Encryption system abnormal event alarm triggering method and related device

Abstract

The application discloses an encryption system abnormal event alarm triggering method and related equipment, and relates to the technical fields of encryption systems and security device monitoring. The encryption system abnormal event alarm triggering method comprises the following steps: in the case that an encryption call has an abnormal event, abnormal event information is extracted; based on the abnormal event information and an event classification rule, an event category is determined; based on the event category, an alarm triggering method is determined; wherein, the alarm triggering method comprises a service level triggering method used for determining an abnormal centralized service dimension of the abnormal event based on a preset composite triggering algorithm and a preset centralization algorithm; based on the alarm triggering method and the abnormal event information, the alarm of the abnormal event is triggered; and alarm triggering records are output. The application extracts abnormal event information, determines an abnormal centralized service dimension through a service level triggering method, thereby expressing abnormal information of a service dimension when triggering an abnormal event alarm, and improving the effect of abnormal event alarm triggering.

Description

Technical Field

[0001] This application relates to the field of encryption system and security device monitoring technology, and in particular to encryption system abnormal event alarm triggering method and related equipment. Background Technology

[0002] In encrypted business systems, the same error can often stem from different underlying causes. For example, a signature interface failure could be due to several factors: the application instance's thread pool running out of resources, causing a request timeout; a database connection becoming unavailable, preventing the query of business parameters; a missing certificate on an HSM (Hardware Security Module); an incorrect certificate number being passed from an access channel; or a business identifier being incorrectly routed to an abnormal device. Therefore, when triggering alarms for abnormal events, it is essential to clearly identify the root cause of the event.

[0003] Current methods typically use general metrics for alerts. When an alert is triggered, they can only detect an increase in the number of errors. It is difficult to determine the cause of the anomaly in the same triggering chain through the alert triggering information. This makes it difficult for the current methods to express abnormal information at the business level, resulting in poor effectiveness of current abnormal event alert triggering. Summary of the Invention

[0004] The main purpose of this application is to provide a method and related equipment for triggering abnormal events in an encryption system, aiming to solve the technical problem that the current abnormal event alarm triggering effect is poor.

[0005] To achieve the above objectives, this application proposes a method for triggering an abnormal event alarm in an encryption system, the method comprising: In the event of an abnormal event during an encrypted call, the information of the abnormal event is extracted to obtain the abnormal event information; Based on the abnormal event information and the preset event classification rules, the event category of the abnormal event is determined; Based on the event category, an alarm triggering method for the abnormal event is determined, wherein the alarm triggering method includes a business-level triggering method, which is used to determine the abnormal centralized business dimension of the abnormal event based on a preset composite triggering algorithm and a preset centralized algorithm. Based on the alarm triggering method and the abnormal event information, an alarm for the abnormal event is triggered, and an alarm triggering record is output.

[0006] In one embodiment, if the alarm triggering method is the service-level triggering method, then the step of triggering an alarm for the abnormal event based on the alarm triggering method and the abnormal event information, and outputting an alarm triggering record includes: Obtain the event time window and event triggering dimension set of the abnormal event; Based on the error type families in the event triggering dimension set, the event time window, the abnormal event information, and the preset composite abnormal triggering algorithm, the triggering type of the abnormal event and the corresponding time-series abnormal score are determined. If the time-series anomaly score is higher than the preset time-series anomaly threshold, then based on the anomaly event information and the preset business dimension concentration algorithm, the dimension concentration score of the business dimension in the preset business dimension attribution set is calculated. If the dimensionality score is higher than the preset dimensionality threshold, the corresponding dimensionality information is recorded, and the alarm trigger record containing the dimensionality information is output.

[0007] In one embodiment, the step of determining the triggering type of the abnormal event and the corresponding time-series anomaly score based on the error type family in the event triggering dimension set, the event time window, the abnormal event information, and a preset composite anomaly triggering algorithm includes: Based on the abnormal event information, obtain the number of errors that match the error type family within the event time window, and obtain the total number of encrypted call requests; The error rate of the encrypted call is calculated based on the number of errors and the total number of requests, and the burn rate of the encrypted call is calculated based on the number of errors, the total number of requests, and the preset target success rate. Based on the preset monitoring configuration, one of the parameters, namely the number of errors, the error rate, and the combustion rate, is used as an anomaly indicator. Based on the historical baseline window in the event time window, the abnormal indicators corresponding to each preset time period in the historical baseline window are obtained to obtain the historical abnormal indicators. Based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm, the triggering type of the anomaly event is determined; The temporal anomaly score of the abnormal event is determined based on the number of errors, the error rate, the burn rate, the historical anomaly index, and the composite anomaly triggering algorithm.

[0008] In one embodiment, the triggering types include fixed threshold sample size triggering, multi-window loss triggering, dynamic baseline triggering, seasonal residual triggering, weighted average triggering, cumulative sum triggering, and frequency domain residual expansion triggering; the burn rate includes short-term window burn rate and long-term window burn rate; and the step of determining the triggering type of the anomalous event based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm includes: Calculate the median and expected value of each of the historical anomaly indicators, and calculate the weighted average of each of the historical anomaly indicators based on preset weights; If the number of errors is higher than a preset error number threshold, or the error rate is higher than a preset error rate threshold, then the trigger type is determined to include the fixed threshold sample size trigger. If both the short-term window burn rate and the long-term window burn rate exceed a preset burn rate threshold, then the trigger type is determined to include the multi-window loss trigger. Obtain abnormal time series data within the current event time window. If the standard deviation multiple of the difference between the abnormal time series data and the median is higher than a preset difference multiple threshold, or if the abnormal time series data is higher than a preset high-level abnormal index in the historical abnormal index, then determine that the trigger type includes the dynamic baseline trigger. If the expected residual between the abnormal time series data and the expected value is higher than a preset residual threshold, then the trigger type is determined to include the seasonal residual trigger; if the weighted average is higher than a preset weighted average threshold, then the trigger type is determined to include the weighted average trigger. Subtract the expected value and the preset allowable offset from the abnormal time series data to obtain the offset value. Add the offset values ​​within the event time window to obtain the cumulative value. If the cumulative value is higher than the preset cumulative threshold, then the trigger type is determined to include the accumulation and trigger. The abnormal time series data is transformed in the frequency domain based on a preset frequency domain residual processing function to obtain an anomaly significance score. If the anomaly significance score is higher than a preset significance score threshold, the trigger type is determined to include the frequency domain residual extension trigger.

[0009] In one embodiment, the step of determining the temporal anomaly score of the abnormal event based on the number of errors, the error rate, the burn rate, the historical anomaly index, and the composite anomaly triggering algorithm includes: Calculate the error ratio between the number of errors and the error threshold, and calculate the error ratio between the error rate and the error rate threshold. Use the higher of the error ratio and the error rate ratio as the fixed threshold sample size score. Calculate the short-term ratio of the short-term window combustion rate to the combustion rate threshold, and calculate the long-term ratio of the long-term window combustion rate to the combustion rate threshold. The smaller of the short-term ratio and the long-term ratio is taken as the multi-window loss score. Calculate the high-level anomaly difference between the abnormal time series data and the high-level anomaly index, and determine the dynamic baseline score based on the high-level anomaly difference and the standard deviation multiple; The ratio of the expected residual to the residual threshold is used as the seasonal residual score, the ratio of the weighted average to the weighted average threshold is used as the weighted average score, the ratio of the accumulated value to the accumulated threshold is used as the accumulated sum score, and the ratio of the abnormal significance score to the significance score threshold is used as the frequency domain residual expansion score. The maximum value among the fixed threshold sample size score, the multi-window loss score, the dynamic baseline score, the seasonal residual score, the weighted average score, the cumulative score, and the frequency domain residual expansion score is used as the time-series anomaly score.

[0010] In one embodiment, the step of calculating the dimension centrality score of the business dimensions in the preset business dimension attribution set based on the abnormal event information and the preset business dimension centrality algorithm includes: For each of the business dimensions, based on the abnormal event information, the number of abnormal events for the business dimension is determined, and the dimension with the most abnormal events is selected as the target business dimension from among all the business dimensions. Calculate the Herfindahl index, information entropy, traffic increase multiple compared to the same period in history, Shannon divergence, and field missing ratio for the target business dimension respectively; The dimensional centrality score is calculated based on the Herfindahl index, the information entropy, the traffic increase factor, the Shannon divergence, the field missing ratio, and the preset centrality weight coefficient.

[0011] In one embodiment, the step of recording the corresponding dimension concentration information and outputting the alarm trigger record containing the dimension concentration information if the dimension concentration score is higher than a preset dimension concentration threshold further includes: If the dimensional concentration score is higher than the dimensional concentration threshold, then the abnormality of the abnormal event is determined to be concentrated in the target business dimension. Record the dimension name, dimension value, number of abnormal events, percentage of abnormal events, traffic increase multiple, and dimension concentration score corresponding to the target business dimension to obtain centralized recording information; Based on the abnormal event information, a business-level suppression key is generated, and the currently active system-level suppression key is obtained. Determine whether the business-level suppression key has been generated within a preset timestamp, or whether the field of the business-level suppression key matches the active system-level suppression key. If it has not been generated or does not match, output the alarm trigger record containing the centralized record information.

[0012] In one embodiment, after the step of determining that the abnormality of the abnormal event is concentrated in the target business dimension if the dimensionality concentration score is higher than the dimensionality concentration threshold, the method further includes: Based on a preset number of candidates, multiple candidate business dimensions with the highest number of abnormal events are determined from each of the business dimensions, and the candidate business dimensions are combined to obtain multiple different combinations of business dimensions. For each business dimension combination, determine the number of abnormal events that simultaneously meet all the business dimensions in the business dimension combination to obtain the joint abnormality number, and calculate the ratio of the joint abnormality number to the total number of abnormal events to obtain the joint abnormality percentage. For each combination of business dimensions, calculate the conditional probability that the abnormal event meets one of the business dimensions and also meets the other business dimensions, and obtain the conditional abnormality ratio. If the proportion of joint anomalies is higher than a preset joint proportion threshold, and the proportion of conditions is higher than a preset condition transition threshold, then it is determined that the anomaly of the abnormal event is concentrated in all of the business dimensions in the business dimension combination.

