The invention relates to the technical field of computer
system monitoring, and discloses a host process monitoring method which comprises the following steps: S1, multi-
modal acquisition: acquiring process resources, behavior data and interaction relationships; s2, performing feature
processing: performing normalization,
time sequence modeling and interactive extraction; s3, behavior modeling: modeling a
time sequence and an interaction graph to describe behaviors; s4,
anomaly detection: identifying anomalies by
time sequence and
graph embedding and confrontation methods; s5, safety response: executing blocking, resource limiting and isolation measures; and S6,
adaptive optimization: dynamically optimizing the model and the strategy by feeding back. Through
file system analysis and network flow capture, process static information, dynamic behaviors and interaction relations are comprehensively collected,
full life cycle data coverage is achieved, resource occupation is optimized in combination with a dynamic sampling strategy, efficient operation is achieved while data comprehensiveness and timeliness are improved, and the
system performance is improved. And the balance between efficient operation and
low resource consumption is achieved.