Device anomaly detection method and apparatus, storage medium, and program product

Abstract

This application provides a method, apparatus, storage medium, and program product for detecting equipment anomalies, relating to the field of computer technology, and is used to improve the accuracy of equipment anomaly detection. The method includes: acquiring the current operating indicators and current behavioral characteristics of the device under test; determining the current load mode of the device under test based on the current operating indicators, and determining anomaly detection conditions matching the current load mode, the anomaly detection conditions being used to determine whether the operating indicators are abnormal; and, if the current operating indicators meet the anomaly detection conditions, determining anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics, the anomaly risk information being used to indicate whether the device under test is abnormal.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and program product for detecting equipment malfunctions. Background Technology

[0002] With the widespread application of various electronic devices in all aspects of production and daily life, the stable operation of these devices is directly related to business efficiency and overall system security. During long-term operation, devices are prone to malfunctions due to various factors. If these malfunctions are not detected and addressed promptly, they may lead to equipment failure, business interruptions, or even security risks. Therefore, malfunction detection has become a crucial aspect of equipment operation and maintenance and security protection.

[0003] Currently, most methods for detecting device anomalies rely on fixed thresholds pre-set by maintenance personnel or static rules based on a single metric to determine whether an attack has occurred, combined with basic log analysis to identify known threats. However, these solutions generally have poor detection performance in practical applications, are difficult to adapt to the operating characteristics and actual operating scenarios of different devices, and lack accuracy in identifying device anomalies. Therefore, improving the accuracy of device anomaly detection has become an urgent technical problem to be solved. Summary of the Invention

[0004] This invention provides a method, apparatus, storage medium, and program product for detecting equipment anomalies, which addresses the shortcomings of existing technologies in equipment detection that cannot adapt to the operating characteristics and actual operating scenarios of different devices, thereby improving the accuracy of equipment anomaly detection.

[0005] This invention provides a method for detecting equipment malfunctions, comprising the following steps.

[0006] Obtain the current operating indicators and current behavioral characteristics of the device under test; Based on the current operating indicators, determine the current load mode of the device under test, and determine the anomaly detection conditions that match the current load mode. The anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators. If the current operating indicators meet the anomaly detection conditions, based on the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics, the abnormal risk information of the device to be tested is determined. The abnormal risk information is used to indicate whether there is an anomaly in the device to be tested.

[0007] According to the present invention, a method for detecting equipment anomalies is provided, wherein the equipment under test includes multiple business processing cycles; based on current operating indicators, the current load mode of the equipment under test is determined, including: Based on the current time, determine the target processing cycle from multiple business processing cycles; Based on historical operating metrics within the target processing cycle, multiple load modes within the target processing cycle are determined, with different operating metrics corresponding to different load modes. Based on current operating metrics, determine the current load mode from multiple load modes.

[0008] According to the present invention, a method for detecting equipment anomalies determines the anomaly risk information of the equipment to be detected based on abnormal operating indicators in the current operating indicators and abnormal behavioral characteristics in the current behavioral characteristics, including: Based on the indicator behavior association information, the target correlation degree corresponding to the abnormal operation indicators and abnormal behavior characteristics is determined. The indicator behavior association information is used to characterize the degree of correlation between abnormal operation indicators and behavior characteristics. Based on abnormal operation indicators, abnormal behavior characteristics, and target correlation, the abnormal risk value of the equipment to be tested is determined; Based on the abnormal risk value, abnormal risk information is determined.

[0009] According to the equipment anomaly detection method provided by the present invention, before determining the target correlation degree corresponding to the abnormal operation indicator based on indicator behavior correlation information, the method further includes: Obtain the device type of the device to be tested; Based on the device type of the device to be tested, indicator behavior association information is determined from multiple preset indicator behavior association information, and one preset indicator behavior association information corresponds to one device type.

[0010] According to the present invention, a method for detecting equipment malfunctions further includes: Obtain multiple historical abnormal indicators and multiple historical abnormal behavior characteristics; For each historical anomaly indicator, a correlation analysis is performed between the historical anomaly indicator and each historical anomaly behavior feature to determine the degree of correlation between the historical anomaly indicator and each historical anomaly behavior feature. Based on the correlation between each historical abnormal indicator and each historical abnormal behavior feature, indicator behavior correlation information is constructed; wherein, the indicator behavior correlation information includes multiple correlation degrees, each correlation degree is used to characterize the degree of correlation between a historical abnormal indicator and a historical abnormal behavior feature.

[0011] According to the present invention, a method for detecting equipment malfunctions further includes: Determine the current anomaly type and current risk level of the equipment to be tested; Based on the current anomaly type and the current risk level, an anomaly response instruction is determined. The anomaly response instruction is used to indicate how to handle the anomaly situation of the device under test. Send an abnormal response command to the device under test.

[0012] According to the present invention, a method for detecting equipment malfunctions further includes: If the indicator behavior association information meets the update conditions, update the indicator behavior association information to obtain the updated indicator behavior association information. The update conditions include: the usage duration of the indicator behavior-related information is greater than the preset time threshold, and / or the anomaly detection accuracy is less than the preset accuracy threshold. The anomaly detection accuracy is the accuracy of detecting whether the device under test has an anomaly.

[0013] According to the present invention, a method for detecting equipment malfunctions further includes: Obtain anomaly detection response information, which is used to indicate whether the anomaly risk information is correct; The anomaly detection accuracy is obtained based on the anomaly detection response information and the historical anomaly detection accuracy.

[0014] The present invention also provides a device for detecting equipment malfunctions, comprising the following modules: an acquisition module, a processing module, and a transmission module.

[0015] The acquisition module is used to acquire the current operating indicators and current behavioral characteristics of the device under test; The processing module is used to determine the current load mode of the device under test based on the current operating indicators, and to determine the anomaly detection conditions that match the current load mode. The anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators. The processing module is also used to determine the abnormal risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics when the current operating indicators meet the abnormal detection conditions. The abnormal risk information is used to indicate whether there is an abnormality in the device under test.

