.

[0054] S402: Perform grayscale simulation of abnormal process behavior using a grayscale measurement model to obtain a simulated process tree of abnormal process behavior.

[0055] Specifically, the relevant data of abnormal process behavior is input into the gray-scale measurement model, and the abnormal process behavior is simulated in gray-scale through the gray-scale measurement model. Based on the simulation results, the simulated running process tree of the abnormal process behavior is output.

[0056] S403: Based on the process's unique identifier, the historical task process tree of the same process, which was pre-trained in the grayscale measurement model, is compared with the simulated running process tree to obtain abnormal process information.

[0057] Specifically, the historical task process tree is identified according to the unique process identifier. The pre-trained historical task process tree in the gray-scale measurement model is called to compare the process behavior of each process with the simulated running process tree. Process behaviors in the simulated running process tree that are inconsistent with or deviate from the historical task process tree are marked as abnormal, and abnormal process information is obtained.

[0058] S404: Predict the abnormal deviation trend between abnormal process information and the historical task process tree, evaluate whether the current task process is an abnormal process based on the abnormal deviation trend, and obtain abnormal process detection data.

[0059] Specifically, the abnormal process information of the abnormal process and its subsequent child processes is obtained, and the abnormal deviation trend of the subsequent child processes starting from the abnormal process and the historical task process tree is predicted. The current task process is evaluated as an abnormal process according to the abnormal deviation trend. For example, a deviation threshold is set for the process. When the abnormal deviation trend reaches the deviation threshold, it means that the current task process is an abnormal process. If the abnormal deviation trend is always within the deviation threshold range, it means that the current task process is a normal task process, thus obtaining abnormal process detection data.

[0060] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0061] In one embodiment, a process anomaly detection system based on flexible grayscale calculation is provided. This system corresponds one-to-one with the multi-level operation capture method based on business operations described in the previous embodiment. As shown in Figure 7, the process anomaly detection system based on flexible grayscale calculation includes an information acquisition module, a process tree construction module, an abnormal behavior analysis module, and an abnormal process detection module. The detailed descriptions of each functional module are as follows: The information acquisition module is used to acquire the task execution behavior and process resource usage of each task process during power grid operation, obtaining host process information. The host process information includes process running information, hidden process information, and process resource consumption information.

[0062] The process tree construction module is used to obtain the power resource call order of each power grid task, combine process running information and hidden process information to construct the corresponding task process tree, and analyze the process inheritance relationship between adjacent processes in the task process tree.

[0063] The abnormal behavior analysis module is used to create a process behavior profile for each task process based on process resource consumption information and process inheritance relationships, and to detect abnormal behavior in the process to obtain the abnormal process behavior of the current task process.

[0064] The abnormal process detection module is used to perform abnormal grayscale calculations on the current task process based on abnormal process behavior, evaluate whether the current task process is an abnormal process based on the abnormal grayscale calculation results, and obtain abnormal process detection data.

[0065] Preferably, the abnormal process detection module specifically includes: a model construction submodule, which is used to obtain the historical host process information of each task process, construct a historical task process tree that is running normally based on the historical host process information, and obtain a grayscale measurement model for simulating the real operating environment of the power grid.

[0066] The process simulation submodule is used to perform grayscale simulation of abnormal process behavior using a grayscale measurement model, and obtain a simulated process tree of abnormal process behavior.

[0067] The behavior comparison submodule is used to compare the behavior of the historical task process tree and the simulated running process tree of the same process in the pre-trained grayscale measurement model according to the process's unique identifier code, and obtain abnormal process information.

[0068] The abnormal process identification submodule is used to predict the abnormal deviation trend between abnormal process information and the historical task process tree, evaluate whether the current task process is an abnormal process based on the abnormal deviation trend, and obtain abnormal process detection data.

[0069] Preferably, the model construction submodule specifically includes: an indicator acquisition unit, which is used to compare all historical host process information of the same task process to obtain common process characteristics and corresponding process behavior indicators of the same task process.

[0070] The model building unit is used to compare the historical task process tree of the same task process, analyze the process tree inheritance relationship under normal operation, and build a gray-scale measurement model by combining common process characteristics and process behavior indicators.

[0071] Preferably, the process behavior profile in the abnormal behavior analysis module specifically includes: a behavior profile submodule, which is used to construct a process behavior baseline based on process resource consumption information and process inheritance relationship, analyze the process behavior characteristics of the process behavior baseline and mark its importance, and obtain the process behavior profile of the corresponding task process.