[0013] In one embodiment, the event classification rules include hard rules and soft scoring rules. The hard rules include ignore rules, system-level hard rules, and business-level hard rules. The step of determining the event category of the abnormal event based on the abnormal event information and the preset event classification rules includes: Based on the abnormal event information, it is determined whether the abnormal event only hits one of the ignore rule, the system-level hard rule, and the business-level hard rule. If only one of them is hit, the abnormal event is determined to be an abnormality corresponding to the hit rule. If no rule is hit or multiple rules among the ignored rules, the system-level hard rules, and the business-level hard rules are hit, then based on the abnormal event information, the system item hit and business item hit of the abnormal event are determined respectively, and the system-level score and business-level score are calculated respectively based on the system item hit and business item hit. If the system-level score is higher than the preset system-level equal score threshold, and the difference between the system-level score and the business-level score is higher than the preset difference threshold, then the abnormal event is determined to be a system-level event. If the business-level score is higher than the preset business-level score threshold, and the difference between the business-level score and the system-level score is higher than the difference threshold, then the abnormal event is determined to be a business-level event. If the difference between the system-level score and the business-level score is lower than the difference threshold, and the difference between the business-level score and the system-level score is also lower than the difference threshold, then the abnormal event is determined to be a mixed-source event.

[0014] In addition, to achieve the above objectives, this application also proposes an encryption system abnormal event alarm triggering device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the encryption system abnormal event alarm triggering method described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: In the event of an abnormal event during an encrypted call, this application extracts information about the abnormal event, obtains abnormal event information, determines the event category of the abnormal event based on the abnormal event information and preset event classification rules, and determines an alarm triggering method for the abnormal event based on the event category. The alarm triggering method includes a business-level triggering method, which is used to determine the abnormal event's centralized business dimension based on a preset composite triggering algorithm and a preset centralized algorithm. Based on the alarm triggering method and the abnormal event information, an alarm for the abnormal event is triggered, and an alarm triggering record is output.

[0016] Compared to current methods that use general metrics for alerts, which only detect an increase in the number of errors upon alert triggering and fail to express business-level anomalies, resulting in poor alert triggering effectiveness, this application extracts anomaly event information and uses a business-level triggering method to determine the concentrated business dimensions of anomalies within the anomaly event. This allows for the expression of business-level anomaly information when an anomaly event alert is triggered, improving the effectiveness of alert triggering. Specifically, this application extracts anomaly event information, classifies the anomalies, and determines the corresponding alert triggering method. The business-level triggering method of this application determines the concentrated business dimensions of anomalies within the anomaly event based on a preset composite triggering algorithm and a preset concentration algorithm. When business-level information exists within the anomaly information, this application can use the business-level triggering method and the extracted anomaly information to determine the business dimensions within the anomaly information set and record them in the triggered alert information. This allows for the expression of business-level anomalies when an alert is triggered, improving the effectiveness of anomaly event alert triggering. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the first embodiment of the encryption system abnormal event alarm triggering method of this application; Figure 2 This is a schematic diagram of the overall processing flow provided in Embodiment 1 of the encryption system abnormal event alarm triggering method of this application; Figure 3 This is a flowchart illustrating Embodiment 2 of the encryption system abnormal event alarm triggering method of this application; Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the encryption system abnormal event alarm triggering method in this embodiment of the application; Figure 5 This is a schematic diagram illustrating the data acquisition consent / permission method involved in the encryption system abnormal event alarm triggering method in this application embodiment.

[0020] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0023] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as an encryption system abnormal event alarm triggering device. The following description uses an encryption system abnormal event alarm triggering device as an example to illustrate this embodiment and the subsequent embodiments.

[0024] In encrypted business systems, the same error can often stem from different underlying causes. For example, a signature interface failure could be due to several factors: the application instance's thread pool running out of resources, causing a request timeout; a database connection becoming unavailable, preventing the query of business parameters; a missing certificate on an HSM (Hardware Security Module); an incorrect certificate number being passed from an access channel; or a business identifier being incorrectly routed to an abnormal device. Therefore, when triggering alarms for abnormal events, it is essential to clearly identify the root cause of the event.

[0025] Current methods typically use general metrics for alerts. When an alert is triggered, they can only detect an increase in the number of errors. It is difficult to determine the cause of the anomaly in the same triggering chain through the alert triggering information. This makes it difficult for the current methods to express abnormal information at the business level, resulting in poor effectiveness of current abnormal event alert triggering.

[0026] Furthermore, the handling paths for system-level and business-level faults are intertwined. System-level faults such as CPU, memory, database, network, thread pool, connection pool, and unreachable HSM devices require rapid alerts, while faults related to certificates, keys, HSM return codes, channels, and business identifiers require further attribution. If both types of events share the same path, it can easily lead to alert delays or misclassification of business events as system events.

[0027] Furthermore, the current method's use of a simple fixed threshold cannot adapt to different business volumes, time periods, error code risk levels, and seasonal fluctuations. Short-term spikes, sustained slow increases, periodic anomalies, and sudden changes in business volume require different triggering strategies, which can easily lead to false positives and false negatives. Moreover, while current device syslog, SNMP (Simple Network Management Protocol), or cloud monitoring metrics can detect device health issues, it is difficult to establish a unified trigger group with specific encrypted APIs (Application Programming Interfaces), business channels, business identifiers, certificates, or keys.

[0028] Based on this, embodiments of this application provide a method for triggering alarms for abnormal events in an encryption system, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the method for triggering an abnormal event alarm in the encryption system according to this application.

[0029] In this embodiment, the method for triggering an abnormal event alarm in the encryption system includes steps S10 to S40: Step S10: In the event of an abnormal event during encrypted calls, extract the information of the abnormal event to obtain abnormal event information; It should be noted that an encrypted call is an interface call or operation performed by the encrypted business system on a security device, hardware security module, or encryption / decryption function when processing a request. An exception event is an application error, device return exception, timeout, or occurrence of specific log characteristics that does not conform to the expected normal processing flow during the encrypted call. Exception event information is a multi-dimensional structured set of fields extracted from the context of the exception event to describe the event, including but not limited to error code, trace identifier, business identifier, security device identifier, certificate number, and key number.

[0030] Specifically, the abnormal event information in this embodiment includes: 1. Request link information: TRACE_ID: link, SPAN_ID: node, PARENT_SPAN_ID: parent node.

[0031] 2. Business Information: BUSINESS_ID: Business Channel Code, API_NAME: Interface Name, ACCESS_BUS_CODE: Access Code.

[0032] 3. Exception information: ERROR_CODE: error code, ERROR_MSG: error message, SECM_RETURN_CODE: encryption device response code, SECM_RETURN_MSG: encryption device error message, SECM_CMD_CODE: encryption device command.

[0033] 4. Security device information: GROUP_CODE: Encryption device cluster, SECM_NBR: Encryption device code, SECM_IP: Device IP, SECM_PORT: Request port, SECM_SERVER_TYPE: Device type.

[0034] 5. Service Application Information: APP_NAME: Security Service Application, APP_VERSION: Service Code Version, DIV_NAME: Database Subsegment, DEPLOY_NO: Instance Number, IP Address, INSTANCE_AREA: Example Deployment Region.

[0035] 6. Certificate key information: CERT_ID: Certificate number, KEY_ID: Key number, KEY_SEQ: Key sequence.

[0036] 7. Time information: REQ_TIME: Request time, INGEST_TIME: Log entry time.

[0037] The security device display key can be defined as follows: secmDeviceKey = GROUP_CODE + '|' + SECM_NBR + '|' + SECM_IP + ':' +SECM_PORT + '|' + SECM_SERVER_TYPE secmDeviceKey is the security device key, GROUP_CODE is the encrypted device cluster, SECM_NBR is the encrypted device code, SECM_IP is the device IP address, SECM_PORT is the request port, and SECM_SERVER_TYPE is the device type.

[0038] An exception event ID can be defined as: eventId = TRACE_ID + ':' + SPAN_ID + ':' + SECM_NBR + ':' + SECM_CMD_CODE + ':' + REQ_TIME eventId is the event identifier, TRACE_ID is the link tracing identifier, SPAN_ID is the span identifier, SECM_NBR is the encryption device code, SECM_CMD_CODE is the encryption device instruction, and REQ_TIME is the time the request occurred.

[0039] If a single request involves multiple security device calls, multiple exception events can be generated based on the security device call dimension, with each event corresponding to a specific device return code and device identifier. If some fields are missing, they are represented by `UNKNOWN` or null values, and a field missing marker is recorded. Subsequent statistics can then identify whether the missing fields themselves constitute a data quality issue.

[0040] Step S20: Based on the abnormal event information and the preset event classification rules, determine the event category of the abnormal event; It should be noted that the preset event classification rules are a predefined set of logical judgment conditions and scoring rules used to determine the category to which the abnormal event information should belong. The event category is the classification result obtained by dividing the abnormal event according to its nature, source and scope of impact, including system-level events, business-level events, mixed-source events and ignored events.

[0041] Understandably, this embodiment separates system-level events (such as infrastructure failures) from business-level events requiring attribution based on business dimensions at the process entry point through a hard rule priority matching mechanism and a score-based supplementary judgment mechanism. This allows system-level events to bypass complex centralized calculations based on business dimensions and directly enter the rapid alarm chain, significantly shortening the response latency for infrastructure failures. Simultaneously, for business-level events, this embodiment avoids premature consumption or erroneous suppression in the system-level misjudgment path, ensuring that all types of abnormal events in encrypted business scenarios receive processing strategies that match their nature, effectively reducing false positive and false negative rates.

[0042] In one feasible implementation, the event classification rules include hard rules and soft scoring rules. The hard rules include ignore rules, system-level hard rules, and business-level hard rules. A further implementation of determining the event category of the abnormal event based on the abnormal event information and the preset event classification rules may be: Based on the abnormal event information, it is determined whether the abnormal event only hits one of the ignore rule, the system-level hard rule, and the business-level hard rule. If only one of them is hit, the abnormal event is determined to be an abnormality corresponding to the hit rule. If no rule is hit or multiple rules among the ignored rules, the system-level hard rules, and the business-level hard rules are hit, then based on the abnormal event information, the system item hit and business item hit of the abnormal event are determined respectively, and the system-level score and business-level score are calculated respectively based on the system item hit and business item hit. If the system-level score is higher than the preset system-level equal score threshold, and the difference between the system-level score and the business-level score is higher than the preset difference threshold, then the abnormal event is determined to be a system-level event. If the business-level score is higher than the preset business-level score threshold, and the difference between the business-level score and the system-level score is higher than the difference threshold, then the abnormal event is determined to be a business-level event. If the difference between the system-level score and the business-level score is lower than the difference threshold, and the difference between the business-level score and the system-level score is also lower than the difference threshold, then the abnormal event is determined to be a mixed-source event.

