An artificial intelligence-based software running environment supervision system and method
By deploying probes in the software runtime environment to collect multi-dimensional data, constructing dynamic behavioral baselines, identifying behavioral intent, and quantifying risks, the shortcomings of traditional monitoring methods in dealing with unknown threats and internal anomalies are addressed, achieving proactive protection and efficient supervision.
Patent Information
- Application Number
- CN202610046966.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-14
- Publication Date
- 2026-06-05
AI Technical Summary
Traditional monitoring and maintenance methods are ill-equipped to deal with unknown vulnerabilities, zero-day attacks, and internal anomalies. They lack a deep understanding of the correlation between internal system behaviors and operational intentions, resulting in high false alarm rates, insufficient risk warning capabilities, and difficulty in shifting from passive response to proactive protection.
By deploying probes to collect multi-dimensional operational data, a dynamic behavioral baseline is constructed, behavioral intentions are identified, risks are quantified, and graded responses are implemented to achieve proactive supervision of the software operating environment.
It improves the system's adaptability to complex and ever-changing environments and the accuracy of supervision, reduces the risk of misjudgment, enhances the intelligence and credibility of risk assessment, and strengthens the system's operability and configurability.
Smart Images
Figure CN122152624A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software operation technology, specifically to a software operation environment monitoring system and method based on artificial intelligence. Background Technology
[0002] In recent years, with the popularization of cloud computing and distributed systems, the scale and complexity of software operating environments have increased dramatically, and traditional monitoring and maintenance methods have gradually revealed their limitations of being slow and reactive. Traditional monitoring systems primarily rely on rule matching or static signature databases for threat identification, making it difficult to address dynamic risks such as unknown vulnerabilities, zero-day attacks, and internal anomalies. They also struggle to adapt to dynamic and ever-changing environments and lack a deep understanding of the correlations and intentions behind internal system behaviors, resulting in high false alarm rates and insufficient risk warning capabilities. Furthermore, most systems focus on post-incident alerts, exhibiting significant deficiencies in risk prediction and proactive remediation, making it difficult to transition from passive response to proactive protection. Summary of the Invention
[0003] The purpose of this invention is to provide a software runtime environment monitoring system and method based on artificial intelligence to solve the problems raised in the prior art.
[0004] To achieve the above objectives, the present invention provides the following technical solution: a software runtime environment monitoring method based on artificial intelligence, the monitoring method comprising: By deploying probes in the software runtime environment, multi-dimensional runtime data generated during software operation is collected periodically. Cluster analysis is performed on the collected multi-dimensional operational data to construct dynamic behavioral baselines that characterize various operating modes of the software; By comparing multi-dimensional operational data in any unit cycle with a dynamic behavior baseline, the behavior sequence is extracted to generate operational mode features, and the behavioral intent of the software operation is identified. The deviation between the behavioral intention in any unit period and the dynamic behavioral baseline is compared to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; based on the degree of behavioral deviation, the risk quantification value of the extracted behavioral sequence is calculated to analyze the risk of the behavioral intention. A tiered response mechanism is triggered to adjust actions based on their level of risk.
[0005] Furthermore, periodically collect multi-dimensional operational data, including: Several probes are pre-deployed in the software runtime environment, and the data generated during the software operation is pre-divided into several dimensions of runtime indicators. The probes sample the runtime data of each dimension at preset fixed time intervals to obtain the runtime data group at each sampling time point. The dimensions of runtime indicators during the software operation process include CPU utilization, memory usage, network traffic, disk I / O operations, process call sequence and system log events, etc. Every unit cycle, the running data sets at each sampling time point are summarized and arranged in order according to the sampling time to generate a multi-dimensional running data set for the corresponding unit cycle.
[0006] Furthermore, the construction of dynamic behavioral baselines includes: For each operating mode, all unit cycles included in the operating mode are extracted and processed to obtain a standardized dataset; cluster analysis is performed on the unit cycle data of the same operating mode to obtain the clustering results of indicators of each dimension; based on the clustering results, a behavioral baseline model for each operating mode is constructed.
