WO2020211251A1

WO2020211251A1 - Monitoring method and apparatus for operating system

Info

Publication number: WO2020211251A1
Application number: PCT/CN2019/103404
Authority: WO
Inventors: 秦天欢
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-04-16
Filing date: 2019-08-29
Publication date: 2020-10-22
Also published as: CN110175083A

Abstract

Disclosed are a monitoring method and apparatus for an operating system. The method comprises: acquiring monitoring data of a user, the monitoring data comprising a target command executed by the user on the operating system and a parameter of the target command (S110); determining, according to the monitoring data, a command vector of the target command, the command vector comprising command indication information and parameter indication information, the command indication information being used for indicating the target command and the parameter indication information being used for indicating the parameter type of the parameter (S120); and determining, according to the command vector and a risk analysis model, a risk level of the target command, the risk analysis model being used for representing a mapping relationship between the command vector and the risk level, the risk level comprising a dangerous operation or a non-dangerous operation (S130). By using the monitoring method and apparatus for the operating system, the risk level of the command executed by the user on the operating system can be identified, and the security of the operating system can be improved.

Description

Operating system monitoring method and device

This application affirms that it enjoys the priority of a Chinese patent application filed on April 16, 2019 with the application number 201910301822.6 and titled "Operating System Monitoring Method and Device". The entire content of the Chinese patent application is incorporated herein by reference. Applying.

Technical field

This application relates to the field of intelligent decision-making, and more specifically, to a method and device for monitoring an operating system in the field of intelligent decision-making.

Background technique

With the continuous development of information technology, the challenges brought by the system security of the operating system become more and more severe. Timely detection of dangerous operations performed by abnormal logins can avoid system safety damage.

The inventor realizes that the industry usually records the user's login log on the operating system through a bastion machine, but cannot provide an analysis based on this log. That is to say, the existing methods cannot analyze which operations will threaten the security of the system and take protective measures to the operating system in time.

Therefore, there is currently a lack of effective monitoring of sensitive instructions executed by users on the operating system.

Summary of the invention

The present application provides a method and device for monitoring an operating system, which can identify the risk level of commands executed by a user on the operating system, which is beneficial to improve the security of the operating system.

In order to achieve the above objectives, this application provides a method for monitoring an operating system, including the following content:

Acquiring monitoring data of the user, the monitoring data including the target command executed by the user on the operating system and the parameters of the target command;

According to the monitoring data, a command vector of the target command is determined, the command vector includes command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication information is used to indicate all The parameter type of the parameter;

The risk level of the target command is determined according to the command vector and the risk analysis model, the risk analysis model is used to represent the mapping relationship between the command vector and the risk level, and the risk level includes dangerous operations or Non-hazardous operation.

In a possible implementation manner, determining the command vector according to the monitoring data includes: determining the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data, the parameter type including high Frequency parameter or low frequency parameter; the parameter indication information is determined according to the parameter type.

In order to achieve the above objective, this application also provides a monitoring device for an operating system, which specifically includes:

An obtaining unit, configured to obtain monitoring data of a user, the monitoring data including a target command executed by the user on the operating system and parameters of the target command;

The determining unit is configured to determine a command vector of the target command according to the monitoring data, the command vector including command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication Information is used to indicate the parameter type of the parameter; the risk level of the target command is determined according to the command vector and the risk analysis model, and the risk analysis model is used to indicate the difference between the command vector and the risk level A mapping relationship, where the risk level includes dangerous operations or non-dangerous operations.

In order to achieve the above object, the present application also provides a computer device, including a memory, a processor, a communication interface, and a computer program stored on the memory and running on the processor, wherein the memory, the The processor and the communication interface communicate with each other through an internal connection path, and the processor implements the following steps of the above method when the processor executes the computer program:

To achieve the foregoing objective, the present application also provides a non-volatile computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the following steps of the foregoing method are implemented:

Using the operating system monitoring method, device, computer equipment, and non-volatile computer-readable storage medium provided in the present application can identify the risk level of commands executed by the user on the operating system, thereby improving the security of the operating system.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for monitoring an operating system provided by an embodiment of the present application;

2 is a schematic flowchart of another operating system monitoring method provided by an embodiment of the present application;

FIG. 3 is a schematic block diagram of an operating system monitoring device provided by an embodiment of the present application;

Fig. 4 is a schematic block diagram of another operating system monitoring device provided by an embodiment of the present application.

detailed description

In order to make the purpose, technical solutions, and advantages of this application clearer, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application, and not used to limit the application. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

Example 1

FIG. 1 shows a schematic flowchart of a method 100 for monitoring an operating system provided by an embodiment of the present application. It should be understood that the method 100 may be executed by a monitoring device of an operating system.