[0043] It should be noted that hard rules are pre-defined rules with clear matching conditions and absolute judgment effect. Once an abnormal event is matched by a rule, it directly determines the event category. Soft scoring rules are a pre-defined set of rules that calculate a quantitative score through weighted calculation of multiple conditions, and then indirectly determine the event category based on the score range. Ignore rules are hard rules used to filter test environment traffic, drill window events, low-risk noise, events already covered by dedicated systems, and events within the scope of manual silencing. Events that match these rules are directly excluded from subsequent triggering links.

[0044] System-level hard rules are hard rules used to determine infrastructure or runtime failures such as database unavailability, network unreachability, JVM exceptions, thread pool exhaustion, connection pool exhaustion, HSM device unreachability, or device health check failures. Business-level hard rules are hard rules used to determine abnormal events related to encryption business APIs, security device return codes, certificates, keys, channels, business identifiers, message formats, or business routing, and whose attribution requires consideration of business dimensions. System item hits are feature hits in abnormal event information that match system-level hard rules or system-level scoring items. Business item hits are feature hits in abnormal event information that match business-level hard rules or business-level scoring items.

[0045] The system-level score is a quantitative score calculated according to system-level scoring rules based on the system item hit rate of the abnormal event information, used to characterize the degree to which the event is likely to belong to a system-level anomaly. The business-level score is a quantitative score calculated according to business-level scoring rules based on the business item hit rate of the abnormal event information, used to characterize the degree to which the event is likely to belong to a business-level anomaly. The preset system-level score threshold is a pre-set minimum score threshold used to determine whether the system-level score is sufficient to classify the event into a system-level category. The preset business-level score threshold is a pre-set minimum score threshold used to determine whether the business-level score is sufficient to classify the event into a business-level category.

[0046] The difference threshold is a pre-set threshold used to determine whether the difference between the system-level score and the business-level score is sufficient to make a clear category assignment when both are above their respective thresholds. A mixed-source event is an event category where both the system-level score and the business-level score are high and the difference between them is insufficient. This category indicates that the abnormal event simultaneously possesses both system-level and business-level characteristics, and must first enter the system-level rapid alarm chain while retaining the business field for further evaluation.

[0047] It should also be noted that the formula for calculating the system-level score in this embodiment is: scoreSystem = w1 codeInfraHit + w2 msgInfraHit + w3 dependencyHealthHit + w4 resourceExhaustionHit + w5 deviceReachabilityHit Among them, scoreSystem is the system-level score, codeInfraHit is the infrastructure error code hit, msgInfraHit is the infrastructure error message hit, dependencyHealthHit is the dependency health hit, resourceExhaustionHit is the resource exhaustion hit, and deviceReachabilityHit is the device reachability hit. The coefficients w1 to w5 of each variable are the corresponding weights. The system-level score is obtained by weighted summation of the above items.

[0048] The formula for calculating the business-level score in this embodiment is: scoreBusiness = v1 cryptoApiHit + v2 businessReturnCodeHit + v3 certKeyFieldPresent+ v4 channelBusinessFieldPresent+v5 deviceBusinessCodeHit scoreBusiness represents the business-level score, cryptoApiHit represents the crypto API hit, businessReturnCodeHit represents the business return code hit, certKeyFieldPresent represents the presence of the certificate key field, channelBusinessFieldPresent represents the presence of the channel business field, and deviceBusinessCodeHit represents the presence of the device business code. Coefficients v1 to v5 represent the corresponding weights. The business-level score is obtained by weighted summation of the above items.

[0049] Furthermore, if scoreSystem >= threshold_system and scoreSystem - scoreBusiness >= delta, it is marked as a system-level event. If scoreBusiness >= threshold_business and scoreBusiness - scoreSystem >= delta, it is marked as a business-level event. If both are high but the difference is insufficient, it is marked as a mixed-source event. The handling strategy is to first initiate a rapid system-level alarm while retaining the business field; subsequently, the business-level evaluation algorithm can further determine the event. Here, delta is the difference threshold, threshold_system is the system-level score threshold, and threshold_business is the business-level score threshold.

[0050] Understandably, this implementation adopts a three-tiered structure at the hard rule level: ignore rules, system-level hard rules, and business-level hard rules. It directly outputs a definite category, allowing test traffic, known noise, and events already covered by dedicated systems to be excluded immediately without consuming subsequent computing resources. Simultaneously, clearly defined system-level and business-level faults can be quickly categorized without soft scoring calculations, significantly reducing processing latency for high-determinism events. Furthermore, because this implementation introduces soft scoring rules and a difference threshold mechanism when multiple hard rules are hit simultaneously or no hard rules are hit, events with cross-category cross-features can be reasonably categorized after quantification and comparison. When both are high but the difference is insufficient, they are separately classified as mixed-source events, thus avoiding incorrect traffic splitting.

[0051] Step S30: Based on the event category, determine the alarm triggering method for the abnormal event, wherein the alarm triggering method includes a business-level triggering method, and the business-level triggering method is used to determine the abnormal centralized business dimension of the abnormal event based on a preset composite triggering algorithm and a preset centralized algorithm. It should be noted that the alarm triggering method is a complete processing strategy and execution path used to determine whether an abnormal event meets the alarm conditions and what alarm action to trigger. The business-level triggering method is specifically designed for business-level event categories, using composite triggering algorithms and centralized algorithms as core judgment methods. The composite triggering algorithm integrates multiple sub-algorithms, including fixed threshold judgment, multi-window burn rate detection, dynamic baseline comparison, seasonal residual analysis, and trend detection calculation, and comprehensively scores the results of each sub-algorithm to determine the significance of time-series anomalies.

[0052] The centralization algorithm is used to calculate the degree of concentration of abnormal events across various preset business dimensions, and quantifies the significance of abnormal clustering through indicators such as proportion, dispersion, historical improvement multiple, and distribution difference. An abnormal clustering business dimension is a business dimension where, after calculation by the centralization algorithm, the distribution of abnormal events is significantly clustered at a specific value or combination of values. This dimension points to specific objects such as hardware security modules, certificates, keys, access channels, or business identifiers.

[0053] Understandably, in this embodiment, the business-level triggering method first confirms the existence and significance of anomalies from a temporal dimension using a composite triggering algorithm, and then calculates the degree of clustering of anomalies across various business objects from a spatial distribution dimension using a centralized algorithm. By combining temporal anomaly detection with business-dimensional distribution analysis, the system can accurately identify whether anomalies are concentrated in a specific hardware security module, a specific certificate, a specific key, or a specific access channel from a massive number of business-level events, thereby improving the accuracy of fault root cause location and troubleshooting efficiency. Step S40: Based on the alarm triggering method and the abnormal event information, trigger an alarm for the abnormal event and output an alarm triggering record.

[0054] It should be noted that the overall processing flow of this embodiment can be referred to Figure 2 An alarm is a notification or signal sent by the system to external monitoring or notification channels when an abnormal event meets specific triggering conditions. An alarm trigger record is a standardized structured data object generated by the system after an alarm is triggered, describing the overall situation of the trigger. It includes at least the following fields: trigger window time, error type family, trigger dimension, actual value and threshold, hit sub-algorithm, central conclusion, and suppression status.

[0055] In a feasible implementation, if the alarm triggering method is the business-level triggering method, then the specific implementation of triggering an alarm for the abnormal event based on the alarm triggering method and the abnormal event information, and outputting an alarm triggering record, can also be: Obtain the event time window and event triggering dimension set of the abnormal event; Based on the error type families in the event triggering dimension set, the event time window, the abnormal event information, and the preset composite abnormal triggering algorithm, the triggering type of the abnormal event and the corresponding time-series abnormal score are determined. If the time-series anomaly score is higher than the preset time-series anomaly threshold, then based on the anomaly event information and the preset business dimension concentration algorithm, the dimension concentration score of the business dimension in the preset business dimension attribution set is calculated. If the dimensionality score is higher than the preset dimensionality threshold, the corresponding dimensionality information is recorded, and the alarm trigger record containing the dimensionality information is output.

[0056] It should be noted that the event time window is a time interval used to limit the statistical scope of abnormal events. The interval uses the actual occurrence time of the event as the boundary, and is managed in conjunction with a watermark and lateness tolerance mechanism. The event trigger dimension set is a pre-defined combination of dimension fields used to group and aggregate abnormal events. The set fixedly contains error type families and can be combined as needed with dimensions such as access channel, business identifier, certificate number, key number, or security device identifier. The trigger type is the abnormal pattern category determined by the composite abnormal triggering algorithm based on the hit status of each sub-algorithm. It is used to identify whether the abnormality belongs to a specific form such as fixed threshold exceeding the limit, burn rate exceeding the standard, dynamic baseline deviation, seasonal residual abnormality, or a continuously rising trend.

[0057] The temporal anomaly score is a numerical result obtained by the composite anomaly triggering algorithm after comprehensively scoring the salience of anomaly events in the time dimension. The preset temporal anomaly threshold is a pre-defined minimum score threshold used to determine whether a temporal anomaly score is sufficient to enter the centralized judgment stage. The business dimension attribution set is a preset set of business dimensions used for centralized calculation, including dimensions such as hardware security modules, certificates, keys, access channels, business identifiers, interface names, and deployment regions. The dimension concentration score is a numerical result obtained by the centralized algorithm after quantifying and scoring the degree of distribution and clustering of anomaly events in a certain business dimension.

[0058] The preset dimensional concentration threshold is a pre-defined minimum score threshold used to determine whether a dimensional concentration score is sufficient to identify an abnormal concentration in that dimension. Dimensional concentration information is a complete structured description of the dominant dimension, dominant value, dominant quantity, dominant percentage, historical percentage, improvement factor, and score recorded after the dimensional concentration score meets the threshold.