[0007] Furthermore, the construction of dynamic behavioral baselines also includes: Obtain a multi-dimensional runtime data set for any given unit period, and define the runtime data of the j-th dimension at the i-th sampling time point as X(i,j), then perform normalization: Y(i,j)=[X(i,j)-μ j ] / σ j , where μ j Let σ be the mean of the j-th dimension across all sampling time points. j Given the standard deviation of the j-th dimension across all sampling points, we obtain the standardized data Y(i,j) of the j-th dimension at the i-th sampling time point. We then perform standardization on all running data to obtain a standardized dataset. A pre-defined operating mode database stores several operating modes, each matching a set of corresponding indicator parameters, each with a specified numerical range. The indicator parameters for all operating modes are then aggregated to form an indicator parameter set. The actual values of each indicator parameter are obtained from the standardized dataset. Indicator parameters whose actual values satisfy the corresponding numerical ranges are set as target indicator parameters. If any selected operating mode matches several target indicator parameters, then the selected operating mode is set as the operating mode for a given period. The operating mode database can include: a normal operating mode with CPU utilization of [20%, 60%] and memory utilization of [30%, 70%]; and a high-load access mode with CPU utilization of [70%, 95%] and memory utilization of [70%, 95%]. By comparing the expected numerical ranges of different indicator parameters, the operating mode of the software can be directly captured. Arbitrarily select the k-th operating mode, obtain several unit cycles contained in the k-th operating mode, and arbitrarily select the a-th unit cycle. Let Y be the standardized data of the j-th dimension at the i-th sampling time point in the a-th unit cycle of the k-th operating mode. (a,k) (i,j), according to the formula: ; Where M is the number of unit cycles included in the k-th operating mode; the standardized mean μ of the j-th dimension at the i-th sampling time point is calculated under the k-th operating mode. k (i,j); The standardized mean values of each dimension in the k-th operating mode are extracted at different sampling time points to obtain the behavioral baseline of the k-th operating mode as: B k (i)=[μ k (i,1),μ k (i,2),…,μ k [i,W)], i=1,2,…,T, where W is the total number of dimensions; According to the formula: ; The standard vector difference σ of the j-th dimension at the i-th sampling time point under the k-th operating mode is calculated. k (i,j); The standard vector difference of each dimension at different sampling time points is extracted, and the standard deviation of the k-th operating mode is expressed as: C k (i)=[σ k (i,1),σ k (i,2),…,σ k [i,W)],i=1,2,…,T; Introducing the standard deviation of the k-th operating mode into the behavioral baseline, we obtain the baseline interval function B for the j-th dimension in the k-th operating mode. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], where α is a preset adjustable coefficient.
[0008] Further, operational pattern feature extraction and behavioral intent recognition include: A standardized dataset corresponding to a multi-dimensional running dataset in any unit period is selected, and the running mode of the selected unit period is determined. The dynamic behavior baseline of the determined running mode is obtained, and the standardized dataset is compared with the obtained dynamic behavior baseline at all sampling time points. The data deviation values of each dimension at each sampling time point are calculated, and the behavior deviation sequence of each dimension is generated in chronological order. For each dimension, a corresponding deviation amplitude threshold is preset. The data deviation value of each sampling time point in the behavior deviation sequence is compared with the corresponding deviation amplitude threshold. If the data deviation value exceeds the preset deviation amplitude threshold, the corresponding sampling time point in the dimension is set as an abnormal time point. The number of abnormal time points in the dimension is counted. If there are several abnormal time points that are adjacent to each other and continuous, an abnormal time interval is generated, and the interval length of the abnormal time interval is obtained. Several behavior sequence features of the dimension are generated. The behavioral sequence features of each dimension in the selected unit period are extracted to form the operating mode feature set of the selected unit period; a behavioral intent database is pre-constructed and stores several behavioral intents, and any behavioral intent is matched with a corresponding behavioral feature set; the operating mode feature set of the selected unit period is compared with the behavioral feature set of any behavioral intent, and if there is a behavioral feature set of a certain behavioral intent that has the same behavioral sequence features in the operating mode feature set, then the certain behavioral intent is set as the behavioral intent of the software operation in the selected unit period.
[0009] Further, the risk analysis of behavioral intentions includes: By calculating the degree of deviation between standardized data in each dimension and the dynamic behavioral baseline, and combining the number of abnormal time points and the length of abnormal time intervals, a comprehensive risk quantification value is calculated, and behavioral intentions are classified into first-level risk, second-level risk, or normal behavioral intentions based on preset thresholds.