Optionally, the monitoring device may be a computer, or may be a functional module in the computer, which is not limited in the embodiment of the present application.

S110: Obtain monitoring data of a user, where the monitoring data includes a target command executed by the user on the operating system and a parameter of the target command.

Specifically, the monitoring device can acquire at least one command executed by the user on the operating system within a preset time period and the parameter of each command in the at least one command, where the at least one command includes the target Command; Obtain the target command and the parameters of the target command from the monitoring data.

Optionally, the target command can be any one of the at least one command.

For example, within the preset time period, the monitoring device obtains a list of commands executed by the user. As shown in Table 1, the list of commands includes all the commands executed by the user and the parameters of each command. The monitoring device can sequentially use each command in the command list as a target command.

命令command	参数parameter
cdcd	/home/wls81/home/wls81
lsls	/home/wls81/home/wls81

lsls	-trlah-trlah
vivi	my.cnfmy.cnf
serviceservice	mysqld restartmysqld restart
……...	……...

Table I

S120. Determine a command vector of the target command according to the monitoring data, the command vector including command indication information and parameter indication information, the command indication information is used for indicating the target command, and the parameter indication information is used for Indicates the parameter type of the parameter.

In a possible implementation manner, the monitoring device may determine the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data, and the parameter type includes a high-frequency parameter or a low-frequency parameter; The parameter type determines the parameter indication information. (When at least one parameter is included in the monitoring data)

For example: /home/wls81 appears 1100 times, mysql.cnf appears 1200 times, mysqld restart appears 1233 times, and -trlah appears 82 times.

It can be seen that the first two occurrences are mysqld restart and mysql.cnf, which are high-frequency parameters; the ones that appear after the first two are /home/wls81 and -trlah, which are low-frequency parameters.

Optionally, when the number of times the parameter appears in the monitoring data is greater than or equal to a preset number of times, the monitoring device determines that the parameter is a high-frequency parameter; or when the parameter appears in the monitoring data When the number of times is less than the preset number of times, the monitoring device determines that the parameter is a low-frequency parameter.

For example: mysqld restart appears 1233 times, mysql.cnf appears 1200 times, /home/wls81 appears 1100 times, -trlah appears 82 times, and the preset number is 1200 times.

It can be seen that the number of occurrences of mysqld restart and mysql.cnf is greater than or equal to the preset number of 1200, which is the high frequency parameter; the frequency of /home/wls81 and -trlah is less than the preset number of 1200, which is the low frequency parameter.

In another possible implementation manner, the monitoring device may determine the parameter type of the parameter according to the importance of the parameter, and the parameter type includes a key parameter or a non-critical parameter; and determine the parameter type according to the parameter type. The parameter indication information.

For example, the importance levels of mysql.cnf and mysqld restart are both important, and the importance levels of /home/wls81 and -trlah are not important.

It can be seen that mysql.cnf and mysqld restart are key parameters, and /home/wls81 and -trlah are non-key parameters.

Optionally, when the importance level of the parameter is greater than or equal to the preset level, the monitoring device determines that the parameter is a key parameter; or when the importance level of the parameter is less than the preset level, the monitoring device determines The parameters are non-critical parameters.

For example, the importance level of mysqld restart is 4, the importance level of mysql.cnf is 3, the importance level of /home/wls81 is 1, the importance level of -trlah is 0, and the default level is 2.

It can be seen that the importance levels of mysqld restart and mysql.cnf are both greater than or equal to the preset level 2, which is a key parameter; the importance levels of /home/wls81 and -trlah are both less than the preset level 2, which is a non-critical parameter.

Optionally, determining the parameter indication information according to the parameter type may be: when the parameter is a high-frequency parameter or a key parameter, the monitoring device determines that the parameter indication information is an identifier of the parameter; or When the parameter is a low-frequency parameter or a non-critical parameter, the monitoring device determines that the parameter indication information is a first identifier, and the first identifier is used to identify all low-frequency parameters or non-critical parameters.

For example, mysql.cnf and mysqld restart are high-frequency parameters/key parameters, and /home/wls81 and -trlah are low-frequency parameters/non-key parameters. Among them, the identifier of mysqld restart is 1, the identifier of mysql.cnf is 2, and the first The identifier is 0, and the first identifier is used to identify low-frequency parameters/non-critical parameters.