[0059] It should also be noted that the triggering engine uses an event time window, rather than the local memory count of a single service instance. The specific expression is: Window(T, W) = { e | T - W <e.REQ_TIME<= T} The window function Window(T, W) is defined as a set of all events e, where T is the window end time, W is the window length, and e.REQ_TIME is the event request time, satisfying that T minus W is less than e.REQ_TIME and e.REQ_TIME is less than or equal to T.

[0060] If the scheduling time is now, then the formula for calculating the log water level is: watermark = now - L_late T = min(requestedWindowEnd, watermark) Wherein, `watermark` is the water level, obtained by subtracting the late tolerance time `L_late` from the current time `now`; `T` is the window end time, which is the smaller value between the requested window end time `requestedWindowEnd` and the water level `watermark`. For delayed writes or out-of-order events, the system can perform a review and recalculation at the most recent `R` evaluation points. If the review and recalculation finds that a window state has changed from never being triggered to being triggered, a trigger record is reissued.

[0061] The specific parameters for this embodiment are shown in Table 1 below.

[0062] Table 1: Parameter Information Table

[0063] Understandably, this implementation method, when executing business-level triggers, first uses a composite anomaly triggering algorithm to determine the timing anomaly score of the error type families in the event triggering dimension set. Only when the score exceeds a preset timing anomaly threshold does it enter the more computationally expensive business dimension centralized algorithm. This ensures accurate anomaly localization while avoiding centralized analysis of a large number of business processes. Furthermore, since the output alarm trigger record explicitly includes dimension concentration information, operations and maintenance personnel can directly obtain the specific object of the anomaly concentration upon receiving an alarm, thereby enabling them to determine the root cause of the fault.

[0064] In one feasible implementation, the specific implementation of determining the triggering type of the abnormal event and the corresponding time-series abnormality score based on the error type family in the event triggering dimension set, the event time window, the abnormal event information, and a preset composite abnormality triggering algorithm can also be: Based on the abnormal event information, obtain the number of errors that match the error type family within the event time window, and obtain the total number of encrypted call requests; The error rate of the encrypted call is calculated based on the number of errors and the total number of requests, and the burn rate of the encrypted call is calculated based on the number of errors, the total number of requests, and the preset target success rate. Based on the preset monitoring configuration, one of the parameters, namely the number of errors, the error rate, and the combustion rate, is used as an anomaly indicator. Based on the historical baseline window in the event time window, the abnormal indicators corresponding to each preset time period in the historical baseline window are obtained to obtain the historical abnormal indicators. Based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm, the triggering type of the anomaly event is determined; The temporal anomaly score of the abnormal event is determined based on the number of errors, the error rate, the burn rate, the historical anomaly index, and the composite anomaly triggering algorithm.

[0065] It should be noted that the error count is the deduplicated count of abnormal events matching the error type family within the event time window. The total number of requests is the total number of encryption calls within the event time window, used as the denominator in the error rate calculation. The error rate is the ratio of the error count to the total number of requests, used to measure the overall proportion of failed encryption calls. The burn rate is the ratio between the error count and the allowable error count calculated based on the total number of requests and the target success rate, used to measure the rate at which errors consume the available error budget. The target success rate is a preset target value for the proportion of successful encryption calls, used to calculate the allowable error count.

[0066] The monitoring configuration is a preset configuration information used to guide the selection of abnormal indicators. This configuration specifies whether the error count, error rate, or burn rate should be used as the primary abnormal indicator for entering the composite abnormality triggering algorithm in the current monitoring scenario. An abnormal indicator is an indicator specified in the monitoring configuration and used as the main input parameter of the composite abnormality triggering algorithm; this indicator can be any one of the error count, error rate, or burn rate. The historical baseline window is a special window type within the event time window, used to extract abnormal indicator data from a historical period, serving as a data source for comparing the dynamic baseline and historical distribution. Historical abnormal indicators are the sequence of abnormal indicator values ​​corresponding to each preset time period within the historical baseline window, used to characterize the indicator performance of the trigger group under normal historical conditions.

[0067] It should also be noted that the expression for the error type family in this embodiment is: aggErrorKey = ERROR_CODE + API_NAME Here, `aggErrorKey` is the aggregated error key, `ERROR_CODE` is the error code, `API_NAME` is the interface name, and `aggErrorKey` only represents the error type family, without dynamically concatenating channel, business, certificate, or device fields. The actual trigger dimension and value are recorded by the following fields: `triggerDimensionSet` (trigger dimension set), `triggerGroupKey` (trigger group key), `triggerGroupJson` (trigger group JSON), `triggerMetric` (trigger metric), `triggerThresholdValue` (trigger threshold), `triggerActualValue` (actual value), and `triggerBaselineValue` (baseline value).

[0068] Typical trigger dimension sets include: 1. `aggErrorKey` detects a general outbreak of a certain type of error.

[0069] 2. `aggErrorKey,accessBusCode` indicates a surge in a certain type of error on a single access channel.

[0070] 3. `aggErrorKey,businessId` indicates a surge in a certain type of error within a single business identifier.

[0071] 4. `aggErrorKey,certId` indicates that a certain type of error is concentrated on a single certificate.

[0072] 5. `aggErrorKey,keyId`, identifies a cluster of errors of a certain type on a single key.

[0073] 6. `aggErrorKey,secmDeviceKey` indicates that a certain type of error is concentrated on a single HSM or security device.

[0074] 7. `aggErrorKey,secmDeviceKey,certId` indicates an abnormal combination of device and certificate.

[0075] 8. `aggErrorKey,accessBusCode,certId` indicates an anomaly in the combination of channel and certificate.

[0076] Understandably, this implementation method, when determining the trigger type and timing anomaly score, not only counts the absolute number of errors in the current window but also calculates the error rate and burn rate, which reflect the business success target. It flexibly selects one of these as the primary anomaly indicator through monitoring configuration, enabling the composite anomaly triggering algorithm to simultaneously cover two different anomaly forms: short-term spikes and rapid depletion of error budget. Furthermore, because this implementation method obtains the anomaly indicator sequence for the corresponding time period through a historical baseline window, comparing the current performance with the historical distribution for the same period, the system can effectively distinguish between the increase in error count caused by seasonal fluctuations in business volume and genuine abnormal behavior. This reduces false alarms caused by natural changes in business volume and enhances the ability to judge slow-rising anomalies and periodic deviation anomalies.

[0077] In one feasible implementation, the triggering types include fixed threshold sample size triggering, multi-window loss triggering, dynamic baseline triggering, seasonal residual triggering, weighted average triggering, cumulative sum triggering, and frequency domain residual expansion triggering; the burn rate includes short-term window burn rate and long-term window burn rate; and the specific implementation of determining the triggering type of the anomalous event based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm can also be: Calculate the median and expected value of each of the historical anomaly indicators, and calculate the weighted average of each of the historical anomaly indicators based on preset weights; If the number of errors is higher than a preset error number threshold, or the error rate is higher than a preset error rate threshold, then the trigger type is determined to include the fixed threshold sample size trigger. If both the short-term window burn rate and the long-term window burn rate exceed a preset burn rate threshold, then the trigger type is determined to include the multi-window loss trigger. Obtain abnormal time series data within the current event time window. If the standard deviation multiple of the difference between the abnormal time series data and the median is higher than a preset difference multiple threshold, or if the abnormal time series data is higher than a preset high-level abnormal index in the historical abnormal index, then determine that the trigger type includes the dynamic baseline trigger. If the expected residual between the abnormal time series data and the expected value is higher than a preset residual threshold, then the trigger type is determined to include the seasonal residual trigger; if the weighted average is higher than a preset weighted average threshold, then the trigger type is determined to include the weighted average trigger. Subtract the expected value and the preset allowable offset from the abnormal time series data to obtain the offset value. Add the offset values ​​within the event time window to obtain the cumulative value. If the cumulative value is higher than the preset cumulative threshold, then the trigger type is determined to include the accumulation and trigger. The abnormal time series data is transformed in the frequency domain based on a preset frequency domain residual processing function to obtain an anomaly significance score. If the anomaly significance score is higher than a preset significance score threshold, the trigger type is determined to include the frequency domain residual extension trigger.

[0078] It should be noted that the fixed threshold sample size trigger is triggered when the number of errors or the error rate exceeds a preset absolute value threshold and the sample size meets the minimum requirement. The multi-window burnout trigger is triggered when both the short-term window burn rate and the long-term window burn rate simultaneously exceed a preset burn rate threshold. The dynamic baseline trigger is triggered when the deviation of abnormal time-series data from the median of historical anomalies exceeds a preset multiple threshold, or when the abnormal time-series data exceeds a preset high quantile of historical anomalies. The seasonal residual trigger is triggered when the residual between abnormal time-series data and historical expected values ​​exceeds a preset residual threshold.

[0079] Weighted average trigger is triggered when the weighted average of historical anomaly indicators exceeds a preset weighted average threshold. Cumulative sum trigger is triggered when the sum of all offset values ​​(after subtracting the expected value and allowed offset) from the anomaly time-series data exceeds a preset cumulative threshold. Frequency domain residual expansion trigger is triggered when the anomaly significance score obtained after performing a frequency domain transformation on the anomaly time-series data exceeds a preset significance score threshold. Short-window burn rate is a burn rate calculated based on a shorter event time window, used to capture the rapid depletion of erroneous budgets within a short period. Long-window burn rate is a burn rate calculated based on a longer event time window, used to confirm whether the anomaly is persistent rather than a transient spike.

[0080] Anomaly time-series data consists of a sequence of anomaly indicator values ​​selected according to a preset monitoring configuration within the current event time window. The expected value is the expected value within a given period, calculated after aligning historical anomaly indicators by time period; it characterizes the expected value of the indicator under normal historical levels. The allowable offset is a preset permissible unidirectional drift amplitude in accumulation and triggering, used to suppress unnecessary triggering within normal fluctuation ranges. The accumulated value is the numerical value obtained by accumulating and adding the offset values ​​in chronological order within the event time window. The frequency domain residual processing function is a mathematical function that performs a frequency domain transformation on the anomaly time-series data and calculates the significance of its residual anomalies. The anomaly significance score is a quantized score output by the frequency domain residual processing function, used to measure the outlier degree of the anomaly time-series data in the frequency domain.