[0010] Furthermore, the risk analysis of behavioral intentions also includes: Choose any unit period, acquire the standardized data set of the selected unit period, and obtain the dynamic behavior baseline under the current operating mode. Define the current operating mode as the k-th operating mode. Extract the standardized data of the j-th dimension arbitrarily from the standardized data set, where the standardized data at the i-th sampling time point is defined as Y. k (i,j); Obtain the baseline interval function of the j-th dimension under the k-th operating mode as B. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], according to the formula: ; The behavioral bias p of the i-th sampling point is calculated. k (i,j); The degree of behavioral deviation for all dimensions at each sampling time point is acquired and arranged chronologically to form a sequence of behavioral deviation for each dimension. A weight coefficient is preset for each dimension, where the weight coefficient for the j-th dimension is set to Q. j And satisfy Q1+Q2+…+Q j +…+Q M =1, M is the total number of dimensions, according to the formula: ; Where T is the number of sampling time points; the comprehensive quantization value D of the behavioral deviation sequence in the selected unit period is calculated; The sampling time points within the selected unit period are acquired, and the number of abnormal time points within the selected unit period is counted as N1. If abnormal time intervals exist, the length of the abnormal time interval is obtained as L1, according to the formula: ; Where β1 and β2 are preset weight coefficients, and satisfy β1 + β2 = 1; calculate the risk quantification value R of the behavioral deviation sequence in the selected unit period; and preset the first risk threshold R. th1 Second risk threshold R th2 , where R th1 >R th2 If R≥R th1 Then, the behavioral intention selected within a unit period will be set as the first-level risk intention. If R th2 ≤R<R th1 Then, the behavioral intention selected within a unit period will be set as the secondary risk intention. If R < R th2If the selected unit period is set as the normal behavioral intention, then the purpose of dividing the interval length and the number of abnormal time points in the formula is to judge the continuity of abnormal time points. If the abnormal time points are more continuous, it means that the abnormal situation is more frequent and the risk intention is more obvious.
[0011] Furthermore, regulation of risky behavioral intentions includes: Extract behavioral intent within any unit period; If the extracted behavioral intent is identified as a Level 1 risk intent, the proactive intervention engine is triggered to perform resource restrictions or forced isolation operations on the relevant processes and call predefined repair actions to bring all dimensions back to the dynamic behavioral baseline. If the extracted behavioral intent is classified as a Level 2 risk intent, the extracted behavioral intent will be marked and tracked, an early warning and recording mechanism will be activated, and a risk alert will be sent.
[0012] To better implement the above methods, a software runtime environment monitoring system is also proposed. The monitoring system includes a runtime data acquisition module, a behavior baseline construction module, a behavior intent analysis module, an intent risk analysis module, and a risk intent adjustment module. The data acquisition module is used to periodically collect multi-dimensional operational data generated during software operation through probes deployed in the software runtime environment. The behavior baseline construction module is used to perform cluster analysis on the collected multi-dimensional operational data and construct dynamic behavior baselines that characterize various operating modes of the software. The behavioral intent analysis module is used to compare multi-dimensional operational data in any unit cycle with the dynamic behavioral baseline, extract behavioral sequences to generate operational mode features, and identify the behavioral intent of the software operation. The intention risk analysis module is used to compare the deviation between the behavioral intention in any unit period and the dynamic behavioral baseline to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; based on the degree of behavioral deviation, the risk quantification value of the extracted behavioral sequence is calculated to analyze the risk of the behavioral intention. The risk intent adjustment module is used to trigger a tiered response mechanism to adjust behavioral intentions based on different levels of risk.
[0013] Furthermore, the intentional risk analysis module includes a behavioral deviation analysis unit and a risk quantification calculation unit; The behavioral deviation analysis unit is used to compare the behavioral intention of any unit period with the dynamic behavioral baseline to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; the risk quantification calculation unit is used to calculate the risk quantification value of the extracted behavioral sequence based on the degree of behavioral deviation to analyze the risk of the behavioral intention.