[0016] According to the present invention, a device for detecting equipment malfunctions, including a processing module, is specifically used for: Based on the current time, determine the target processing cycle from multiple business processing cycles; Based on historical operating metrics within the target processing cycle, multiple load modes within the target processing cycle are determined, with different operating metrics corresponding to different load modes. Based on current operating metrics, determine the current load mode from multiple load modes.

[0017] According to the device for detecting equipment malfunctions provided by the present invention, the processing module is further specifically used for: Based on the indicator behavior association information, the target correlation degree corresponding to the abnormal operation indicators and abnormal behavior characteristics is determined. The indicator behavior association information is used to characterize the degree of correlation between abnormal operation indicators and behavior characteristics. Based on abnormal operation indicators, abnormal behavior characteristics, and target correlation, the abnormal risk value of the equipment to be tested is determined; Based on the abnormal risk value, abnormal risk information is determined.

[0018] According to the device for detecting equipment malfunction provided by the present invention, the acquisition module is further configured to acquire the equipment type of the equipment to be detected; The processing module is also used to determine the indicator behavior association information from multiple preset indicator behavior association information based on the device type of the device to be detected. One preset indicator behavior association information corresponds to one device type.

[0019] According to the device for detecting equipment malfunctions provided by the present invention, the acquisition module is further configured to acquire multiple historical malfunction indicators and multiple historical malfunction behavior characteristics. The processing module is also used to perform correlation analysis between each historical abnormal indicator and each historical abnormal behavior feature to determine the degree of correlation between the historical abnormal indicator and each historical abnormal behavior feature. The processing module is also used to construct indicator behavior correlation information based on the correlation degree between each historical abnormal indicator and each historical abnormal behavior feature; wherein, the indicator behavior correlation information includes multiple correlation degrees, each correlation degree is used to characterize the degree of correlation between a historical abnormal indicator and a historical abnormal behavior feature.

[0020] According to the equipment anomaly detection device provided by the present invention, the processing module is further used to determine the current anomaly type and current risk level of the equipment to be detected; The processing module is also used to determine the anomaly response instruction based on the current anomaly type and the current risk level. The anomaly response instruction is used to indicate the handling of the anomaly situation of the device under test. The sending module is used to send abnormal response commands to the device under test.

[0021] According to the device for detecting equipment malfunctions provided by the present invention, the processing module is further used for: If the indicator behavior association information meets the update conditions, update the indicator behavior association information to obtain the updated indicator behavior association information. The update conditions include: the usage duration of the indicator behavior-related information is greater than the preset time threshold, and / or the anomaly detection accuracy is less than the preset accuracy threshold. The anomaly detection accuracy is the accuracy of detecting whether the device under test has an anomaly.

[0022] According to the device for detecting equipment malfunctions provided by the present invention, the acquisition module is further configured to acquire malfunction detection response information, which is used to indicate whether the malfunction risk information is correct. The processing module is also used to obtain the anomaly detection accuracy based on the anomaly detection response information and the historical anomaly detection accuracy.

[0023] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the above-described methods for detecting device malfunctions.

[0024] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a device malfunction detection method as described above.

[0025] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a method for detecting device malfunctions as described above.

[0026] The present invention provides a method, apparatus, storage medium, and program product for detecting equipment anomalies. This method first acquires the current operating indicators and behavioral characteristics of the equipment under test, then determines the current load mode of the equipment based on the operating indicators and matches corresponding anomaly detection conditions. Finally, when the operating indicators meet the conditions, it combines abnormal operating indicators and abnormal behavioral characteristics to determine the risk information of equipment anomalies, thus achieving accurate detection of equipment anomalies. This method abandons a unified and fixed anomaly judgment standard, adapting corresponding anomaly detection conditions according to the actual load mode of the equipment, making anomaly judgment more closely aligned with the actual operating state of the equipment, effectively reducing false alarms and missed alarms caused by rigid standards. Simultaneously, by combining operating indicators and behavioral characteristics for anomaly risk judgment, it can more comprehensively and accurately identify equipment anomalies, improving the accuracy of equipment anomaly detection. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0028] Figure 1 This is a system architecture diagram of the equipment anomaly detection system provided by the present invention.

[0029] Figure 2 This is one of the flowcharts of the equipment malfunction detection method provided by the present invention.

[0030] Figure 3 This is the second flowchart of the equipment malfunction detection method provided by the present invention.

[0031] Figure 4 This is the third flowchart of the equipment malfunction detection method provided by the present invention.

[0032] Figure 5 This is the fourth flowchart of the equipment malfunction detection method provided by the present invention.

[0033] Figure 6 This is the fifth flowchart of the equipment malfunction detection method provided by the present invention.

[0034] Figure 7 This is a schematic diagram of the device for detecting equipment malfunctions provided by the present invention.

[0035] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0037] The terms “comprising” and “having”, and any variations thereof, used in the description of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not limited to the steps or modules listed, but may optionally include other steps or modules not listed, or may optionally include other steps or modules inherent to such processes, methods, products, or apparatus.

[0038] Furthermore, in this invention, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present concepts in a concrete manner.

[0039] With the continuous increase in the number of deployed devices and the increasing complexity of business scenarios, device security detection and automated response have become important research directions in the field of cybersecurity. Currently, resource indicator monitoring based on fixed thresholds is possible. Static thresholds can be set for device resource indicators such as Central Processing Unit (CPU) utilization and memory usage, triggering alarms when these indicators exceed preset ranges. Alternatively, attack identification can be based on logs and behavioral rules. By analyzing device logs, process behavior, and other information, combined with expert-defined rule bases, potential attack behaviors can be identified; abnormal port connections, unauthorized modifications to system files, and other behaviors can trigger alarms.

[0040] However, the aforementioned solutions still have many key shortcomings in the practical application of current equipment security protection, making it difficult to meet the security protection needs in complex scenarios. For example, most systems use a uniform static resource utilization threshold to judge anomalies, lacking the ability to create personalized models for different devices, different business stages, and time periods, ignoring the differentiated operating characteristics of devices, which directly leads to a high false alarm rate in anomaly detection.