It can be seen that the parameter indication information of mysqld restart is 1, the parameter indication information of mysql.cnf is 2, and the parameter indication information of home/wls81 and -trlah is 0.

Optionally, the command indication information in the command vector is the identifier of the target command.

For example, the identifier of cd is 1, the identifier of ls is 2, the identifier of vi is 3, and the identifier of service is 4.

It can be seen that the command indication information of cd is 1, the command indication information of ls is 2, the command indication information of vi is 3, and the command indication information of service is 4.

In summary, each row in the above command list can get a corresponding vector, as shown in Table 2.

命令command	参数parameter	向量vector
cdcd	/home/wls81/home/wls81	<1,0><1,0>
lsls	/home/wls81/home/wls81	<2,0><2,0>
lsls	-trlah-trlah	<2,0><2,0>
vivi	my.cnfmy.cnf	<3,2><3,2>
serviceservice	mysqld restartmysqld restart	<4,1><4,1>
……...	……...	……...

Table II

S130. Determine the risk level of the target command according to the command vector and the risk analysis model, where the risk analysis model is used to represent the mapping relationship between the command vector and the risk level, and the risk level includes danger Operation or non-hazardous operation.

Optionally, the method further includes: outputting risk level indication information, where the risk level indication information is used to indicate the risk level of the target command.

For example, output 1 for dangerous operations and 0 for non-hazardous operations.

Optionally, dangerous operations may include prohibited operations or high-risk operations, and non-dangerous operations may include normal operations and low-risk operations.

For example, common operations: read files; low-risk operations: write files; high-risk operations: shutdown; prohibited operations: delete operating system files on the server.

For another example, normal operation output 0, low-risk operation output 1, high-risk operation output 2, and prohibited operation output 3.

Optionally, the method further includes: when the target command is a dangerous operation, sending an alarm notification to the staff.

For example, when the target command is a high-risk operation, an alarm notification is sent to the staff by email or text message; when the target command is a prohibited operation, an alarm notification is sent to the staff by phone or the execution of the target command is prohibited .

Using the operating system monitoring method provided in this application to notify the staff in time can effectively avoid threats to system security.

Optionally, before S130, the method further includes training the risk analysis model.

Specifically, the command vector of each command and the risk level of each command among the multiple commands executed by the user on the operating system are acquired; the command vector of each command and the risk of each command The level is input into the LSTM network, and the risk analysis model is obtained by training.

It should be noted that the risk analysis model trains an optimal model through the LSTM model algorithm for the command vector of each command in a plurality of commands and the risk level of each command. This model belongs to a set of functions. Excellent means that the output closest to the actual result can be obtained according to the input under a certain evaluation criterion, so that the command vector of the input command can be mapped to the risk level of the corresponding output command through the risk analysis model.

Optionally, the risk analysis model may be based on one or coding-decoding model framework, for example, it may be based on the LSTM model, or may be based on convolutional neural networks (convolutional neural networks, CNN), recurrent neural networks (recurrent neural networks, RNN) , Bidirectional recurrent neural networks (BiRNN), gated recurrent units (GRU) models, etc. The embodiments of the present invention are not limited thereto.

It should be understood that LSTM (Long Short-Term Memory) is a long and short-term memory network, a time recurrent neural network, suitable for processing and predicting important events with relatively long intervals and delays in a time series. LSTM adds a "processor" to the algorithm to determine whether the information is useful or not. The structure of this processor is called a cell. Three doors are placed in a cell, which are called input gate, forget gate and output gate. When a piece of information enters the LSTM network, it can be judged whether it is useful according to the rules. Only the information that meets the algorithm authentication will be left, and the non-compliant information will be forgotten through the forget door. The LSTM model adopts the working principle of one input and two output, which can solve the long-term large problems in the neural network under repeated calculations.

Example 2

FIG. 2 shows a schematic flowchart of a method 200 for monitoring an operating system provided by an embodiment of the present application. It should be understood that the method 200 may be executed by a monitoring device of an operating system.

S210. Acquire a command vector of each command and a risk level of each command among multiple commands executed by the user on the operating system, where the command vector of each command includes first command indication information and first parameter indication information The first command indication information is used to indicate each command, the first parameter indication information is used to indicate a parameter type of a parameter of each command, and the risk level includes a dangerous operation or a non-dangerous operation.

S220: Input the command vector of each command and the risk level of each command into the LSTM network, and train a risk analysis model.