[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention constructs a dynamic behavioral baseline representing different operating modes by clustering analysis of multi-dimensional operating data, which can adaptively adjust according to the actual operating state of the software; it greatly improves the system's adaptability to complex and changing operating environments, realizes the transformation from "static monitoring" to "dynamic perception", and enhances the accuracy and real-time performance of supervision. 2. This invention achieves deep identification of software behavior intent by extracting behavioral sequences and generating operational mode features, and combines multiple factors for comprehensive risk quantification; it can distinguish between normal fluctuations and real threats, significantly improving the intelligence and reliability of risk assessment and reducing the risk of misjudgment. 3. This invention introduces adjustable coefficients and weight configurations in risk calculation, allowing users to flexibly adjust the degree of influence and risk threshold of each dimension according to the actual scenario, which enhances the configurability and practicality of the system, facilitates the understanding and decision-making of operation and maintenance personnel, and improves the operability and reliability of the system. Attached Figure Description
[0015] Figure 1 This is a schematic diagram illustrating the steps of a software runtime environment monitoring method based on artificial intelligence. Figure 2 This is a schematic diagram of the structure of a software runtime environment monitoring system based on artificial intelligence. Detailed Implementation
[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] Example: Figures 1 to 2 As shown, this invention provides a software runtime environment monitoring method based on artificial intelligence. The monitoring method includes: By deploying probes in the software runtime environment, multi-dimensional runtime data generated during software operation is collected periodically. This includes periodically collecting multi-dimensional operational data, including: Several probes are pre-deployed in the software runtime environment, and the data generated during the software operation is pre-divided into several dimensions of operation indicators. The probes sample the operation data of each dimension at a preset fixed time interval to obtain the operation data group at each sampling time point. Every unit cycle, the running data sets at each sampling time point are summarized and arranged in order according to the sampling time to generate a multi-dimensional running data set for the corresponding unit cycle.
[0018] Cluster analysis is performed on the collected multi-dimensional operational data to construct dynamic behavioral baselines that characterize various operating modes of the software; The construction of dynamic behavior baselines includes: For each operating mode, all unit cycles included in the operating mode are extracted and processed to obtain a standardized dataset; cluster analysis is performed on the unit cycle data of the same operating mode to obtain the clustering results of indicators of each dimension; based on the clustering results, a behavioral baseline model for each operating mode is constructed.
[0019] The construction of dynamic behavior baselines also includes: Obtain a multi-dimensional runtime data set for any given unit period, and define the runtime data of the j-th dimension at the i-th sampling time point as X(i,j), then perform normalization: Y(i,j)=[X(i,j)-μ j ] / σ j , where μ j Let σ be the mean of the j-th dimension across all sampling time points. j Given the standard deviation of the j-th dimension across all sampling points, we obtain the standardized data Y(i,j) of the j-th dimension at the i-th sampling time point. We then perform standardization on all running data to obtain a standardized dataset. A pre-defined operating mode database is established, storing several operating modes. Each operating mode is matched with several corresponding indicator parameters, and each indicator parameter corresponds to a numerical range. The indicator parameters of all operating modes are summarized to obtain an indicator parameter set. The data of any indicator parameter in the indicator parameter set is obtained from the standardized dataset to obtain the actual value of each indicator parameter. The indicator parameters whose actual values satisfy the corresponding numerical range are set as target indicator parameters. An operating mode is arbitrarily selected. If the selected operating mode matches several indicator parameters that are all target indicator parameters, then the selected operating mode is set as the operating mode for the unit period. Arbitrarily select the k-th operating mode, obtain several unit cycles contained in the k-th operating mode, and arbitrarily select the a-th unit cycle. Let Y be the standardized data of the j-th dimension at the i-th sampling time point in the a-th unit cycle of the k-th operating mode. (a,k) (i,j), according to the formula: ; Where M is the number of unit cycles included in the k-th operating mode; the standardized mean μ of the j-th dimension at the i-th sampling time point is calculated under the k-th operating mode. k (i,j); The standardized mean values of each dimension in the k-th operating mode are extracted at different sampling time points to obtain the behavioral baseline of the k-th operating mode as: B k (i)=[μ k (i,1),μ k (i,2),…,μ k [i,W)], i=1,2,…,T, where W is the total number of dimensions; According to the formula: ; The standard vector difference σ of the j-th dimension at the i-th sampling time point under the k-th operating mode is calculated. k (i,j); The standard vector difference of each dimension at different sampling time points is extracted, and the standard deviation of the k-th operating mode is expressed as: C k (i)=[σ k (i,1),σ k (i,2),…,σ k [i,W)],i=1,2,…,T; Introducing the standard deviation of the k-th operating mode into the behavioral baseline, we obtain the baseline interval function B for the j-th dimension in the k-th operating mode. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], where α is a preset adjustable coefficient; Example 1: Cluster the data of multiple unit periods under each mode, calculate the mean μ and standard deviation σ of each dimension at each sampling point. In the "transaction processing mode", the mean μ of the first sampling point under the "CPU utilization" dimension is 65% and the standard deviation σ is 5%. Set the adjustable coefficient α=2 to obtain the baseline interval function of "CPU utilization" as [65%-5%×2,65%+5%×2]=[55%,75%]. By comparing multi-dimensional operational data in any unit cycle with a dynamic behavior baseline, the behavior sequence is extracted to generate operational mode features, and the behavioral intent of the software operation is identified. Among them, the extraction of operating mode features and the recognition of behavioral intent include: A standardized dataset corresponding to a multi-dimensional running dataset in any unit period is selected, and the running mode of the selected unit period is determined. The dynamic behavior baseline of the determined running mode is obtained, and the standardized dataset is compared with the obtained dynamic behavior baseline at all sampling time points. The data deviation values of each dimension at each sampling time point are calculated, and the behavior deviation sequence of each dimension is generated in chronological order. For each dimension, a corresponding deviation amplitude threshold is preset. The data deviation value of each sampling time point in the behavior deviation sequence is compared with the corresponding deviation amplitude threshold. If the data deviation value exceeds the preset deviation amplitude threshold, the corresponding sampling time point in the dimension is set as an abnormal time point. The number of abnormal time points in the dimension is counted. If there are several abnormal time points that are adjacent to each other and continuous, an abnormal time interval is generated, and the interval length of the abnormal time interval is obtained. Several behavior sequence features of the dimension are generated. The behavioral sequence features of each dimension in the selected unit period are extracted to form the operation mode feature set of the selected unit period; a behavioral intent database is pre-built and stores several behavioral intents, and any behavioral intent is matched with a corresponding behavioral feature set; the operation mode feature set of the selected unit period is compared with the behavioral feature set of any behavioral intent. If there is a behavioral feature set of a certain behavioral intent that has the same behavioral sequence features in the operation mode feature set, then the certain behavioral intent is set as the behavioral intent of the software operation in the selected unit period. Example 2: Suppose that within a certain unit period, the CPU utilization exceeds the upper limit of the baseline interval at the 2nd, 3rd, and 4th sampling points, and the number of network connections surges abnormally at the 3rd and 4th sampling points; if there is a DDoS attack intent in the system's predefined behavioral intent library, and the corresponding behavioral feature set includes a surge in the number of network connections and abnormal CPU, then the feature of a certain unit period matches the DDoS attack intent, and the system determines the current behavioral intent as "suspected DDoS attack".
[0020] The deviation between the behavioral intention in any unit period and the dynamic behavioral baseline is compared to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; based on the degree of behavioral deviation, the risk quantification value of the extracted behavioral sequence is calculated to analyze the risk of the behavioral intention. The risk analysis of behavioral intentions includes: By calculating the degree of deviation between standardized data in each dimension and the dynamic behavioral baseline, and combining the number of abnormal time points and the length of abnormal time intervals, a comprehensive risk quantification value is calculated, and behavioral intentions are classified into first-level risk, second-level risk, or normal behavioral intentions based on preset thresholds.
[0021] The risk analysis of behavioral intentions also includes: Choose any unit period, acquire the standardized data set of the selected unit period, and obtain the dynamic behavior baseline under the current operating mode. Define the current operating mode as the k-th operating mode. Extract the standardized data of the j-th dimension arbitrarily from the standardized data set, where the standardized data at the i-th sampling time point is defined as Y. k (i,j); Obtain the baseline interval function of the j-th dimension under the k-th operating mode as B. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], according to the formula: ; The behavioral bias p of the i-th sampling point is calculated. k (i,j); The degree of behavioral deviation for all dimensions at each sampling time point is acquired and arranged chronologically to form a sequence of behavioral deviation for each dimension. A weight coefficient is preset for each dimension, where the weight coefficient for the j-th dimension is set to Q. j And satisfy Q1+Q2+…+Q j +…+Q M =1, M is the total number of dimensions, according to the formula: ; Where T is the number of sampling time points; the comprehensive quantization value D of the behavioral deviation sequence in the selected unit period is calculated; The sampling time points within the selected unit period are acquired, and the number of abnormal time points within the selected unit period is counted as N1. If abnormal time intervals exist, the length of the abnormal time interval is obtained as L1, according to the formula: ; Where β1 and β2 are preset weight coefficients, and satisfy β1 + β2 = 1; calculate the risk quantification value R of the behavioral deviation sequence in the selected unit period; and preset the first risk threshold R. th1 Second risk threshold R th2 , where R th1 >R th2 If R≥R th1 Then, the behavioral intention selected within a unit period will be set as the first-level risk intention. If R th2 ≤R<R th1 Then, the behavioral intention selected within a unit period will be set as the secondary risk intention. If R < R th2 Then the behavioral intent selected for a unit period will be set as the normal behavioral intent; Example 3: Set the number of abnormal time points in a certain unit period to N1=3, the length of the abnormal time interval to L1=2, the comprehensive deviation value to D=8.5, and set the weight coefficients to β1=0.6 and β2=0.4. The calculated value is R=0.6×8.5+0.4×3×(1+2 / 3)=5.1+2=7.1.