[0081] Specifically, in this embodiment, for any window W, trigger dimension set S, and trigger group g, the basic count is defined as: N(W, S, g) = COUNT(DISTINCT eventId WHERE e in Window(T, W) ANDgroupKey(S, e) = g) Where N(W,S,g) is the count within the window, W is the window, S is the set of trigger dimensions, g is the trigger group, COUNTDISTINCT is the deduplication function, eventId is the event identifier, Window is the window function, and groupKey is the grouping key. This formula represents the total number of deduplicated event identifiers for event e within the time window W, satisfying that it belongs to the window and its grouping key is equal to g.

[0082] If there is a normal total number of requests, then the error rate is defined as: R(W, S, g) = N(W, S, g) / max(totalRequests(W, S, g), epsilon) Where totalRequests(W,S,g) is the total number of requests and epsilon is a minimum constant. This formula means that the error rate is equal to the count within the window divided by the larger of the total number of requests and the minimum constant.

[0083] The formula for triggering the fixed threshold sample size in this embodiment is: staticHit = N(W, S, g)>= thresholdCountORR(W, S, g)>= thresholdRate Among them, staticHit is a fixed threshold hit, which is valid when the count within the window is greater than or equal to thresholdCount (count threshold) or the error rate is greater than or equal to thresholdRate (ratio threshold).

[0084] To avoid false positives due to low traffic, the rule can be configured with a minimum sample size: sampleEnough = totalRequests(W, S, g)>= minRequestCount OR N(W, S, g)>= minErrorCount The sampleEnough condition is met when the totalRequests(W, S, g) (total number of requests) is greater than or equal to the minRequestCount (minimum number of requests), or the count within the window is greater than or equal to the minErrorCount (minimum number of errors).

[0085] The formula for multi-window loss triggering in this embodiment is: allowedErrors(W, S, g) = totalRequests(W, S, g) (1 - SLO) burnRate(W, S, g) = N(W, S, g) / max(allowedErrors(W, S, g), epsilon) burnHit = burnRate(W_short, S, g)>= BR_short AND burnRate(W_long, S,g)>= BR_long Here, allowedErrors is the number of allowed errors, which is equal to the total number of requests multiplied by (1 minus SLO, where SLO is the target success rate); burnRate is the burn rate, which is equal to the count within the window divided by the larger of allowedErrors(W, S, g) and the minimal constant epsilon; burnHit is the burn rate hit, which is valid when the short window burn rate burnRate(W_short, S, g) is greater than or equal to the short window burn rate threshold BR_short, and the long window burn rate burnRate(W_long, S, g) is greater than or equal to the long window burn rate threshold BR_long.

[0086] The formula for dynamic baseline triggering in this embodiment is: baselineMedian = median(historyValues) MAD = median(abs(historyValues ​​- baselineMedian)) robustZ = (N(W, S, g) - baselineMedian) / max(1.4826 MAD, epsilon) baselineHit = robustZ>= Z_threshold OR N(W, S, g)>= quantile(historyValues, q) Here, baselineMedian is the baseline median, obtained by taking the median of historyValues; MAD is the median absolute deviation, taken as the median of the absolute values ​​of the differences between the historical values ​​and the baseline median baselineMedian; robustZ is the robust Z-score; and baselineHit is the baseline hit, which is true when robustZ (robust Z-score) is greater than or equal to Z_threshold (Z-threshold), or N(W,S,g) (in-window count) is greater than or equal to quantile(historyValues, q) (quantile function, where q is the quantile parameter).

[0087] The formula for determining seasonal residual triggering in this embodiment is: residual = currentValue - seasonalExpectedValue seasonalHit = residual / max(1.4826 MAD_residual, epsilon)>=residualThreshold Where residual is the residual, currentValue is the current value, seasonalExpectedValue is the seasonal expected value, and the residual is equal to the current value minus the seasonal expected value; seasonalHit is the seasonal hit, which is the residual divided by the larger of 1.4826 times MAD_residual (median absolute deviation of residuals) and epsilon (minimal constant). A hit occurs when the result is greater than or equal to residualThreshold (residual threshold).

[0088] The formulas for determining weighted average triggering and cumulative sum triggering in this embodiment are as follows: ewma_t = alpha x_t + (1 - alpha) ewma_{t-1} ewmaHit = ewma_t>= ewmaThreshold cusum_t = max(0, cusum_{t-1} + (x_t - expected_t - k)) cusumHit = cusum_t>= h Wherein, ewma_t is the value of the exponentially weighted moving average at time t, which is obtained by multiplying the smoothing coefficient alpha by the observed value x_t at the current time t, plus (1 minus alpha) multiplied by the exponentially weighted moving average ewma_{t-1} at the previous time t-1; ewmaHit is the exponentially weighted moving average hit, which is valid when ewma_t is greater than or equal to ewmaThreshold (exponentially weighted moving average threshold); cusum_t is the value of the cumulative sum at time t, which is the larger of 0 and the cumulative sum cusum_{t-1} at the previous time t-1 plus the current observed value x_t minus the expected value expected_t at time t minus the allowable offset k; cusumHit is the cumulative sum hit, which is valid when cusum_t is greater than or equal to h (cumulative sum trigger threshold).

[0089] The formula for determining frequency domain residual spread triggering in this embodiment is: srScore = spectralResidualScore(series(g)) srHit = srScore>= srThreshold Wherein, srScore is the frequency domain residual score, which is calculated by spectralResidualScore (frequency domain residual scoring function) on series(g) (the sequence of trigger group g); srHit is the frequency domain hit, which is valid when srScore is greater than or equal to srThreshold (frequency domain threshold).

[0090] Based on the above sub-algorithms, the timing anomaly score for any trigger group in this embodiment is defined as follows: timeSeriesScore = max( staticScore, burnRateScore, baselineScore, seasonalScore, ewmaScore, cusumScore, srScore ) Wherein, `timeSeriesScore` is the time-series score, equal to the maximum value among `staticScore` (fixed score), `burnRateScore` (burn rate score), `baselineScore` (baseline score), `seasonalScore` (seasonal score), `ewmaScore` (exponentially weighted moving average score), `cusumScore` (cumulative sum score), and `srScore` (frequency domain residual score). When `timeSeriesScore >= T_time` and the sample size meets the requirements, it enters the clustering judgment stage, where `T_time` is the time-series anomaly score; for system-level events, the clustering judgment can be skipped and the system alarm can be triggered directly.

[0091] Understandably, this implementation integrates the judgment logic of multiple trigger types into a single composite anomaly triggering algorithm. Fixed threshold sample size triggering and multi-window loss triggering target short-term spikes and rapid depletion of erroneous budgets, respectively; dynamic baseline triggering and seasonal residual triggering target significant deviations from historical levels and periodic pattern deviations, respectively; weighted average triggering and cumulative sum triggering target sustained slow increases and cumulative drift, respectively; and frequency domain residual expansion triggering targets anomalies at the frequency domain level. This allows the composite anomaly triggering algorithm to simultaneously detect multiple anomaly patterns of different natures. Furthermore, since the judgment conditions for each trigger type are independent and mutually exclusive, the same anomaly event can simultaneously hit multiple trigger types, thus contributing data from different directions to the final time-series anomaly score and improving the comprehensiveness of anomaly detection.

[0092] In one feasible implementation, the specific implementation of determining the temporal anomaly score of the abnormal event based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm can also be: Calculate the error ratio between the number of errors and the error threshold, and calculate the error ratio between the error rate and the error rate threshold. Use the higher of the error ratio and the error rate ratio as the fixed threshold sample size score. Calculate the short-term ratio of the short-term window combustion rate to the combustion rate threshold, and calculate the long-term ratio of the long-term window combustion rate to the combustion rate threshold. The smaller of the short-term ratio and the long-term ratio is taken as the multi-window loss score. Calculate the high-level anomaly difference between the abnormal time series data and the high-level anomaly index, and determine the dynamic baseline score based on the high-level anomaly difference and the standard deviation multiple; The ratio of the expected residual to the residual threshold is used as the seasonal residual score, the ratio of the weighted average to the weighted average threshold is used as the weighted average score, the ratio of the accumulated value to the accumulated threshold is used as the accumulated sum score, and the ratio of the abnormal significance score to the significance score threshold is used as the frequency domain residual expansion score. The maximum value among the fixed threshold sample size score, the multi-window loss score, the dynamic baseline score, the seasonal residual score, the weighted average score, the cumulative score, and the frequency domain residual expansion score is used as the time-series anomaly score.

[0093] It should be noted that the error count ratio is the ratio obtained by dividing the number of errors by a preset error count threshold, and is used to quantify the relative extent to which the current number of errors exceeds the fixed threshold. The error rate ratio is the ratio obtained by dividing the error rate by a preset error rate threshold, and is used to quantify the relative extent to which the current error rate exceeds the fixed threshold.

[0094] The fixed threshold sample size score is the higher of the error count ratio and the error rate ratio as the quantitative score result for this trigger type. The short-term ratio is the ratio obtained by dividing the short-term window burn rate by a preset burn rate threshold, and is used to quantify the relative extent to which the error budget consumption exceeds the threshold under the short-term window.

[0095] The long-term ratio is the ratio obtained by dividing the long-term window burn rate by a preset burn rate threshold, used to quantify the relative degree to which erroneous budget consumption exceeds the threshold under a long-term window. The multi-window loss score is the smaller of the short-term and long-term ratios as the quantitative score result for this trigger type. The high-order anomaly difference is the difference between the abnormal time-series data and the high-order anomaly indicator, used to quantify the absolute magnitude by which the current value exceeds the historical high percentile. The dynamic baseline score is the quantitative score result calculated based on the relationship between the high-order anomaly difference and the standard deviation multiple.

[0096] The seasonal residual score is the ratio of the expected residual to the residual threshold, used as the quantitative score for this trigger type. The weighted average score is the ratio of the weighted average to the weighted average threshold, used as the quantitative score for this trigger type. The cumulative sum score is the ratio of the cumulative value to the cumulative threshold, used as the quantitative score for this trigger type. The frequency domain residual expansion score is the ratio of the anomaly significance score to the significance score threshold, used as the quantitative score for this trigger type.