[0041] To address the aforementioned technical problems, this application provides a method for detecting equipment anomalies. This method acquires the current operating indicators and behavioral characteristics of the equipment under test, determines the current load mode based on the operating indicators, and then matches anomaly detection conditions corresponding to that load mode. When the equipment operating indicators meet the anomaly detection conditions, the method combines the abnormal operating indicators and abnormal behavioral characteristics to comprehensively determine the equipment's anomaly risk information, thereby determining whether the equipment is abnormal. In this way, by setting appropriate anomaly detection conditions based on load modes, the method abandons a uniform fixed threshold, achieving personalized detection tailored to different equipment operating characteristics, thus solving the problems of false alarms and missed alarms caused by fixed thresholds and lack of personalized modeling. Simultaneously, by combining abnormal operating indicators and abnormal behavioral characteristics to jointly determine anomaly risk, the method achieves joint analysis of multiple indicators and behavioral characteristics, solving the problem that single-indicator identification is insufficient for accurately judging complex anomalies, thereby improving the accuracy of equipment anomaly detection.

[0042] The following is combined with Figures 1 to 8 The present invention describes a method, apparatus, storage medium, and program product for detecting device malfunctions.

[0043] like Figure 1 As shown, this is a device anomaly detection system provided in an embodiment of this application. The device anomaly detection system includes: a device layer 101, an intelligent agent layer 102, and a data analysis layer 103.

[0044] The device layer 101 includes multiple devices to be monitored (such as device 1, device 2, and device 3). Each device to be monitored deploys a lightweight intelligent agent component, which is used to monitor the operating data of the device in real time and communicate with the intelligent agent layer 102. For example, the intelligent agent component can collect the device's operating metrics in real time, including CPU utilization, memory usage, disk I / O, and network traffic. Furthermore, the intelligent agent component can monitor the device's behavioral characteristics, including process startup, file modification, and port connections. For another example, the intelligent agent component can structure the collected operating metrics and monitored behavioral characteristics before sending them to the AI ​​intelligent agent layer 102. Moreover, the intelligent agent component can receive anomaly response commands issued by the AI ​​intelligent agent layer 102, including commands such as terminating processes, disconnecting from the network, and isolating devices, and execute these commands locally on the device.

[0045] The AI ​​intelligent agent layer 102 deploys an anomaly response intelligent agent, which includes an anomaly analysis submodule 1021 and a response decision submodule 1022. The anomaly analysis submodule 1021 combines historical and current operating indicators of the device to determine the device's current business processing cycle and load mode. For example, the business processing cycle includes peak and off-peak periods, and the load mode includes low and high load modes. Furthermore, the anomaly analysis submodule 1021 combines indicator behavior correlation information to perform coupled analysis of the device's abnormal operating indicators and abnormal behavior characteristics to determine the device's risk score. The response decision submodule 1022 automatically generates an appropriate emergency response strategy based on the risk level corresponding to the risk score. The emergency response strategy includes isolating the device, logging, and shutting down services, and then sends the anomaly response command to the corresponding intelligent agent component of the device.

[0046] It should be noted that the anomaly response agent can be deployed in an electronic device to execute the embodiments of this application. This electronic device can be the same device as the device to be detected, or the electronic device and the device to be detected can be two different devices; this application does not limit this.

[0047] The execution entity of the device anomaly detection method provided in this application can be a device anomaly detection device, which can be an electronic device. Furthermore, the device can also be the central processing unit (CPU) of the electronic device, or a detection module within the electronic device for detecting device anomalies. Alternatively, the execution entity can be an anomaly response agent deployed within the electronic device. This application's embodiments use an anomaly response agent executing the device anomaly detection method as an example to illustrate the device anomaly detection method provided in this application's embodiments.

[0048] The data analysis layer 103 is used to manage the correlation information between indicators and behaviors. For example, the data analysis layer 103 can obtain abnormal operation indicators and abnormal behavior characteristics from the AI ​​agent layer 102, determine the correlation between the abnormal operation indicators and abnormal behavior characteristics, construct indicator behavior correlation information, and update the indicator behavior correlation information when conditions are met, such as periodic updates or updates when the false positive rate increases. Furthermore, the data analysis layer 103 can push the updated indicator behavior correlation information to the AI ​​agent layer 102 to provide data basis for its subsequent coupling analysis and risk scoring calculation.

[0049] Among them, a real-time data communication channel is established between the data analysis layer 103 and the AI ​​intelligent agent layer 102 to ensure real-time data interaction, thereby enabling continuous optimization of the system risk judgment model.

[0050] It should be understood that the embodiments of this application do not limit the device to be tested. For example, the device to be tested can be an electronic device (such as a terminal) or a server (such as a host). The terminal can be a device with transceiver capabilities. The terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on water (such as a ship); and it can also be deployed in the air (such as on an airplane, balloon, or satellite). The terminal includes handheld devices, vehicle-mounted devices, wearable devices, or computing devices with wireless communication capabilities. Exemplarily, the terminal can be a mobile phone, a tablet computer, or a computer with wireless transceiver capabilities. The terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in autonomous driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, and so on.

[0051] The server can be a single physical server, or a server cluster consisting of multiple servers. Alternatively, the server cluster can be a distributed cluster. Alternatively, the server can be a cloud server. This application does not limit the specific implementation of the server.

[0052] Figure 2 This is one of the flowcharts illustrating the device malfunction detection method provided by the present invention, such as... Figure 2 As shown, the method includes the following: Step 201: Obtain the current operating indicators and current behavioral characteristics of the device under test.

[0053] Among them, operational indicators are used to indicate the operating status and resource usage of the equipment under test. Behavioral characteristics are used to indicate the operations or events occurring on the equipment under test.

[0054] For example, performance metrics may include CPU utilization, memory usage, disk input / output (I / O) rates, and network traffic. Behavioral characteristics may include, but are not limited to, abnormal process startups, sensitive file modifications, abnormal network connection establishment, and registry changes.

[0055] In one possible implementation, a lightweight agent component is deployed in the device under test. This agent component can collect the current operating metrics and behavioral characteristics of the device. The device under test can then send these operating metrics and behavioral characteristics to an anomaly response agent via the agent component. The anomaly response agent can receive the operating metrics and behavioral characteristics sent by the agent component.

[0056] In some embodiments, the agent component can acquire initial operating metrics and initial behavioral characteristics. Subsequently, the agent component can perform data preprocessing on the initial operating metrics and initial behavioral characteristics to obtain current operating metrics and current behavioral characteristics.