S230: Obtain monitoring data of a user, where the monitoring data includes a target command executed by the user on the operating system and a parameter of the target command.

S240. Determine a command vector of the target command according to the monitoring data, where the command vector of the target command includes second command indication information and second parameter indication information, and the second command indication information is used to indicate the target Command, the second parameter indication information is used to indicate the parameter type of the parameter.

S250: Determine the risk level of the target command according to the command vector of the target command and the risk analysis model, where the risk analysis model is used to indicate the mapping relationship between the command vector and the risk level.

The operating system monitoring method provided by the embodiment of the present application is described above with reference to FIG. 1 and FIG. 2, and the operating system monitoring device provided by the embodiment of the present application will be described below with reference to FIG. 3 and FIG. 4.

Example 3

FIG. 3 shows a schematic block diagram of an operating system monitoring device 300 provided in an embodiment of the present application. The device 300 includes:

The obtaining unit 310 is configured to obtain monitoring data of a user, where the monitoring data includes a target command executed by the user on the operating system and parameters of the target command;

The determining unit 320 is configured to determine a command vector of the target command according to the monitoring data, the command vector including command indication information and parameter indication information, the command indication information is used to indicate the target command, the parameter The indication information is used to indicate the parameter type of the parameter; the risk level of the target command is determined according to the command vector and the risk analysis model, and the risk analysis model is used to indicate the difference between the command vector and the risk level The risk level includes hazardous operations or non-hazardous operations.

Optionally, the determining unit is specifically configured to determine the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data, and the parameter type includes a high-frequency parameter or a low-frequency parameter; according to the parameter Type to determine the parameter indication information.

Optionally, the determining unit is specifically configured to determine that the parameter is a high-frequency parameter when the number of times the parameter appears in the monitoring data is greater than or equal to a preset number; or when the parameter is in the monitoring data When the number of occurrences in the data is less than the preset number of times, it is determined that the parameter is a low frequency parameter.

Optionally, the determining unit is specifically configured to determine that the parameter indication information is an identifier of the parameter when the parameter is a high-frequency parameter; or determine the parameter indication information when the parameter is a low-frequency parameter It is a first identifier, and the first identifier is used to identify all low-frequency parameters.

Optionally, the determining unit is specifically configured to determine the parameter type of the parameter according to the importance of the parameter, and the parameter type includes a key parameter or a non-critical parameter; and determine the parameter indication according to the parameter type information.

Optionally, the determining unit is specifically configured to determine that the parameter is a key parameter when the importance level of the parameter is greater than or equal to a preset level; or when the importance level of the parameter is less than the preset level, Determine that the parameters are non-critical parameters.

Optionally, the determining unit is specifically configured to determine that the parameter indication information is the identifier of the parameter when the parameter is a key parameter; or determine the parameter indication information when the parameter is a non-critical parameter It is a first identifier, and the first identifier is used to identify all non-critical parameters.

Optionally, the device further includes a training unit, and the acquiring unit is further configured to acquire the information executed by the user on the operating system before determining the risk level of the target command according to the command vector and the risk analysis model. The command vector of each command in the plurality of commands and the risk level of each command; the training unit is used to input the command vector of each command and the risk level of each command into the LSTM network, The risk analysis model is obtained through training.

Example 4

FIG. 4 shows a schematic block diagram of a hardware architecture of a computer device of an operating system provided in an embodiment of the present application. The computer device may be an apparatus 400. The computer device may include a processor 410, a communication interface 420, and a memory 430, and the processor 410, the communication interface 420, and the memory 430 communicate with each other through an internal connection path. The related functions implemented by the determining unit 320 in FIG. 3 may be implemented by the processor 410, and the related functions implemented by the acquiring unit 310 in FIG. 3 may be implemented by the processor 410 controlling the communication interface 420.

The processor 410 may include one or more processors, for example, one or more central processing units (CPU). In the case where the processor is a CPU, the CPU may be a single-core CPU or It can be a multi-core CPU.

The communication interface 420 is used to input and/or output data. The communication interface may include a sending interface and a receiving interface, the sending interface is used for outputting data, and the receiving interface is used for inputting data.

The memory 430 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable memory (erasable read only memory, EPROM), and read-only memory. A compact disc (read-only memory, CD-ROM), and the memory 430 is used to store related instructions and data.

The memory 430 is used to store program codes and data of the device, and may be a separate device or integrated in the processor 410.