[0097] Understandably, this implementation converts the judgment results of multiple trigger types into numerical scores, and finally uses the maximum value as the time-series anomaly score. This ensures that no matter what form the anomaly takes, its corresponding trigger type can contribute the dominant score. While reducing computational complexity, it comprehensively considers various anomaly modes such as instantaneous bursts, continuous increases, and periodic deviations to obtain the final anomaly score, thereby improving the detection comprehensiveness of the composite trigger algorithm.

[0098] In summary, compared to current methods that use general indicators for alerts, which only detect an increase in the number of errors upon alert triggering and fail to express business-level anomalies, resulting in poor alert triggering effectiveness, this embodiment extracts anomaly event information and uses a business-level triggering method to determine the concentrated business dimensions within the anomalies. This allows for the expression of business-level anomalies when an alert is triggered, improving the effectiveness of alert triggering. Specifically, this embodiment extracts anomaly event information, classifies the anomalies, and determines the corresponding alert triggering method. The business-level triggering method in this embodiment determines the concentrated business dimensions of the anomalies based on a preset composite triggering algorithm and a preset concentration algorithm. When business-level information exists within the anomaly information, this embodiment can use the business-level triggering method and the extracted anomaly information to determine the business dimensions within the anomaly information set and record them in the triggered alert information. This allows for the expression of business-level anomalies when an alert is triggered, improving the effectiveness of alert triggering.

[0099] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3The step of calculating the dimension centrality score of the business dimensions in the preset business dimension attribution set based on the abnormal event information and the preset business dimension centrality algorithm further includes steps S100~S300: Step S100: For each business dimension, based on the abnormal event information, determine the number of abnormal events in the business dimension, and determine the dimension with the most abnormal events from among all the business dimensions as the target business dimension. It should be noted that the business dimension is a classification perspective used to describe the attributes of different business objects in the encrypted call context. This perspective includes hardware security module identifier, certificate number, key number, access channel code, business identifier code, interface name, and deployment region. The number of abnormal events is the deduplicated count of abnormal events corresponding to all different values ​​under a certain business dimension. The target business dimension is the business dimension with the highest number of abnormal events in the preset business dimension attribution set, and this dimension serves as the primary candidate dimension for subsequent centralized calculations.

[0100] It should also be noted that the expression for the dimension set in this embodiment is: D = {secmDeviceKey, certId, keyId, accessBusCode, businessId,apiName, instanceArea} The dimension set D includes secmDeviceKey (security device key), certId (certificate number), keyId (key number), accessBusCode (access code), businessId (business identifier), apiName (interface name), and instanceArea (instance deployment area).

[0101] The formula for determining the parameters of the target business dimension in this embodiment is as follows: C_d(v) = COUNT(DISTINCT eventId WHERE norm(d, e) = v) top1Value_d = argmax_v C_d(v) top1Count_d = max_v C_d(v) top1Ratio_d = top1Count_d / N(W, S, g) Where C_d(v) is the event count when dimension d takes the value v, obtained by performing COUNT DISTINCT on all events e to remove duplicates, where eventId is the event identifier, d is a dimension in the dimension set D, v is the specific value of the dimension, norm(d, e) is the normalized value of dimension d extracted from event e; top1Value_d is the value ranked first, obtained by taking the value of v that maximizes C_d(v) (argmax); top1Count_d is the count of the ranked first, taken as the maximum value of C_d(v) (max); top1Ratio_d is the proportion of the ranked first, equal to top1Count_d divided by N(W,S,g) (count within the window).

[0102] Understandably, in the preset business dimension attribution set, each business dimension is sorted based on the number of abnormal events, and the dimension corresponding to the maximum value is extracted as the target business dimension. Computational resources are preferentially concentrated on the dimension with the highest number of abnormal events for evaluation, thereby determining the most significant concentration signal and reducing the overall computational overhead of the concentration algorithm.

[0103] Step S200: Calculate the Herfindahl index, information entropy, traffic increase multiple compared to the same period in history, Shannon divergence, and field missing ratio for the target business dimension, respectively. It should be noted that the Herfindahl-Hirschman Index (HHI) measures the concentration of anomalies across different values ​​within a specific business dimension. This index is calculated based on the sum of the squares of the proportions of each value; a higher value indicates that the anomalies are concentrated in a few values. Information entropy, on the other hand, measures the uncertainty and dispersion of anomalies across different values ​​within a specific business dimension. This index is calculated based on the logarithmic weighted sum of the proportions of each value; a lower value indicates a more concentrated distribution and less uncertainty.

[0104] Traffic increase multiplier is the percentage of abnormal events with a specific value in the target business dimension within the current event time window, compared to the percentage of normal traffic with the same value in the same historical time window. This metric is used to eliminate the interference of uneven historical traffic distribution on the determination of centralization. Shannon divergence measures the difference in probability distribution of abnormal events in the target business dimension between the current event time window and the historical time window. This metric is calculated based on the logarithmic weighted sum of the probability ratios of each value in the two distributions; a higher value indicates a greater difference between the current and historical distributions. Field missing ratio is the proportion of records with missing or empty values ​​in the abnormal event information of the target business dimension to the total number of abnormal events in that dimension. This metric is used to quantify the impact of data completeness in that dimension on the reliability of centralization analysis.

[0105] It should also be noted that the calculation formulas for the Herfindahl index, information entropy, traffic increase multiple compared to the same period in history, and Shannon divergence for the target business dimension in this embodiment are as follows: HHI_d = sum_v (C_d(v) / N)^2 entropy_d = -sum_v p_v log(p_v) lift_d(v) = currentRatio_d(v) / max(baselineRatio_d(v), epsilon) jsDivergence_d = JS(currentDistribution_d, baselineDistribution_d) Where HHI_d is the Herfindahl-Hirschman exponent of dimension d, which is equal to the sum of squares over all values ​​v, where C_d(v) is the event count of dimension d with value v, and N is the total event count; entropy_d is the entropy, which is equal to the negative summation p_v multiplied by log(p_v), where p_v is equal to C_d(v) divided by N; lift_d(v) is the lift factor, which is equal to the larger of the current proportion currentRatio_d(v) divided by the baseline proportion baselineRatio_d(v) and epsilon (a minimal constant); jsDivergence_d is the Jensen-Shannon divergence, which is equal to the Jensen-Shannon divergence JS calculated over the current distribution currentDistribution_d and the baseline distribution baselineDistribution_d.

[0106] It is understandable that this embodiment simultaneously calculates five indicators that characterize abnormal concentration from different perspectives: Herfindahl index, information entropy, traffic increase factor, Shannon divergence, and field missing ratio. Among them, Herfindahl index and information entropy assess the degree of concentration from the perspective of distribution pattern, traffic increase factor identifies the effect of abnormal amplification from historical longitudinal comparison, Shannon divergence detects structural changes from the perspective of distribution shift, and field missing ratio provides a credibility reference from the perspective of data quality. This makes the subsequent determination of dimensional concentration based on multi-dimensional quantitative data, avoids misjudgment of concentration, and improves the accuracy of business dimension concentration determination.

[0107] Step S300: Calculate the dimensional centrality score based on the Herfindahl index, the information entropy, the traffic increase factor, the Shannon divergence, the field missing ratio, and the preset centrality weight coefficient.

[0108] It should be noted that the preset concentration weight coefficients are a pre-defined set of weighted coefficients corresponding to the Herfindahl exponent, information entropy, traffic increase multiple, Shannon divergence, and field missing ratio, which are used to assign different degrees of influence to each indicator during comprehensive calculation.

[0109] It should also be noted that the dimensional centrality score in this embodiment can be defined as: concentrationScore_d = a1 top1Ratio_d + a2 normalized(HHI_d) + a3 normalized(lift_d(top1Value_d)) + a4 normalized(jsDivergence_d)-a5 missingFieldPenalty Wherein, concentrationScore_d is the concentration score of dimension d, which is equal to a1 multiplied by top1Ratio_d (the proportion of the first-ranked product) plus a2 multiplied by normalized(HHI_d) (normalized Herfindahl-Hirschman index) plus a3 multiplied by normalized(lift_d(top1Value_d)) (normalized lift factor) plus a4 multiplied by normalized(jsDivergence_d) (normalized Jensen-Shannon divergence) minus a5 multiplied by missingFieldPenalty (field missing penalty), where a1 to a5 are the weight coefficients of each component.

[0110] Understandably, this embodiment adds the Herfindahl index, information entropy, traffic increase factor, and Shannon divergence from four positive dimensions: concentration, distribution dispersion, historical longitudinal increase, and distribution offset. At the same time, it uses a negative penalty for the proportion of missing fields to suppress the problem of insufficient credibility caused by incomplete data. The influence of each indicator in the final score is determined by a preset concentration weight coefficient, so that the calculated dimensional concentration score can reflect the true degree of aggregation of abnormal events in the business dimension and effectively filter out erroneous concentration signals caused by large-scale missing fields, thereby improving the accuracy of concentration judgment.

[0111] In one feasible implementation, the specific implementation of recording the corresponding dimensionality concentration information and outputting the alarm trigger record containing the dimensionality concentration information if the dimensionality concentration score is higher than a preset dimensionality concentration threshold can also be: If the dimensional concentration score is higher than the dimensional concentration threshold, then the abnormality of the abnormal event is determined to be concentrated in the target business dimension. Record the dimension name, dimension value, number of abnormal events, percentage of abnormal events, traffic increase multiple, and dimension concentration score corresponding to the target business dimension to obtain centralized recording information; Based on the abnormal event information, a business-level suppression key is generated, and the currently active system-level suppression key is obtained. Determine whether the business-level suppression key has been generated within a preset timestamp, or whether the field of the business-level suppression key matches the active system-level suppression key. If it has not been generated or does not match, output the alarm trigger record containing the centralized record information.

[0112] It should be noted that the dimension name is the category angle name corresponding to the target business dimension, such as certificate number, key number, or access channel code. The dimension value is the identifier of the specific value taken under the target business dimension, such as a specific certificate number string or a specific access channel code. The percentage of abnormal events is the proportion of the number of abnormal events corresponding to this dimension value under the target business dimension to the total number of abnormal events under this business dimension. Centralized recorded information is a collection of information obtained by organizing the dimension name, dimension value, number of abnormal events, percentage of abnormal events, traffic increase multiple, and dimension centralization score of the target business dimension in a structured format.