[0057] It should be noted that the embodiments of this application do not limit the data preprocessing. For example, data preprocessing may include at least one of the following: data cleaning, data standardization, and data smoothing. For example, data cleaning may include removing null values, negative values, erroneous data points, etc. Data standardization can be achieved by using the Z-score standardization method to unify the data. Data smoothing refers to applying a sliding window average to the standardized data to reduce drastic fluctuations over short periods and improve the robustness of the model.

[0058] Step 202: Determine the current load mode of the device under test based on the current operating indicators.

[0059] The load mode is used to indicate the operating status of the device under test in processing services.

[0060] For example, load modes may include low load mode, normal load mode, and high load mode. Under different load modes, the value range and fluctuation characteristics of various operating indicators are different.

[0061] In one possible implementation, a historical load pattern library can be obtained, which includes multiple load patterns. Then, based on current operating metrics, each load pattern can be matched, and the pattern with the highest matching degree can be selected as the current load pattern.

[0062] The historical load pattern library can be determined based on historical operating metrics. Multiple load patterns are identified by clustering historical operating metrics.

[0063] Step 203: Determine the anomaly detection conditions that match the current load pattern.

[0064] Among them, the anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators.

[0065] For example, anomaly detection conditions may include thresholds for multiple operational metrics.

[0066] In the embodiments of this application, one load mode corresponds to one anomaly detection condition.

[0067] For example, as shown in Table 1, it illustrates the anomaly detection conditions corresponding to different load modes.

[0068] Table 1

[0069] For example, referring to Table 1, in low-load mode, the CPU utilization threshold is 15%, the memory usage threshold is 30%, the disk I / O threshold is 20MB / s, and the network traffic threshold is 10Mbps. Therefore, the anomaly detection conditions for low-load mode include: current CPU utilization greater than 15%, current memory usage greater than 30%, current disk I / O greater than 20MB / s, and current network traffic greater than 10Mbps. In high-load mode, the CPU utilization threshold is 90%, the memory usage threshold is 80%, the disk I / O threshold is 100MB / s, and the network traffic threshold is 70Mbps. Therefore, the anomaly detection conditions for low-load mode include: current CPU utilization greater than 90%, current memory usage greater than 80%, current disk I / O greater than 100MB / s, and current network traffic greater than 70Mbps. Similarly, the descriptions of normal load mode and sudden peak mode can be found above and will not be repeated here.

[0070] The following section introduces the generation methods for the operating indicator thresholds corresponding to different load modes.

[0071] In one possible implementation, a threshold coefficient can be determined based on the load pattern, and then the operating metric threshold can be determined based on the threshold coefficient and historical operating metrics. Different load patterns correspond to different threshold coefficients.

[0072] For example, the mean and standard deviation of historical operating indicators can be determined, and then the operating indicator threshold can be determined based on the mean and standard deviation of historical operating indicators and the threshold coefficient. The operating indicator threshold satisfies the following formula one.

[0073] Formula 1.

[0074] in, The threshold used to represent the operating metric i when the business processing cycle is u and the load mode is p; Used to represent the average value of performance index i. The standard deviation of performance index i is used to represent the threshold coefficient. For example, the threshold coefficient can be 2, 2.1, 3, etc.

[0075] It should be understood that the load size corresponding to the load pattern is positively correlated with the threshold coefficient. Furthermore, this operational metric threshold can be updated periodically.

[0076] Step 204: Determine whether the current operating indicators meet the anomaly detection conditions.

[0077] In this embodiment of the application, when the current operating indicator includes multiple operating indicators, if there is an operating indicator among the current operating indicators that meets the anomaly detection conditions, then the current operating indicator is determined to meet the anomaly detection conditions. If none of the current operating indicators meet the anomaly detection conditions, then the current operating indicator is determined not to meet the anomaly detection conditions.

[0078] For example, referring to Table 1, if the current load mode is low load mode, the current CPU utilization is 20%, the current memory usage is 35%, the current disk I / O is 30MB / s, and the current network traffic is 5Mbps, then the current operating metrics meet the anomaly detection conditions. If the current load mode is low load mode, the current CPU utilization is 10%, the current memory usage is 15%, the current disk I / O is 15MB / s, and the current network traffic is 5Mbps, then the current operating metrics do not meet the anomaly detection conditions.

[0079] In some embodiments, if the current operating indicators meet the anomaly detection conditions, step 205 is executed. If the current operating indicators do not meet the anomaly detection conditions, it is determined that the device under test does not have an anomaly.

[0080] Step 205: Based on the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics, determine the abnormal risk information of the equipment to be tested.

[0081] Among them, the abnormal risk information is used to indicate whether there is an abnormality in the device under test.

[0082] It should be understood that the anomaly risk information is a comprehensive assessment result used to ultimately determine whether the device under test is abnormal. This information can be a binary classification result (yes / no abnormality) or a risk score used to quantify the risk level. This application's embodiments do not limit this.

[0083] Furthermore, the device anomalies mentioned in the embodiments of this application can be anomalies caused by device malfunctions or anomalies caused by attacks, and the embodiments of this application do not limit them.

[0084] In this embodiment of the application, when the current operating indicators meet the anomaly detection conditions, the abnormal risk information of the device to be detected is determined based on the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics.

[0085] It should be noted that abnormal operation indicators refer to indicators that exceed the range of their corresponding abnormal detection conditions. Abnormal behavior characteristics can be suspicious behaviors identified based on predefined rules (such as blacklists, whitelists, behavioral baselines, etc.).

[0086] In one possible implementation, an anomaly is determined in the device under test when the abnormal operating indicators match the abnormal behavior characteristics.

[0087] For example, if a surge in disk I / O and network traffic is detected simultaneously (abnormal operation indicators), and an abnormal process is also detected attempting to send a large amount of data outward (abnormal behavior characteristics), then it is determined that the device under test is abnormal.