Specifically, the processor 410 is configured to control the communication interface 420 to call the code instructions stored in the memory 430 and execute the code instructions. For details, please refer to the description in the method embodiment, which will not be repeated here.

It can be understood that FIG. 4 only shows a simplified design of the computer device. In practical applications, the computer equipment may also contain other necessary components, including but not limited to any number of communication interfaces, processors, controllers, memories, etc., and all devices that can implement the application are protected by this application. Within range.

In a possible design, the computer device may be replaced with a chip device, for example, a chip that can be used in the device to implement related functions of the processor 410 in the device. The chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for realizing related functions. . The chip may optionally include one or more memories for storing program codes. When the codes are executed, the processor realizes corresponding functions.

A person of ordinary skill in the art may be aware that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the above-described system, device, and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a computer-readable storage medium. Wherein, the computer-readable storage medium includes a volatile computer-readable storage medium and a non-transitory computer-readable storage medium, and includes a number of instructions to enable a computer device (which may be a personal computer, a server, or a network device) Etc.) Perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

A method for monitoring an operating system, characterized in that it includes:

Acquiring monitoring data of the user, the monitoring data including the target command executed by the user on the operating system and the parameters of the target command;

According to the monitoring data, a command vector of the target command is determined, the command vector includes command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication information is used to indicate all The parameter type of the parameter;

The risk level of the target command is determined according to the command vector and the risk analysis model, the risk analysis model is used to represent the mapping relationship between the command vector and the risk level, and the risk level includes dangerous operations or Non-hazardous operation.
The method according to claim 1, wherein determining a command vector according to the monitoring data comprises:

Determining the parameter type of the parameter according to the total number of occurrences of the parameter in the monitoring data, the parameter type including a high-frequency parameter or a low-frequency parameter;

Determine the parameter indication information according to the parameter type.
The method according to claim 2, wherein determining the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data comprises:

When the number of occurrences of the parameter in the monitoring data is greater than or equal to the preset number of times, determining that the parameter is a high-frequency parameter; or

When the number of occurrences of the parameter in the monitoring data is less than the preset number of times, it is determined that the parameter is a low-frequency parameter.
The method according to claim 3, wherein determining the parameter indication information according to the parameter type comprises:

When the parameter is a high-frequency parameter, determine that the parameter indication information is an identifier of the parameter; or

When the parameter is a low-frequency parameter, it is determined that the parameter indication information is a first identifier, and the first identifier is used to identify all low-frequency parameters.
The method according to claim 1, wherein determining a command vector according to the monitoring data comprises:

Determine the parameter type of the parameter according to the importance of the parameter, and the parameter type includes a key parameter or a non-critical parameter;

Determine the parameter indication information according to the parameter type.
The method according to claim 5, wherein determining the parameter type of the parameter according to the importance of the parameter comprises:

When the importance level of the parameter is greater than or equal to the preset level, determine that the parameter is a key parameter; or

When the importance level of the parameter is less than the preset level, it is determined that the parameter is a non-critical parameter.
The method according to any one of claims 1 to 6, characterized in that, before determining the risk level of the target command according to the command vector and the risk analysis model, the method further comprises:

Acquiring the command vector of each command in the multiple commands executed by the user on the operating system and the risk level of each command;

The command vector of each command and the risk level of each command are input into the LSTM network, and the risk analysis model is obtained by training.
An operating system monitoring device, characterized in that it comprises:

An obtaining unit, configured to obtain monitoring data of a user, the monitoring data including a target command executed by the user on the operating system and parameters of the target command;

The determining unit is configured to determine a command vector of the target command according to the monitoring data, the command vector including command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication Information is used to indicate the parameter type of the parameter; the risk level of the target command is determined according to the command vector and the risk analysis model, and the risk analysis model is used to indicate the difference between the command vector and the risk level A mapping relationship, where the risk level includes dangerous operations or non-dangerous operations.
A computer device, including a memory, a processor, a communication interface, and a computer program stored on the memory and running on the processor, wherein the memory, the processor, and the communication interface are Communicating with each other through internal connection paths, characterized in that the processor executes the computer program to implement the following steps:

Acquiring monitoring data of the user, the monitoring data including the target command executed by the user on the operating system and the parameters of the target command;

According to the monitoring data, a command vector of the target command is determined, the command vector includes command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication information is used to indicate all The parameter type of the parameter;