[0113] The business-level suppression key is a unique identifier string generated based on abnormal event information, used for deduplication and suppression determination of business-level abnormal events. The active system-level suppression key is the set of suppression identifiers corresponding to system-level alarms that are still within their valid time range, used to determine whether a root cause-level system fault is associated with the current business abnormality. The preset timestamp is a pre-set time limit used to determine whether the same business-level suppression key has been recorded within the valid suppression period.

[0114] It should also be noted that the system-level suppression key in this embodiment is defined as: systemSuppressionKey = systemCodeType + '|' + resourceKey + '|' +errorCode Among them, systemSuppressionKey is a system-level suppression key, which is obtained by concatenating systemCodeType (system code type), resourceKey (resource key), and errorCode (error code).

[0115] In this embodiment, the system-level suppression key is defined as: businessSuppressionKey = aggErrorKey + '|' + triggerDimensionSet + '|' + triggerGroupKey Among them, businessSuppressionKey is a business-level suppression key, which is obtained by concatenating aggErrorKey (aggregate error key), triggerDimensionSet (trigger dimension set), and triggerGroupKey (trigger group key).

[0116] The trigger record in this embodiment includes at least: 1. Trigger ID; 2. Start and end times of the trigger window; 3. Error type family `aggErrorKey`; 4. Trigger dimension set and trigger group; 5. Hit sub-algorithm, such as fixed threshold, burn rate, dynamic baseline, seasonal residual, EWMA, CUSUM, frequency domain residual; 6. Actual value, threshold, baseline value, historical quantile, burn rate, and trend score; 7. Dominant dimension, dominant value, dominant proportion, HHI, lift, and JS divergence; 8. Two-dimensional combination candidates and their proportions; 9. Deduplication key, suppression status, and suppression reason; 10. Sample summary and field missing summary; 11. Rule version and evaluation audit information. Business trigger records can be retrieved by manual investigation systems, alarm systems, and log event analysis intelligent agents. Understandably, this implementation performs a repeatability check of the service-level suppression key based on a preset timestamp and a root cause matching check based on the active system-level suppression key before outputting the alarm trigger record. This ensures that the same service anomaly will not generate multiple duplicate alarms in a short period of time. Furthermore, when a system-level root cause fault is already active, service-level anomalies caused by that root cause will not push additional independent alarms, thus avoiding the output of a large number of alarm messages. Moreover, since the service-level suppression key is generated based on anomaly event information and the active system-level suppression key dynamically maintains the current system-level fault status, the suppression determination can accurately identify duplicate events and derivative events during real-time operation, thereby improving operational efficiency while ensuring that critical anomalies are not lost.

[0117] In one feasible implementation, the specific implementation following the step of determining that the abnormality of the abnormal event is concentrated in the target business dimension if the dimensionality concentration score is higher than the dimensionality concentration threshold can also be: Based on a preset number of candidates, multiple candidate business dimensions with the highest number of abnormal events are determined from each of the business dimensions, and the candidate business dimensions are combined to obtain multiple different combinations of business dimensions. For each business dimension combination, determine the number of abnormal events that simultaneously meet all the business dimensions in the business dimension combination to obtain the joint abnormality number, and calculate the ratio of the joint abnormality number to the total number of abnormal events to obtain the joint abnormality percentage. For each combination of business dimensions, calculate the conditional probability that the abnormal event meets one of the business dimensions and also meets the other business dimensions, and obtain the conditional abnormality ratio. If the proportion of joint anomalies is higher than a preset joint proportion threshold, and the proportion of conditions is higher than a preset condition transition threshold, then it is determined that the anomaly of the abnormal event is concentrated in all of the business dimensions in the business dimension combination.

[0118] It should be noted that candidate business dimensions are selected from the top few business dimensions with the highest number of abnormal events, based on a preset number of candidates. A business dimension combination is a set of dimensions formed by pairing multiple candidate business dimensions in pairs or multiple combinations, used to check whether abnormal events are concentrated in the intersection of multiple business dimensions. The joint anomaly count is the deduplicated count of abnormal events that simultaneously meet all business dimensions in the business dimension combination. The joint anomaly percentage is the ratio of the joint anomaly count to the total number of abnormal events, used to measure the degree to which abnormal events are concentrated in multiple dimensions.

[0119] Conditional anomaly percentage is the probability that an anomaly event, given that it conforms to one of the business dimensions in a combination of business dimensions, also conforms to the conditions of the other business dimensions. It is used to measure the strength of the correlation between dimensions. The joint percentage threshold is a preset minimum percentage threshold used to determine whether the joint anomaly percentage is sufficient to conclude that anomalies are concentrated in the combination. The conditional transition threshold is a preset minimum probability threshold used to determine whether the conditional anomaly percentage is sufficient to conclude that there is a strong correlation between dimensions.

[0120] It should also be noted that the formula for calculating the proportion of joint conditions in this embodiment is: jointRatio(d1=v1, d2=v2) = C(d1=v1 AND d2=v2) / N conditionalRatio(d2=v2 | d1=v1) = C(d1=v1 AND d2=v2) / C(d1=v1) Wherein, jointRatio(d1=v1, d2=v2) is the joint ratio, where d1 and d2 are two different dimensions, v1 and v2 are the specific values ​​of the corresponding dimensions, C(d1=v1 AND d2=v2) is the count of unique events that simultaneously satisfy the condition that dimension d1 is v1 and dimension d2 is v2, N is the total event count, and the joint ratio is equal to the combined count divided by the total event count; conditionalRatio(d2=v2 | d1=v1) is the conditional ratio, which represents the proportion of events where dimension d2 is v2 under the condition that dimension d1 is v1, and is equal to the count of events that simultaneously satisfy the values ​​of both dimensions divided by the count of events where only dimension d1 is v1, C(d1=v1).

[0121] Understandably, this implementation method, based on single-dimensional concentration judgment, further performs combined analysis on multiple candidate business dimensions with the highest number of abnormal events, and calculates the joint anomaly ratio and conditional anomaly ratio respectively. This enables the system to identify highly concentrated two-dimensional or multi-dimensional combined anomalies. For example, a certain type of error may be concentrated in a combination of a specific hardware security module and a specific certificate, while any dimension in this combination may not be triggered when counted individually due to the dilution of the total. This embodiment ensures that the discovered combined anomalies have strong correlations through joint ratio thresholds and conditional ratio thresholds, thereby enabling the output of more refined root cause localization conclusions and improving the accuracy of fault root cause identification in complex encrypted business scenarios.

[0122] In one embodiment, if a signature fails due to a missing certificate on a single HSM, the signature interface will experience 180 failures within 5 minutes, with the following error type families: aggErrorKey = ZSHN503 (error code) | ZsgCerSign (interface name) Both the short-window and long-window burn rates exceeded the threshold simultaneously. The dynamic baseline shows a historical median of 8 occurrences during this period, with a MAD of 3, and the current robust Z-score has significantly increased. Centralized calculations show that `secmDeviceKey=HSM-A` accounts for 86%, `certId=CERT-001` accounts for 84%, and the combined share is 82%. Historically, `HSM-A` only handled 20% of the traffic.

[0123] The system generates a business anomaly trigger record, with the conclusion type being `HSM_CERT_DOUBLE_CONCENTRATION` in the HSM and certificate dual-dimensional set, the trigger object being `HSM-A + CERT-001`, and records the burn rate, dynamic baseline, Top1 percentage, lift, dual-dimensional condition percentage, and sample summary.

[0124] In one embodiment, if a single channel parameter is incorrect but the overall error rate does not exceed a fixed threshold, then a certain access channel may experience 25 signature verification failures within one minute, and the overall service error rate will not exceed the fixed threshold. However, historical baselines show that this channel typically does not have this type of error during the same period, and the current Top 1 percentage of `accessBusCode=CH-09` reaches 91% (the Top 1 percentage of the channel value CH-09 for access code accessBusCode reaches 91%), indicating a significant increase in lift. The system triggers business anomaly recording through a centralized algorithm to avoid missed reports due to the failure to meet general indicator thresholds.

[0125] In summary, this embodiment identifies the target business dimension by ranking the number of abnormal events, allowing subsequent computing resources to be prioritized for the most significant candidate dimension, thereby reducing computational overhead while identifying the main concentration signals. Furthermore, because this embodiment simultaneously calculates the abnormal concentration characteristics from four positive dimensions—distribution concentration, distribution dispersion, historical longitudinal improvement, and distribution offset—and removes false signals caused by incomplete data through a penalty mechanism based on the proportion of missing fields, the final dimension concentration score accurately reflects the true degree of anomaly aggregation on that dimension.

[0126] Furthermore, after the centralized determination meets the standard, this embodiment further performs business-level suppression key repetition checks and active system-level suppression key root cause matching checks, so that the same anomaly will not push alarms repeatedly in a short period of time, and when the anomaly is a derivative result of a known system-level fault, no additional noise notification will be generated. This accurately outputs the root cause of centralized anomalies while avoiding a large number of duplicate alarms and improving the efficiency of operation and maintenance.

[0127] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the method for triggering abnormal event alarms in the encryption system of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0128] This application provides an encryption system abnormal event alarm triggering device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the encryption system abnormal event alarm triggering method in the above embodiment 1.

[0129] The following is for reference. Figure 4This document illustrates a structural diagram of an encryption system abnormal event alarm triggering device suitable for implementing embodiments of this application. The encryption system abnormal event alarm triggering device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The encryption system abnormal event alarm triggering device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0130] like Figure 4 As shown, the encryption system abnormal event alarm triggering device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the encryption system abnormal event alarm triggering device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the encryption system abnormal event alarm triggering device to communicate wirelessly or wiredly with other devices to exchange data. Although encryption system abnormal event alarm triggering devices with various systems are shown in the figure, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented or possessed alternatively.