[0088] Based on the above technical solution, this method achieves accurate detection of equipment anomalies by first acquiring the current operating indicators and behavioral characteristics of the device under test, then determining the current load mode of the device based on the operating indicators and matching corresponding anomaly detection conditions, and finally, when the operating indicators meet the conditions, combining abnormal operating indicators and abnormal behavioral characteristics to determine the risk information of equipment anomalies. This method abandons a unified and fixed anomaly judgment standard, adapting corresponding anomaly detection conditions according to the actual load mode of the device, making anomaly judgment more closely aligned with the actual operating state of the device, and effectively reducing false alarms and missed alarms caused by rigid standards. Furthermore, combining operating indicators and behavioral characteristics for anomaly risk judgment enables more comprehensive and accurate identification of equipment anomalies, improving the accuracy of equipment anomaly detection.

[0089] It should be noted that the load on the device under test may vary significantly across different time periods. Therefore, confirming the load pattern at different time periods can improve the accuracy of the load pattern.

[0090] Figure 3 This is a second schematic flowchart of the equipment malfunction detection method provided by the present invention, as shown below. Figure 3 As shown, step 202 includes the following: Step 301: Based on the current time, determine the target processing cycle from multiple business processing cycles.

[0091] In one possible implementation, the time period for the device under test to process its business can be divided into multiple business processing cycles based on the time dimension.

[0092] For example, multiple business processing cycles include peak and off-peak periods. Peak periods are from 08:00 to 18:00, and off-peak periods are from 18:00 to 08:00 the next day. If the current time is 9:25, then the target processing cycle is the peak period.

[0093] Step 302: Based on historical operating metrics within the target processing cycle, determine multiple load patterns within the target processing cycle.

[0094] Different load modes correspond to different operating metrics.

[0095] It should be understood that, in the embodiments of this application, the load pattern is a set of operating states summarized by analyzing historical operating indicators within a specific business processing cycle. For example, during the peak business period, cluster analysis can identify regular peak patterns and sudden peak patterns. The data sources for constructing these patterns are limited to historical data from peak business periods.

[0096] For example, K-means clustering analysis can be performed on historical multi-dimensional indicator data (such as CPU, memory, disk I / O, and network traffic) of the device under test during peak business periods over the past month. The goal of the K-means algorithm is to divide the data points into K clusters, such that each data point belongs to the cluster represented by its nearest cluster center. The cluster center represents a load pattern. In this way, several different operating patterns of the device can be discovered within peak periods. For example, Cluster 1 (regular peak mode): CPU average 50%, memory average 60%; Cluster 2 (burst peak mode): CPU average 85%, memory average 80%.

[0097] In this way, multiple fine-grained load patterns can be identified for the peak business periods of the device under test.

[0098] In some embodiments, the data difference between peak and off-peak periods can be determined. If the data difference is greater than or equal to a difference threshold, the peak and off-peak periods are modeled separately to obtain multiple load patterns. If the data difference is less than the difference threshold, the peak and off-peak periods are modeled uniformly.

[0099] For example, data discrepancies can be calculated using the average of operating metrics during peak business periods and the average of operating metrics during off-peak business periods. Alternatively, data discrepancies can be calculated using the standard deviation of operating metrics during peak business periods and the standard deviation of operating metrics during off-peak business periods.

[0100] Step 303: Based on the current operating metrics, determine the current load mode from multiple load modes.

[0101] In one possible implementation, the similarity between the current operating metrics and each load pattern can be calculated. Then, the load pattern with the highest similarity is selected as the current load pattern.

[0102] For example, the Euclidean distance between the current operating metric and the cluster center vector corresponding to each load mode can be calculated. Then, the load mode represented by the cluster center with the smallest distance is determined as the current load mode.

[0103] Understandably, by combining the current time to accurately locate the target processing cycle from multiple business processing cycles, and then dividing different load modes based on historical operating indicators within that cycle, and finally matching the current operating indicators to determine the current load mode of the device, the load mode determination aligns with the operating patterns of the device across different business processing cycles. This approach fully considers the differences in the device's operating characteristics across different business cycles, avoiding a singular load determination method detached from the business cycle. Furthermore, it provides precise cycle and mode basis for subsequent matching and adaptation of anomaly detection conditions, further improving the accuracy of anomaly detection.

[0104] Figure 4 This is the third flowchart of the equipment malfunction detection method provided by the present invention, as shown below. Figure 4 As shown, step 205 includes the following: Step 401: Based on the correlation information of indicator behavior, determine the target correlation degree corresponding to the abnormal operation indicators and abnormal behavior characteristics.

[0105] Among them, the indicator behavior correlation information is used to characterize the degree of correlation between abnormal operation indicators and behavioral characteristics.

[0106] For example, the correlation information between indicators and behaviors can be a two-dimensional matrix. Rows represent abnormal operating indicators (such as abnormal CPU usage or abnormal memory usage), columns represent behavioral characteristics (such as abnormal process startup or suspicious file operations), and each element value in the matrix represents the correlation degree. The higher the correlation degree, the stronger the correlation between the abnormal operating indicator and the behavioral characteristic.

[0107] For example, if the correlation between abnormal CPU usage and abnormal process startup is 0.92, the correlation with suspicious file operations is 0.70, the correlation with abnormal network connections is 0.75, the correlation with registry modification is 0.60, and the correlation with abnormal permission requests is 0.55, then if the abnormal operation indicator is CPU usage and the abnormal behavior characteristic is abnormal network connections, then the target correlation is 0.75.

[0108] It should be understood that indicator behavior association information can be generated during the process of determining the target correlation. Alternatively, indicator behavior association information can be generated in advance, and this application embodiment does not limit this. The following describes the process of generating indicator behavior association information (steps 1-3).

[0109] Step 1: You can obtain multiple historical abnormal indicators and multiple historical abnormal behavior characteristics.

[0110] Step 2: For each historical abnormal indicator, perform a correlation analysis between the historical abnormal indicator and each historical abnormal behavior feature to determine the degree of correlation between the historical abnormal indicator and each historical abnormal behavior feature.

[0111] In one possible implementation, a pre-defined correlation processing algorithm can be used to process historical abnormal indicators and historical abnormal behavior characteristics to determine the correlation degree.

[0112] It should be understood that the preset association processing algorithm can be partial correlation analysis, association rule mining, mutual information, etc., and the embodiments of this application do not limit it.