The risk level of the target command is determined according to the command vector and the risk analysis model, the risk analysis model is used to represent the mapping relationship between the command vector and the risk level, and the risk level includes dangerous operations or Non-hazardous operation.
The computer device according to claim 9, characterized in that: determining a command vector according to the monitoring data comprises:

Determining the parameter type of the parameter according to the total number of occurrences of the parameter in the monitoring data, the parameter type including a high-frequency parameter or a low-frequency parameter;

Determine the parameter indication information according to the parameter type;

Preferably, determining the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data includes:

When the number of occurrences of the parameter in the monitoring data is greater than or equal to the preset number of times, determining that the parameter is a high-frequency parameter; or

When the number of occurrences of the parameter in the monitoring data is less than the preset number of times, it is determined that the parameter is a low-frequency parameter.
The computer device according to claim 10, wherein: determining the parameter indication information according to the parameter type comprises:

When the parameter is a high-frequency parameter, determine that the parameter indication information is an identifier of the parameter; or

When the parameter is a low-frequency parameter, it is determined that the parameter indication information is a first identifier, and the first identifier is used to identify all low-frequency parameters.
The computer device according to claim 9, wherein determining a command vector according to the monitoring data comprises:

Determine the parameter type of the parameter according to the importance of the parameter, and the parameter type includes a key parameter or a non-critical parameter;

Determine the parameter indication information according to the parameter type.
The computer device according to claim 12, wherein: determining the parameter type of the parameter according to the importance of the parameter comprises:

When the importance level of the parameter is greater than or equal to the preset level, determine that the parameter is a key parameter; or

When the importance level of the parameter is less than the preset level, it is determined that the parameter is a non-critical parameter.
The computer device according to any one of claims 9 to 13, wherein before determining the risk level of the target command according to the command vector and the risk analysis model, the method further comprises:

Acquiring the command vector of each command in the multiple commands executed by the user on the operating system and the risk level of each command;

The command vector of each command and the risk level of each command are input into the LSTM network, and the risk analysis model is obtained by training.
A computer-readable storage medium for storing a computer program, wherein the computer program is executed by a processor to implement the following steps:

Acquiring monitoring data of the user, the monitoring data including the target command executed by the user on the operating system and the parameters of the target command;

According to the monitoring data, a command vector of the target command is determined, the command vector includes command indication information and parameter indication information, the command indication information is used to indicate the target command, and the parameter indication information is used to indicate all The parameter type of the parameter;

The risk level of the target command is determined according to the command vector and the risk analysis model, the risk analysis model is used to represent the mapping relationship between the command vector and the risk level, and the risk level includes dangerous operations or Non-hazardous operation.
The computer-readable storage medium according to claim 15, wherein: determining a command vector according to the monitoring data comprises:

Determining the parameter type of the parameter according to the total number of occurrences of the parameter in the monitoring data, the parameter type including a high-frequency parameter or a low-frequency parameter;

Determine the parameter indication information according to the parameter type;

Preferably, determining the parameter type of the parameter according to the total number of times the parameter appears in the monitoring data includes:

When the number of occurrences of the parameter in the monitoring data is greater than or equal to the preset number of times, determining that the parameter is a high-frequency parameter; or

When the number of occurrences of the parameter in the monitoring data is less than the preset number of times, it is determined that the parameter is a low-frequency parameter.
The computer device according to claim 16, wherein: determining the parameter indication information according to the parameter type comprises:

When the parameter is a high-frequency parameter, determine that the parameter indication information is an identifier of the parameter; or

When the parameter is a low-frequency parameter, it is determined that the parameter indication information is a first identifier, and the first identifier is used to identify all low-frequency parameters.
The computer-readable storage medium of claim 15, wherein determining a command vector according to the monitoring data comprises:

Determine the parameter type of the parameter according to the importance of the parameter, and the parameter type includes a key parameter or a non-critical parameter;

Determine the parameter indication information according to the parameter type.
The computer-readable storage medium of claim 18, wherein: determining the parameter type of the parameter according to the importance of the parameter comprises:

When the importance level of the parameter is greater than or equal to the preset level, determine that the parameter is a key parameter; or

When the importance level of the parameter is less than the preset level, it is determined that the parameter is a non-critical parameter.
The computer-readable storage medium according to any one of claims 15 to 19, wherein before determining the risk level of the target command according to the command vector and the risk analysis model, the method further comprises:

Acquiring the command vector of each command in the multiple commands executed by the user on the operating system and the risk level of each command;

The command vector of each command and the risk level of each command are input into the LSTM network, and the risk analysis model is obtained by training.