[0072] Preferably, the abnormal behavior detection process in the abnormal behavior analysis module specifically includes: a path prediction submodule, which is used to predict the next access process of the current task process according to the process behavior profile, associate the prediction results of all next access processes, and combine the process inheritance relationship to obtain the predicted access path of the current task process.

[0073] The abnormal process analysis submodule is used to obtain the real-time access path of the current task process. Starting from the root process, it compares the real-time access path with the predicted access path one by one to obtain the abnormal access process that deviates from the predicted access path.

[0074] The abnormal behavior detection submodule is used to predict the abnormal deviation trend of subsequent processes based on the abnormal access process, obtain the access behavior of all accessing subprocesses along the abnormal deviation trend, and obtain the abnormal behavior detection result of the current task process.

[0075] Preferably, the abnormal behavior detection submodule specifically includes: an abnormal scoring unit, used to construct an isolation tree of all accessing subprocesses on the abnormal deviation trend, and to score the abnormal deviation of the isolation tree. The abnormal deviation scoring expression is as follows: (1) Among them, This indicates an abnormal deviation from the score. Indicates the process from the root process to the child process. Path length The average value, Indicates the number of child processes accessed. Path length The average value.

[0076] The anomaly marking unit is used to mark the isolated access behavior of all accessing subprocesses on the anomaly deviation trend according to the anomaly deviation score, and obtain the anomaly behavior detection result of the current task process.

[0077] Preferably, the process tree construction module specifically includes: a child process search submodule, used to obtain the parent process code segment and power resource call code segment of each power grid task, and search for the target child process that inherits the parent process code segment and the previous power resource call code segment among all child processes of the same task process.

[0078] The inheritance relationship analysis submodule is used to sequentially associate the target child processes according to the order of power resource calls to construct a task process tree, and analyze the process inheritance relationship between adjacent processes according to the code segment sharing state in the task process tree.

[0079] Specific limitations regarding the process anomaly detection system based on flexible grayscale measurement can be found in the limitations of the multi-level operation capture method based on business operations mentioned above, and will not be repeated here. Each module in the aforementioned process anomaly detection system based on flexible grayscale measurement can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0080] In one embodiment, a computer device, which may be a server, is provided, and its internal structure is shown in Figure 8. The computer device includes a processor, memory, a network interface, and a database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores process anomaly detection data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a process anomaly detection method based on flexible grayscale measurement.

[0081] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the steps of a process anomaly detection method based on flexible grayscale measurement.

[0082] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application of the technical solution and the constraints involved. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0083] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0084] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0085] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A process anomaly detection method based on flexible grayscale measurement, characterized in that, include: During the operation of the power grid, the task execution behavior and process resource usage of each task process are obtained to obtain host process information, which includes process running information, hidden process information and process resource consumption information; the power resource call order of each power grid task is obtained, and a corresponding task process tree is constructed by combining the process running information and the hidden process information, and the process inheritance relationship between adjacent processes in the task process tree is analyzed; Based on the process resource consumption information and the process inheritance relationship, process behavior profiles are created for each task process, and abnormal behavior in the process is detected to obtain the abnormal process behavior of the current task process. Based on the abnormal process behavior, perform abnormal grayscale calculation on the current task process, evaluate whether the current task process is an abnormal process based on the abnormal grayscale calculation results, and obtain abnormal process detection data.

2. The process anomaly detection method based on flexible grayscale measurement according to claim 1, characterized in that, The step of performing anomaly grayscale calculation on the current task process based on the abnormal process behavior, and evaluating whether the current task process is an abnormal process based on the anomaly grayscale calculation results to obtain abnormal process detection data, specifically includes: obtaining historical host process information for each task process; constructing a historical task process tree of normal operation based on the historical host process information to obtain a grayscale calculation model for simulating the real operating environment of the power grid; performing grayscale simulation operation on the abnormal process behavior through the grayscale calculation model to obtain a simulated running process tree of the abnormal process behavior; comparing the process behavior with the historical task process tree of the same process pre-trained in the grayscale calculation model according to the process unique identifier code to obtain abnormal process information; predicting the abnormal deviation trend between the abnormal process information and the historical task process tree, and evaluating whether the current task process is an abnormal process based on the abnormal deviation trend to obtain abnormal process detection data.