[0113] For example, mutual information (MI) can be used to calculate the correlation between indicators and behaviors. The correlation satisfies the following formula 2.

[0114] Formula 2.

[0115] Where H represents multiple historical anomaly indicators, and V represents multiple historical anomaly behavior features. x is any one of the multiple historical anomaly indicators, and y is any one of the multiple historical anomaly behavior features. p(x, y) represents the joint probability of historical anomaly indicator x and historical anomaly behavior feature y occurring simultaneously. p(x) represents the marginal probability of historical anomaly indicator x occurring, and p(y) represents the marginal probability of historical anomaly behavior feature y occurring.

[0116] Step 3: Construct indicator behavior correlation information based on the correlation between each historical abnormal indicator and each historical abnormal behavior feature.

[0117] Among them, the indicator behavior association information includes multiple association degrees, each of which is used to characterize the degree of association between a historical abnormal indicator and a historical abnormal behavior feature.

[0118] For example, as shown in Table 2, it illustrates the degree of correlation between historical anomaly indicators and historical anomalous behavioral characteristics.

[0119] Table 2

[0120] For example, as shown in Table 2, the correlation between abnormal CPU usage and abnormal process startup is 0.92, with suspicious file operations 0.70, with abnormal network connections 0.75, with registry modifications 0.60, and with abnormal permission requests 0.55; the correlation between abnormal memory usage and abnormal process startup is 0.80, with suspicious file operations 0.85, with abnormal network connections 0.65, with registry modifications 0.50, and with abnormal permission requests 0.60. The descriptions of the correlations between other abnormal indicators and abnormal behavioral characteristics can be found above and will not be repeated here.

[0121] In some embodiments, if the indicator behavior association information meets the update conditions, the indicator behavior association information is updated to obtain the updated indicator behavior association information.

[0122] The update conditions include: the usage duration of the indicator behavior-related information is greater than a preset time threshold, and / or the anomaly detection accuracy is less than a preset accuracy threshold. The anomaly detection accuracy is the accuracy of detecting whether the device under test has an anomaly.

[0123] It should be noted that the method for determining the accuracy of anomaly detection can be found in the following examples, which will not be elaborated here.

[0124] Understandably, using the usage duration of indicator behavior-related information and the accuracy of anomaly detection as core update triggers, and employing a dynamic update mechanism, ensures that the related information is always adapted to the latest device operating characteristics. This guarantees regular iteration of the related information and allows for immediate optimization when detection results are unsatisfactory, further enhancing the accuracy of anomaly risk detection.

[0125] Based on the above technical solution, by conducting correlation analysis on each historical anomaly indicator and each historical anomaly behavior feature, the degree of correlation between the two is determined, and indicator-behavioral correlation information is constructed based on all correlation degrees, thus realizing the quantitative presentation of the correlation between anomaly indicators and anomaly behavior features. In this way, the inherent connection between different anomaly indicators and various suspicious behaviors can be determined, and when anomaly indicators are detected, the corresponding suspicious behavior features can be matched, thereby improving the accuracy of anomaly risk identification.

[0126] In some embodiments, the anomaly response agent stores a correspondence between multiple preset devices and multiple preset indicator behavior association information. One preset device corresponds to one preset indicator behavior association information.

[0127] In this embodiment, attribute information of the device to be tested can be obtained, including device type or device identifier. Then, based on the attribute information of the device to be tested, indicator behavior association information is determined from multiple preset indicator behavior association information.

[0128] In one possible design, the attribute information includes the device type. Based on the device type of the device to be detected, the indicator behavior association information can be determined from multiple preset indicator behavior association information. One preset indicator behavior association information corresponds to one device type.

[0129] For example, device types can be categorized as web servers, database servers, office terminals, etc. Different types of devices have different operating characteristics, therefore different preset indicator behavior association information (also known as attack attribute lookup tables) are required.

[0130] Alternatively, the attribute information may include a device identifier. Based on the device identifier of the device to be tested, the associated indicator behavior information can be determined from multiple preset indicator behavior association information. One preset indicator behavior association information corresponds to one device identifier.

[0131] Understandably, matching the corresponding indicator behavior information with the equipment can improve the accuracy of the correlation between abnormal operation indicators and abnormal behavior characteristics, thereby improving the accuracy of anomaly detection.

[0132] Step 402: Determine the abnormal risk value of the device to be tested based on abnormal operation indicators, abnormal behavior characteristics, and target correlation.

[0133] In one possible implementation, the abnormal risk value of the device to be tested is determined by weighted calculation based on abnormal operation indicators, abnormal behavior characteristics, and target correlation.

[0134] For example, the abnormal risk value can satisfy the following formula three.

[0135] Formula 3.

[0136] in, Used to represent the i-th abnormal operation indicator, Used to represent the j-th abnormal behavior feature, Used to represent the correlation degree (i.e., target correlation degree) between the i-th abnormal operation indicator and the j-th abnormal behavior feature.

[0137] For example, and All of these can be represented by vectors.

[0138] Step 403: Determine abnormal risk information based on abnormal risk values.

[0139] In one possible implementation, the abnormal risk value can be compared with a preset risk threshold. If the abnormal risk value is greater than or equal to the preset risk threshold, the abnormal risk information indicates that the device under test has an abnormality. If the abnormal risk value is less than the preset risk threshold, the abnormal risk information indicates that the device under test does not have an abnormality.

[0140] For example, the preset risk threshold can be 0.7, 0.65, 0.75, etc., and this application embodiment does not limit it.

[0141] Based on the above technical solution, the abnormal risk value of the equipment under test is calculated by combining abnormal operation indicators, abnormal behavior characteristics, and target correlation. In this way, differentiated weights can distinguish the degree of correlation between various abnormal combinations, making the abnormal risk value more closely reflect the actual risk situation and significantly improving the accuracy of equipment abnormal risk detection.

[0142] In some embodiments, when it is determined that the device under test is abnormal, an appropriate strategy can be selected to handle the abnormal event.

[0143] Figure 5 This is the fourth flowchart of the equipment malfunction detection method provided by the present invention, as shown below. Figure 5 As shown, the method also includes the following: Step 501: Determine the current anomaly type and current risk level of the equipment to be tested.