[0022] A tiered response mechanism is triggered to adjust actions based on their level of risk. Among these, the regulation of risky behavioral intentions includes: Extract behavioral intent within any unit period; If the extracted behavioral intent is identified as a Level 1 risk intent, the proactive intervention engine is triggered to perform resource restrictions or forced isolation operations on the relevant processes and call predefined repair actions to bring all dimensions back to the dynamic behavioral baseline. If the extracted behavioral intent is classified as a Level 2 risk intent, the extracted behavioral intent will be marked and tracked, an early warning and recording mechanism will be activated, and a risk alert will be sent.
[0023] A software runtime environment monitoring system, the monitoring system includes a runtime data acquisition module, a behavior baseline construction module, a behavior intent analysis module, an intent risk analysis module, and a risk intent adjustment module; The data acquisition module is used to periodically collect multi-dimensional operational data generated during software operation through probes deployed in the software runtime environment. The behavior baseline construction module is used to perform cluster analysis on the collected multi-dimensional operational data and construct dynamic behavior baselines that characterize various operating modes of the software. The behavioral intent analysis module is used to compare multi-dimensional operational data in any unit cycle with the dynamic behavioral baseline, extract behavioral sequences to generate operational mode features, and identify the behavioral intent of the software operation. The intention risk analysis module is used to compare the deviation between the behavioral intention in any unit period and the dynamic behavioral baseline to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; based on the degree of behavioral deviation, the risk quantification value of the extracted behavioral sequence is calculated to analyze the risk of the behavioral intention. The risk intent adjustment module is used to trigger a tiered response mechanism to adjust behavioral intentions based on different levels of risk.
[0024] The intention risk analysis module includes a behavioral deviation analysis unit and a risk quantification calculation unit. The behavioral deviation analysis unit is used to compare the behavioral intention of any unit period with the dynamic behavioral baseline to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; the risk quantification calculation unit is used to calculate the risk quantification value of the extracted behavioral sequence based on the degree of behavioral deviation to analyze the risk of the behavioral intention.
[0025] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.
Claims
1. A software runtime environment monitoring method based on artificial intelligence, characterized in that: The regulatory methods include: By deploying probes in the software runtime environment, multi-dimensional runtime data generated during software operation is collected periodically. Cluster analysis is performed on the collected multi-dimensional operational data to construct dynamic behavioral baselines that characterize various operating modes of the software; By comparing multi-dimensional operational data in any unit cycle with a dynamic behavior baseline, the behavior sequence is extracted to generate operational mode features, and the behavioral intent of the software operation is identified. The deviation between the behavioral intention in any unit period and the dynamic behavioral baseline is compared to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intention; based on the degree of behavioral deviation, the risk quantification value of the extracted behavioral sequence is calculated to analyze the risk of the behavioral intention. A tiered response mechanism is triggered to adjust actions based on their level of risk.
2. The method for monitoring a software runtime environment based on artificial intelligence according to claim 1, characterized in that: Periodically collect multi-dimensional operational data, including: Several probes are pre-deployed in the software runtime environment, and the data generated during the software operation is pre-divided into several dimensions of operation indicators. The probes sample the operation data of each dimension at a preset fixed time interval to obtain the operation data group at each sampling time point. Every unit cycle, the running data sets at each sampling time point are summarized and arranged in order according to the sampling time to generate a multi-dimensional running data set for the corresponding unit cycle.
3. The method for monitoring a software runtime environment based on artificial intelligence according to claim 1, characterized in that: The construction of dynamic behavioral baselines includes: For each operating mode, all unit cycles included in the operating mode are extracted and processed to obtain a standardized dataset; cluster analysis is performed on the unit cycle data of the same operating mode to obtain the clustering results of indicators of each dimension; based on the clustering results, a behavioral baseline model for each operating mode is constructed.