3. The process anomaly detection method based on flexible grayscale measurement according to claim 2, characterized in that, The process of obtaining historical host process information for each task process and constructing a historical task process tree under normal operation based on the historical host process information to obtain a gray-scale measurement model for simulating the real operating environment of the power grid specifically includes: comparing all historical host process information of the same task process to obtain common process characteristics and corresponding process behavior indicators of the same task process; comparing the historical task process tree of the same task process to analyze the process tree inheritance relationship under normal operation, and constructing a gray-scale measurement model by combining the common process characteristics and the process behavior indicators.

4. The process anomaly detection method based on flexible grayscale measurement according to claim 1, characterized in that, The step of creating a process behavior profile for each task process based on the process resource consumption information and the process inheritance relationship, and detecting abnormal behavior in the process to obtain a process behavior profile of the abnormal process behavior of the current task process, specifically includes: constructing a process behavior baseline based on the process resource consumption information and the process inheritance relationship, analyzing the process behavior characteristics of the process behavior baseline and marking their importance, and obtaining a process behavior profile of the corresponding task process.

5. The process anomaly detection method based on flexible grayscale measurement according to claim 4, characterized in that, The process of creating a process behavior profile for each task process based on the process resource consumption information and the process inheritance relationship, and detecting abnormal behaviors in the process to obtain the abnormal behavior detection process of the current task process, specifically includes: predicting the next access process of the current task process according to the process behavior profile, associating the prediction results of all next access processes, and combining them with the process inheritance relationship to obtain the predicted access path of the current task process; obtaining the real-time access path of the current task process, comparing the real-time access path with the predicted access path one by one starting from the root process to obtain the abnormal access processes that deviate from the predicted access path; predicting the abnormal deviation trend of subsequent processes based on the abnormal access processes, obtaining the access behavior of all access child processes along the abnormal deviation trend, and obtaining the abnormal behavior detection result of the current task process.

6. The process anomaly detection method based on flexible grayscale measurement according to claim 5, characterized in that, The step of predicting the abnormal deviation trend of subsequent processes based on the abnormal access process, obtaining the access behavior of all accessing child processes along the abnormal deviation trend, and obtaining the abnormal behavior detection result of the current task process specifically includes: constructing a deviation isolation tree of all accessing child processes along the abnormal deviation trend, and scoring the deviation isolation tree for abnormal deviation, wherein the abnormal deviation scoring expression is as follows: (1) Among them, This indicates an abnormal deviation from the score. Indicates the process from the root process to the child process. Path length The average value, Indicates the number of child processes accessed. Path length The average value; according to the abnormal deviation score, the isolated access behavior of all accessing subprocesses on the abnormal deviation trend is marked as abnormal, and the abnormal behavior detection result of the current task process is obtained.

7. The process anomaly detection method based on flexible grayscale measurement according to claim 1, characterized in that, The process of obtaining the power resource call order for each power grid task, constructing a corresponding task process tree by combining the process execution information and the hidden process information, and analyzing the process inheritance relationship between adjacent processes in the task process tree specifically includes: obtaining the parent process code segment and power resource call code segment for each power grid task; searching for target child processes that inherit the parent process code segment and the previous power resource call code segment among all child processes of the same task process; sequentially associating the target child processes according to the power resource call order to construct a task process tree; and analyzing the process inheritance relationship between adjacent processes according to the code segment sharing state in the task process tree.

8. A process anomaly detection system based on flexible grayscale measurement, characterized in that, The system is applied to the process anomaly detection method based on flexible grayscale calculation as described in any one of claims 1-7. The system includes: an information acquisition module, used to acquire the task execution behavior and process resource usage of each task process during power grid operation, and obtain host process information, the host process information including process running information, hidden process information, and process resource consumption information; a process tree construction module, used to acquire the power resource call order of each power grid task, construct a corresponding task process tree by combining the process running information and the hidden process information, and analyze the process inheritance relationship between adjacent processes in the task process tree; an abnormal behavior analysis module, used to create a process behavior profile for each task process based on the process resource consumption information and the process inheritance relationship, and detect abnormal behavior in the process to obtain the abnormal process behavior of the current task process; and an abnormal process detection module, used to perform abnormal grayscale calculation on the current task process based on the abnormal process behavior, evaluate whether the current task process is an abnormal process based on the abnormal grayscale calculation result, and obtain abnormal process detection data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the process anomaly detection method based on flexible grayscale measurement as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the process anomaly detection method based on flexible grayscale measurement as described in any one of claims 1 to 7.

Images