[0144] In this embodiment of the application, when the current operating indicators meet the abnormality detection conditions, the current abnormality type and current risk level of the device to be detected are determined.

[0145] In one possible implementation, the current anomaly type can be determined based on abnormal operational indicators and abnormal behavior characteristics. Furthermore, the current risk level can be determined based on the anomaly risk value.

[0146] For example, the current anomaly type can be DDoS attack, virus, mining trojan, etc., and the current risk level can be low, medium or high.

[0147] Step 502: Determine the anomaly response instructions based on the current anomaly type and the current risk level.

[0148] Among them, the abnormal response command is used to indicate the handling of abnormal situations existing in the device under test.

[0149] In one possible implementation, the system can query a pre-defined response strategy library based on the current exception type and risk level to determine the exception response instruction.

[0150] For example, for high-risk cryptomining trojan attacks, the abnormal response instructions could include isolating the host and terminating the malicious process. For medium-risk port scanning behavior, the response instructions could include temporarily blocking the source IP on the firewall.

[0151] Step 503: Send an abnormal response command to the device under test.

[0152] Understandably, after determining the current anomaly type and risk level of the device under test, a corresponding anomaly response command can be generated, instructing the device under test to perform an operation to resolve the anomaly.

[0153] Figure 6 This is the fifth flowchart of the equipment malfunction detection method provided by the present invention, as shown below. Figure 6 As shown, the method also includes the following: Step 601: Obtain anomaly detection response information.

[0154] Among them, the anomaly detection response information is used to indicate whether the anomaly risk information is correct.

[0155] For example, this anomaly detection response information can come from feedback from human operations and maintenance personnel. For instance, when an operations and maintenance personnel review an alarm on the platform, if they believe it is a false alarm, they can mark it as "false alarm"; if they believe it is a missed alarm, they can mark it as "missed alarm." This marking information is the anomaly detection response information.

[0156] Step 602: Based on the anomaly detection response information and the historical anomaly detection accuracy, obtain the anomaly detection accuracy.

[0157] In other words, this feedback can be continuously collected, and the current anomaly detection accuracy can be evaluated in real time or periodically.

[0158] For example, suppose 1000 anomaly detections have been completed historically, with a historical anomaly detection accuracy of 90% (i.e., 900 correct detections and 100 false positives / false negatives). If a new batch of 100 anomaly detection response messages is added, with 92 correct detections and 8 false positives, then the latest anomaly detection accuracy is 90.18%.

[0159] Based on the above technical solution, by acquiring anomaly detection response information, a real and objective feedback label is introduced, solving the blind spot of lacking verification basis for detection results. Then, based on this response information and historical anomaly detection accuracy, the updated accuracy is dynamically calculated, achieving a quantitative evaluation of detection performance. This closed-loop feedback mechanism can perceive fluctuations in its own detection performance in real time and use the quantified accuracy as the decision-making basis for triggering subsequent optimization actions.

[0160] The following describes the device malfunction detection apparatus provided by the present invention. The device malfunction detection apparatus described below corresponds to the device malfunction detection method described above. It is understood that, in order to achieve the above functions, the electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the device malfunction detection method steps described in conjunction with the embodiments disclosed herein, the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0161] Figure 7 This is a schematic diagram of the device for detecting equipment malfunctions provided by the present invention, as shown below. Figure 7 As shown, the device for detecting equipment malfunctions includes the following modules: acquisition module 701, processing module 702, and sending module 703.

[0162] The acquisition module 701 is used to acquire the current operating indicators and current behavioral characteristics of the device under test. The processing module 702 is used to determine the current load mode of the device under test based on the current operating indicators, and to determine the anomaly detection conditions matching the current load mode. The anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators. The processing module 702 is also used, if the current operating indicators meet the anomaly detection conditions, to determine the anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics. The anomaly risk information is used to indicate whether there are any anomalies in the device under test.

[0163] In one possible implementation, the device to be tested includes multiple service processing cycles. Processing module 702 is specifically used to determine a target processing cycle from the multiple service processing cycles based on the current time. Processing module 702 is also specifically used to determine multiple load modes within the target processing cycle based on historical operating indicators within the target processing cycle, with different operating indicators corresponding to different load modes. Processing module 702 is further used to determine the current load mode from the multiple load modes based on the current operating indicators.

[0164] In another possible implementation, processing module 702 is specifically used to determine the target correlation degree corresponding to the abnormal operation indicators and abnormal behavior characteristics based on indicator behavior correlation information. The indicator behavior correlation information is used to characterize the degree of correlation between abnormal operation indicators and behavior characteristics. Processing module 702 is specifically used to determine the abnormal risk value of the device to be tested based on the abnormal operation indicators, abnormal behavior characteristics, and target correlation degree. Processing module 702 is specifically used to determine abnormal risk information based on the abnormal risk value.

[0165] In another possible implementation, the acquisition module 701 is further configured to acquire the device type of the device to be detected. The processing module 702 is further configured to determine indicator behavior association information from multiple preset indicator behavior association information based on the device type of the device to be detected, wherein one preset indicator behavior association information corresponds to one device type.

[0166] In another possible implementation, the acquisition module 701 is further configured to acquire multiple historical anomaly indicators and multiple historical anomaly behavior features. The processing module 702 is further configured to perform a correlation analysis on each historical anomaly indicator and each historical anomaly behavior feature to determine the degree of correlation between the historical anomaly indicator and each historical anomaly behavior feature. The processing module 702 is further configured to construct indicator behavior correlation information based on the degree of correlation between each historical anomaly indicator and each historical anomaly behavior feature; wherein, the indicator behavior correlation information includes multiple correlation degrees, each correlation degree representing the degree of correlation between a historical anomaly indicator and a historical anomaly behavior feature.

[0167] In another possible implementation, the device further includes a sending module 703. The processing module 702 is further configured to determine the current anomaly type and current risk level of the device under test. The processing module 702 is also configured to determine an anomaly response instruction based on the current anomaly type and current risk level, the anomaly response instruction being used to instruct on handling the anomaly present in the device under test. The sending module 703 is configured to send the anomaly response instruction to the device under test.