[0131] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0132] The encryption system abnormal event alarm triggering device provided in this application, employing the encryption system abnormal event alarm triggering method in the above embodiments, can solve the technical problem of poor effect of current abnormal event alarm triggering. Compared with the prior art, the beneficial effects of the encryption system abnormal event alarm triggering device provided in this application are the same as the beneficial effects of the encryption system abnormal event alarm triggering method provided in the above embodiments, and other technical features in the encryption system abnormal event alarm triggering device are the same as the features disclosed in the method of the previous embodiment, and will not be repeated here.

[0133] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0134] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0135] All user-related data involved in this application was obtained with the user's permission or consent, as per [reference]. Figure 5 In other words, when this application is applied to a specific product or technology, user permission is required to acquire and process the relevant data, and the processing of the relevant data must comply with relevant laws, regulations and regulatory standards.

[0136] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for triggering an alarm for an abnormal event in an encryption system, characterized in that, The method includes: In the event of an abnormal event during an encrypted call, the information of the abnormal event is extracted to obtain the abnormal event information; Based on the abnormal event information and the preset event classification rules, the event category of the abnormal event is determined; Based on the event category, an alarm triggering method for the abnormal event is determined, wherein the alarm triggering method includes a business-level triggering method, which is used to determine the abnormal centralized business dimension of the abnormal event based on a preset composite triggering algorithm and a preset centralized algorithm. Based on the alarm triggering method and the abnormal event information, an alarm for the abnormal event is triggered, and an alarm triggering record is output.

2. The method as described in claim 1, characterized in that, If the alarm triggering method is the business-level triggering method, then the step of triggering an alarm for the abnormal event based on the alarm triggering method and the abnormal event information, and outputting the alarm triggering record includes: Obtain the event time window and event triggering dimension set of the abnormal event; Based on the error type families in the event triggering dimension set, the event time window, the abnormal event information, and the preset composite abnormal triggering algorithm, the triggering type of the abnormal event and the corresponding time-series abnormal score are determined. If the time-series anomaly score is higher than the preset time-series anomaly threshold, then based on the anomaly event information and the preset business dimension concentration algorithm, the dimension concentration score of the business dimension in the preset business dimension attribution set is calculated. If the dimensionality score is higher than the preset dimensionality threshold, the corresponding dimensionality information is recorded, and the alarm trigger record containing the dimensionality information is output.

3. The method as described in claim 2, characterized in that, The step of determining the triggering type of the abnormal event and the corresponding time-series anomaly score based on the error type family in the event triggering dimension set, the event time window, the abnormal event information, and a preset composite anomaly triggering algorithm includes: Based on the abnormal event information, obtain the number of errors that match the error type family within the event time window, and obtain the total number of encrypted call requests; The error rate of the encrypted call is calculated based on the number of errors and the total number of requests, and the burn rate of the encrypted call is calculated based on the number of errors, the total number of requests, and the preset target success rate. Based on the preset monitoring configuration, one of the parameters, namely the number of errors, the error rate, and the combustion rate, is used as an anomaly indicator. Based on the historical baseline window in the event time window, the abnormal indicators corresponding to each preset time period in the historical baseline window are obtained to obtain the historical abnormal indicators. Based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm, the triggering type of the anomaly event is determined; The temporal anomaly score of the abnormal event is determined based on the number of errors, the error rate, the burn rate, the historical anomaly index, and the composite anomaly triggering algorithm.

4. The method as described in claim 3, characterized in that, The trigger types include fixed threshold sample size triggering, multi-window loss triggering, dynamic baseline triggering, seasonal residual triggering, weighted average triggering, cumulative sum triggering, and frequency domain residual expansion triggering. The burn rate includes short-term window burn rate and long-term window burn rate. The step of determining the trigger type of the abnormal event based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm includes: Calculate the median and expected value of each of the historical anomaly indicators, and calculate the weighted average of each of the historical anomaly indicators based on preset weights; If the number of errors is higher than a preset error number threshold, or the error rate is higher than a preset error rate threshold, then the trigger type is determined to include the fixed threshold sample size trigger. If both the short-term window burn rate and the long-term window burn rate exceed a preset burn rate threshold, then the trigger type is determined to include the multi-window loss trigger. Obtain abnormal time series data within the current event time window. If the standard deviation multiple of the difference between the abnormal time series data and the median is higher than a preset difference multiple threshold, or if the abnormal time series data is higher than a preset high-level abnormal index in the historical abnormal index, then determine that the trigger type includes the dynamic baseline trigger. If the expected residual between the abnormal time series data and the expected value is higher than a preset residual threshold, then the trigger type is determined to include the seasonal residual trigger; if the weighted average is higher than a preset weighted average threshold, then the trigger type is determined to include the weighted average trigger. Subtract the expected value and the preset allowable offset from the abnormal time series data to obtain the offset value. Add the offset values ​​within the event time window to obtain the cumulative value. If the cumulative value is higher than the preset cumulative threshold, then the trigger type is determined to include the accumulation and trigger. The abnormal time series data is transformed in the frequency domain based on a preset frequency domain residual processing function to obtain an anomaly significance score. If the anomaly significance score is higher than a preset significance score threshold, the trigger type is determined to include the frequency domain residual extension trigger.

5. The method as described in claim 4, characterized in that, The step of determining the temporal anomaly score of the abnormal event based on the number of errors, the error rate, the burn rate, the historical anomaly indicators, and the composite anomaly triggering algorithm includes: Calculate the error ratio between the number of errors and the error threshold, and calculate the error ratio between the error rate and the error rate threshold. Use the higher of the error ratio and the error rate ratio as the fixed threshold sample size score. Calculate the short-term ratio of the short-term window combustion rate to the combustion rate threshold, and calculate the long-term ratio of the long-term window combustion rate to the combustion rate threshold. The smaller of the short-term ratio and the long-term ratio is taken as the multi-window loss score. Calculate the high-level anomaly difference between the abnormal time series data and the high-level anomaly index, and determine the dynamic baseline score based on the high-level anomaly difference and the standard deviation multiple; The ratio of the expected residual to the residual threshold is used as the seasonal residual score, the ratio of the weighted average to the weighted average threshold is used as the weighted average score, the ratio of the accumulated value to the accumulated threshold is used as the accumulated sum score, and the ratio of the abnormal significance score to the significance score threshold is used as the frequency domain residual expansion score. The maximum value among the fixed threshold sample size score, the multi-window loss score, the dynamic baseline score, the seasonal residual score, the weighted average score, the cumulative score, and the frequency domain residual expansion score is used as the time-series anomaly score.

6. The method as described in claim 2, characterized in that, The step of calculating the dimension centrality score of the business dimensions in the preset business dimension attribution set based on the abnormal event information and the preset business dimension centrality algorithm includes: For each of the business dimensions, based on the abnormal event information, the number of abnormal events for the business dimension is determined, and the dimension with the most abnormal events is selected as the target business dimension from among all the business dimensions. Calculate the Herfindahl index, information entropy, traffic increase multiple compared to the same period in history, Shannon divergence, and field missing ratio for the target business dimension respectively; The dimensional centrality score is calculated based on the Herfindahl index, the information entropy, the traffic increase factor, the Shannon divergence, the field missing ratio, and the preset centrality weight coefficient.

7. The method as described in claim 6, characterized in that, The step of recording the corresponding dimension concentration information and outputting the alarm trigger record containing the dimension concentration information if the dimension concentration score is higher than a preset dimension concentration threshold further includes: If the dimensional concentration score is higher than the dimensional concentration threshold, then the abnormality of the abnormal event is determined to be concentrated in the target business dimension. Record the dimension name, dimension value, number of abnormal events, percentage of abnormal events, traffic increase multiple, and dimension concentration score corresponding to the target business dimension to obtain centralized recording information; Based on the abnormal event information, a business-level suppression key is generated, and the currently active system-level suppression key is obtained. Determine whether the business-level suppression key has been generated within a preset timestamp, or whether the field of the business-level suppression key matches the active system-level suppression key. If it has not been generated or does not match, output the alarm trigger record containing the centralized record information.

8. The method as described in claim 7, characterized in that, Following the step of determining that the abnormality of the abnormal event is concentrated in the target business dimension if the dimensional concentration score is higher than the dimensional concentration threshold, the method further includes: Based on a preset number of candidates, multiple candidate business dimensions with the highest number of abnormal events are determined from each of the business dimensions, and the candidate business dimensions are combined to obtain multiple different combinations of business dimensions. For each business dimension combination, determine the number of abnormal events that simultaneously meet all the business dimensions in the business dimension combination to obtain the joint abnormality number, and calculate the ratio of the joint abnormality number to the total number of abnormal events to obtain the joint abnormality percentage. For each combination of business dimensions, calculate the conditional probability that the abnormal event meets one of the business dimensions and also meets the other business dimensions, and obtain the conditional abnormality ratio. If the proportion of joint anomalies is higher than a preset joint proportion threshold, and the proportion of conditions is higher than a preset condition transition threshold, then it is determined that the anomaly of the abnormal event is concentrated in all of the business dimensions in the business dimension combination.

9. The method as described in claim 1, characterized in that, The event classification rules include hard rules and soft scoring rules. The hard rules include ignore rules, system-level hard rules, and business-level hard rules. The step of determining the event category of the abnormal event based on the abnormal event information and the preset event classification rules includes: Based on the abnormal event information, it is determined whether the abnormal event only hits one of the ignore rule, the system-level hard rule, and the business-level hard rule. If only one of them is hit, the abnormal event is determined to be an abnormality corresponding to the hit rule. If no rule is hit or multiple rules among the ignored rules, the system-level hard rules, and the business-level hard rules are hit, then based on the abnormal event information, the system item hit and business item hit of the abnormal event are determined respectively, and the system-level score and business-level score are calculated respectively based on the system item hit and business item hit. If the system-level score is higher than the preset system-level equal score threshold, and the difference between the system-level score and the business-level score is higher than the preset difference threshold, then the abnormal event is determined to be a system-level event. If the business-level score is higher than the preset business-level score threshold, and the difference between the business-level score and the system-level score is higher than the difference threshold, then the abnormal event is determined to be a business-level event. If the difference between the system-level score and the business-level score is lower than the difference threshold, and the difference between the business-level score and the system-level score is also lower than the difference threshold, then the abnormal event is determined to be a mixed-source event.

10. A device for triggering alarms for abnormal events in an encryption system, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the encryption system abnormal event alarm triggering method as described in any one of claims 1 to 9.

Images