4. The method for monitoring a software runtime environment based on artificial intelligence according to claim 3, characterized in that: The construction of dynamic behavioral baselines also includes: Obtain a multi-dimensional runtime data set for any given unit period, and define the runtime data of the j-th dimension at the i-th sampling time point as X(i,j), then perform normalization: Y(i,j)=[X(i,j)-μ j ] / σ j , where μ j Let σ be the mean of the j-th dimension across all sampling time points. j Given the standard deviation of the j-th dimension across all sampling points, we obtain the standardized data Y(i,j) of the j-th dimension at the i-th sampling time point. We then perform standardization processing on all running data to obtain a standardized dataset. A pre-defined operating mode database is established, storing several operating modes. Each operating mode is matched with several corresponding indicator parameters, and each indicator parameter corresponds to a numerical range. The indicator parameters of all operating modes are summarized to obtain an indicator parameter set. The data of any indicator parameter in the indicator parameter set is obtained from the standardized dataset to obtain the actual value of each indicator parameter. The indicator parameters whose actual values satisfy the corresponding numerical range are set as target indicator parameters. An operating mode is arbitrarily selected. If the selected operating mode matches several indicator parameters that are all target indicator parameters, then the selected operating mode is set as the operating mode for the unit period. Arbitrarily select the k-th operating mode, obtain several unit cycles contained in the k-th operating mode, and arbitrarily select the a-th unit cycle. Let Y be the standardized data of the j-th dimension at the i-th sampling time point in the a-th unit cycle of the k-th operating mode. (a,k) (i,j), according to the formula: ； Where M is the number of unit cycles included in the k-th operating mode; the standardized mean μ of the j-th dimension at the i-th sampling time point is calculated under the k-th operating mode. k (i,j); The standardized mean values of each dimension in the k-th operating mode are extracted at different sampling time points to obtain the behavioral baseline of the k-th operating mode as: B k (i)=[μ k (i,1),μ k (i,2),…,μ k [i,W)], i=1,2,…,T, where W is the total number of dimensions; According to the formula: ; The standard vector difference σ of the j-th dimension at the i-th sampling time point under the k-th operating mode is calculated. k (i,j); The standard vector difference of each dimension at different sampling time points is extracted, and the standard deviation of the k-th operating mode is expressed as: C k (i)=[σ k (i,1),σ k (i,2),…,σ k [i,W)],i=1,2,…,T; Introducing the standard deviation of the k-th operating mode into the behavioral baseline, we obtain the baseline interval function B for the j-th dimension in the k-th operating mode. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], where α is a preset adjustable coefficient.
5. The method for monitoring a software runtime environment based on artificial intelligence according to claim 1, characterized in that: Operation mode feature extraction and behavioral intent recognition include: A standardized dataset corresponding to a multi-dimensional running dataset in any unit period is selected, and the running mode of the selected unit period is determined. The dynamic behavior baseline of the determined running mode is obtained, and the standardized dataset is compared with the obtained dynamic behavior baseline at all sampling time points. The data deviation values of each dimension at each sampling time point are calculated, and the behavior deviation sequence of each dimension is generated in chronological order. For each dimension, a corresponding deviation amplitude threshold is preset. The data deviation value of each sampling time point in the behavior deviation sequence is compared with the corresponding deviation amplitude threshold. If the data deviation value exceeds the preset deviation amplitude threshold, the corresponding sampling time point in the dimension is set as an abnormal time point. The number of abnormal time points in the dimension is counted. If there are several abnormal time points that are adjacent to each other and continuous, an abnormal time interval is generated, and the interval length of the abnormal time interval is obtained. Several behavior sequence features of the dimension are generated. The behavioral sequence features of each dimension in the selected unit period are extracted to form the operating mode feature set of the selected unit period; a behavioral intent database is pre-constructed and stores several behavioral intents, and any behavioral intent is matched with a corresponding behavioral feature set; the operating mode feature set of the selected unit period is compared with the behavioral feature set of any behavioral intent, and if there is a behavioral feature set of a certain behavioral intent that has the same behavioral sequence features in the operating mode feature set, then the certain behavioral intent is set as the behavioral intent of the software operation in the selected unit period.
6. The method for monitoring a software runtime environment based on artificial intelligence according to claim 1, characterized in that: Behavioral intention risk analysis includes: By calculating the degree of deviation between standardized data in each dimension and the dynamic behavioral baseline, and combining the number of abnormal time points and the length of abnormal time intervals, a comprehensive risk quantification value is calculated, and behavioral intentions are classified into first-level risk, second-level risk, or normal behavioral intentions based on preset thresholds.