[0168] In another possible implementation, the processing module 702 is further configured to update the indicator behavior association information when the indicator behavior association information meets the update conditions, thereby obtaining the updated indicator behavior association information. The update conditions include: the usage duration of the indicator behavior association information is greater than a preset time threshold, and / or, the anomaly detection accuracy is less than a preset accuracy threshold, where the anomaly detection accuracy is the accuracy rate at which anomalies are detected in the device under test.

[0169] In another possible implementation, the acquisition module 701 is further configured to acquire anomaly detection response information, which indicates whether the anomaly risk information is correct. The processing module 702 is further configured to obtain anomaly detection accuracy based on the anomaly detection response information and historical anomaly detection accuracy.

[0170] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a device anomaly detection method. This method includes: acquiring the current operating indicators and current behavioral characteristics of the device under test; determining the current load mode of the device under test based on the current operating indicators, and determining anomaly detection conditions matching the current load mode. The anomaly detection conditions are used to determine whether the operating indicators are abnormal. If the current operating indicators meet the anomaly detection conditions, determining the anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics. The anomaly risk information is used to indicate whether the device under test is abnormal.

[0171] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the device anomaly detection method provided by the above methods. This method includes: acquiring the current operating indicators and current behavioral characteristics of the device under test; determining the current load mode of the device under test based on the current operating indicators, and determining anomaly detection conditions matching the current load mode, wherein the anomaly detection conditions are used to determine whether the operating indicators are abnormal; and, if the current operating indicators meet the anomaly detection conditions, determining anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics, wherein the anomaly risk information is used to indicate whether the device under test is abnormal.

[0173] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the device anomaly detection method provided by the methods described above. This method includes: acquiring the current operating indicators and current behavioral characteristics of the device under test; determining the current load mode of the device under test based on the current operating indicators, and determining anomaly detection conditions matching the current load mode, wherein the anomaly detection conditions are used to determine whether the operating indicators are abnormal; and, if the current operating indicators meet the anomaly detection conditions, determining anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics, wherein the anomaly risk information is used to indicate whether the device under test is abnormal.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting equipment malfunctions, characterized in that, The method includes: Obtain the current operating indicators and current behavioral characteristics of the device under test; Based on the current operating indicators, the current load mode of the device under test is determined, and anomaly detection conditions matching the current load mode are determined. The anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators. If the current operating indicators meet the anomaly detection conditions, the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics are used to determine the abnormal risk information of the device to be tested. The abnormal risk information is used to indicate whether the device to be tested has an anomaly.

2. The method according to claim 1, characterized in that, The device under test includes multiple business processing cycles; determining the current load mode of the device under test based on the current operating indicators includes: Based on the current time, determine the target processing cycle from the multiple business processing cycles; Based on historical operating metrics within the target processing cycle, multiple load modes are determined within the target processing cycle, with different operating metrics corresponding to different load modes. Based on the current operating metrics, the current load mode is determined from the plurality of load modes.

3. The method according to claim 1, characterized in that, The step of determining the abnormal risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavior characteristics in the current behavior characteristics includes: Based on the indicator behavior association information, the target correlation degree corresponding to the abnormal operation indicator and the abnormal behavior feature is determined. The indicator behavior association information is used to characterize the degree of correlation between the abnormal operation indicator and the behavior feature. Based on the abnormal operation indicators, the abnormal behavior characteristics, and the target correlation, the abnormal risk value of the device to be detected is determined; Based on the abnormal risk value, the abnormal risk information is determined.

4. The method according to claim 3, characterized in that, Before determining the target correlation degree corresponding to the abnormal operation indicator based on the indicator behavior correlation information, the method further includes: Obtain the device type of the device to be tested; Based on the device type of the device to be tested, the indicator behavior association information is determined from multiple preset indicator behavior association information, and one preset indicator behavior association information corresponds to one device type.

5. The method according to claim 3, characterized in that, The method further includes: Obtain multiple historical abnormal indicators and multiple historical abnormal behavior characteristics; For each of the historical anomaly indicators, a correlation analysis is performed between the historical anomaly indicators and each of the historical anomaly behavioral features to determine the degree of correlation between the historical anomaly indicators and each of the historical anomaly behavioral features. Based on the correlation degree between each of the historical abnormal indicators and each of the historical abnormal behavior features, the indicator behavior correlation information is constructed; wherein, the indicator behavior correlation information includes multiple correlation degrees, and each correlation degree is used to characterize the degree of correlation between a historical abnormal indicator and a historical abnormal behavior feature.

6. The method according to claim 3, characterized in that, The method further includes: Determine the current anomaly type and current risk level of the device under test; Based on the current anomaly type and the current risk level, an anomaly response instruction is determined, which is used to instruct on how to handle the anomaly situation existing in the device under test; Send the abnormal response command to the device under test.

7. The method according to claim 6, characterized in that, The method further includes: If the indicator behavior association information meets the update conditions, update the indicator behavior association information to obtain the updated indicator behavior association information. The update conditions include: the usage duration of the indicator behavior association information is greater than a preset time threshold, and / or the anomaly detection accuracy is less than a preset accuracy threshold, wherein the anomaly detection accuracy is the accuracy of detecting whether the device under test has an anomaly.

8. The method according to claim 7, characterized in that, The method further includes: Obtain an anomaly detection response information, which is used to indicate whether the anomaly risk information is correct; The anomaly detection accuracy is obtained based on the anomaly detection response information and the historical anomaly detection accuracy.

9. A device for detecting equipment malfunctions, characterized in that, The device includes: The acquisition module is used to acquire the current operating indicators and current behavioral characteristics of the device under test; The processing module is used to determine the current load mode of the device under test based on the current operating indicators, and to determine the anomaly detection conditions that match the current load mode. The anomaly detection conditions are used to determine whether there are any anomalies in the operating indicators. The processing module is further configured to, when the current operating indicators meet the anomaly detection conditions, determine the anomaly risk information of the device under test based on the anomaly operating indicators in the current operating indicators and the anomaly behavior characteristics in the current behavior characteristics, wherein the anomaly risk information is used to indicate whether the device under test is abnormal.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the device anomaly detection method as described in any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the device anomaly detection method as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the device anomaly detection method as described in any one of claims 1 to 8.

Images