7. The method for monitoring a software runtime environment based on artificial intelligence according to claim 6, characterized in that: Behavioral intention risk analysis also includes: Choose any unit period, acquire the standardized data set of the selected unit period, and obtain the dynamic behavior baseline under the current operating mode. Define the current operating mode as the k-th operating mode. Extract the standardized data of the j-th dimension arbitrarily from the standardized data set, where the standardized data at the i-th sampling time point is defined as Y. k (i,j); Obtain the baseline interval function of the j-th dimension under the k-th operating mode as B. k (i,j)=[μ k (i,j)-α×σ k (i,j),μ k (i,j)+α×σ k [i,j], according to the formula: ; The behavioral bias p of the i-th sampling point is calculated. k (i,j); The degree of behavioral deviation for all dimensions at each sampling time point is acquired and arranged chronologically to form a sequence of behavioral deviation for each dimension. A weight coefficient is preset for each dimension, where the weight coefficient for the j-th dimension is set to Q. j And satisfy Q1+Q2+…+Q j +…+Q M =1, M is the total number of dimensions, according to the formula: ； Where T is the number of sampling time points; the comprehensive quantization value D of the behavioral deviation sequence in the selected unit period is calculated; The sampling time points within the selected unit period are acquired, and the number of abnormal time points within the selected unit period is counted as N1. If abnormal time intervals exist, the length of the abnormal time interval is obtained as L1, according to the formula: ； Where β1 and β2 are preset weight coefficients, and satisfy β1 + β2 = 1; calculate the risk quantification value R of the behavioral deviation sequence in the selected unit period; and preset the first risk threshold R. th1 Second risk threshold R th2 , where R th1 >R th2 If R≥R th1 Then, the behavioral intention selected within a unit period will be set as the first-level risk intention. If R th2 ≤R<R th1 Then, the behavioral intention selected within a unit period will be set as the secondary risk intention. If R < R th2 Then the selected unit period's behavioral intention will be set as the normal behavioral intention.
8. The method for monitoring a software runtime environment based on artificial intelligence according to claim 1, characterized in that: Moderating risky behavioral intentions includes: Extract behavioral intent within any unit period; If the extracted behavioral intent is identified as a Level 1 risk intent, the proactive intervention engine is triggered to perform resource restrictions or forced isolation operations on the relevant processes and call predefined repair actions to bring all dimensions back to the dynamic behavioral baseline. If the extracted behavioral intent is classified as a Level 2 risk intent, the extracted behavioral intent will be marked and tracked, an early warning and recording mechanism will be activated, and a risk alert will be sent.
9. A software runtime environment monitoring system, used to execute the artificial intelligence-based software runtime environment monitoring method according to any one of claims 1-8, characterized in that: The monitoring system includes an operational data acquisition module, a behavior baseline construction module, a behavior intent analysis module, an intent risk analysis module, and a risk intent adjustment module. The runtime data acquisition module is used to periodically collect multi-dimensional runtime data generated during software operation through probes deployed in the software runtime environment. The behavior baseline construction module is used to perform cluster analysis on the collected multi-dimensional operational data to construct a dynamic behavior baseline that represents various operating modes of the software. The behavioral intent analysis module is used to compare multi-dimensional operation data in any unit cycle with dynamic behavior baseline, extract behavior sequence to generate operation mode features, and identify the behavioral intent of software operation. The intent risk analysis module is used to compare the deviation of the behavioral intent in any unit period with the dynamic behavioral baseline, and to assess the degree of behavioral deviation of the extracted behavioral sequence under the behavioral intent; based on the degree of behavioral deviation, the module calculates the risk quantification value of the extracted behavioral sequence and analyzes the risk of the behavioral intent. The risk intent adjustment module is used to trigger a tiered response mechanism to adjust actions based on different levels of risk.
10. A software runtime environment monitoring system according to claim 9, characterized in that: The intent risk analysis module includes a behavior deviation analysis unit and a risk quantification calculation unit; The behavior deviation analysis unit is used to compare the behavior intention of any unit period with the dynamic behavior baseline to evaluate the degree of behavior deviation of the extracted behavior sequence under the behavior intention; the risk quantification calculation unit is used to calculate the risk quantification value of the extracted behavior sequence based on the degree of behavior deviation to analyze the risk of the behavior intention.