CN117851154A - A computer host operation abnormality identification system based on data analysis - Google Patents

Abstract

The present invention discloses a computer host operation abnormality identification system based on data analysis, comprising a central control module, a hardware monitoring module, a software monitoring module, a data acquisition module and an alarm module, wherein the hardware monitoring module is used for computer host hardware data abnormality identification and monitoring, and the software monitoring module is used for computer host software data abnormality identification and monitoring; the present invention can identify computer host hardware data abnormality while identifying software data abnormality, so that the computer host hardware data and software data abnormality identification and monitoring complement each other, thereby being able to more comprehensively understand the computer host's security status, timely discover and eliminate virus threats, and being able to regularly back up important data storage to prevent important data loss, thereby improving the security of the computer host, and when the computer host abnormality is detected, being able to promptly notify the user of the computer host abnormality, so that the user is convenient to promptly discover and handle it.

Description

A computer host operation abnormality identification system based on data analysis

Technical Field

The present invention belongs to the technical field of computer host security, and more specifically, particularly relates to a computer host operation abnormality identification system based on data analysis.

Background technique

Computers can run a variety of software, including operating systems, office software, game software, design software, etc., to provide users with a variety of services. With the development and use of computers, computer viruses are a common security issue.

Currently, viruses can be spread in various ways, such as through email attachments, network shared folders, malicious websites, etc. Once a computer host is infected with a virus, it may cause abnormal phenomena such as slow system operation, file loss, data leakage, and failure to operate normally. Therefore, we need to provide a computer host operation abnormality identification system based on data analysis.

Summary of the invention

The purpose of the present invention is to solve the shortcomings of the prior art and to propose a computer host operation abnormality identification system based on data analysis.

To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a computer host operation abnormality identification system based on data analysis, comprising a central control module, a hardware monitoring module, a software monitoring module, a data acquisition module and an alarm module, wherein the hardware monitoring module and the software monitoring module are both connected to a local server, the hardware monitoring module is used for identifying and monitoring abnormalities in the computer host hardware data, and the software monitoring module is used for identifying and monitoring abnormalities in the computer host software data, the hardware monitoring module and the software monitoring module are both connected to the central control module, and the central control module is used for analyzing the data detected by the hardware monitoring module and the software monitoring module to determine whether there are abnormalities in the hardware data and software data of the computer host.

Preferably, the hardware monitoring module includes a scheduled inspection unit, a backup data unit, an abnormality monitoring unit and a temperature monitoring unit. The scheduled inspection unit includes a task scheduler. By creating a new task, setting the trigger and operation of the task, and setting the scheduled task, specific programs or scripts can be run regularly to achieve the purpose of regularly checking the computer.

Preferably, the backup data unit: regularly backs up important data and stores it in a reliable cloud service, which can prevent data loss caused by virus attacks;

The abnormal monitoring unit: viruses usually occupy system resources, causing the computer to run slowly. By monitoring the usage of resources such as CPU, memory, and hard disk, it can be determined whether there is a virus;

The temperature monitoring unit: Virus invasion may lead to excessive use of computer hardware resources, thereby causing the computer to heat up. By monitoring the temperature of the computer hardware, it is possible to preliminarily determine whether there is a virus invasion.

Preferably, the software monitoring module is a core functional module integrated in anti-virus software or security software, and is used to detect and remove malicious programs such as viruses and Trojans in the computer;

The software monitoring module includes a scanning engine, a virus database, a behavior analysis engine, a system warning reminder and a sandbox technology, which comprehensively detects and removes viruses, Trojans and other malicious programs in the computer to protect the security and stable operation of the computer.

Preferably, the scanning engine: The scanning engine is the core part of the virus software detection module, responsible for scanning files and key system areas in the computer to find potential viruses and malicious programs;

Virus database: The virus database is a database containing known virus samples and characteristics, which is used to compare and identify viruses in the computer.

Preferably, the behavior analysis engine: The behavior analysis engine monitors and analyzes the running behavior of the program to determine whether it has malicious nature, so as to detect some unknown viruses and malicious programs;

The behavior analysis engine includes open port checking, process checking, startup item checking, system account checking, and firewall and intrusion detection systems;

Open port check: By scanning the open ports of the local machine, you can find the ports that may be opened by viruses. Scanning all open ports of the local machine from other hosts can prevent hidden ports on the local machine.

Process check: Check the running processes, especially using process check software with paths and startup parameters. If there are unknown processes or processes with suspicious parameters, there may be signs of viruses, so list them as suspicious processes.

Startup item check: Check the computer's startup items, including services, scheduled tasks, etc. If there are suspicious startup items, there may be viruses hiding by modifying system settings or adding illegal services, etc., and they will be listed as suspicious startup items.

System account check: Check the system account information, especially the administrator account and guest account. If there are unknown accounts or abnormal account behavior, there may be backdoors left by malicious attackers, and they will be listed as suspicious accounts.

Firewalls and intrusion detection systems: Firewalls and IDS can monitor and check the computer's network connection, especially when there is no normal program connected to the network. Viruses may transmit data in the network, causing network traffic anomalies. By monitoring network traffic, it can be found whether there are network anomalies caused by viruses. If there are unknown network connections or abnormal network traffic, there is a possibility that the virus transmits data through the network through backdoors, etc., thereby detecting and preventing external attacks and the spread of malicious code.

Preferably, the system warns: when a possible virus attack is detected, the system can automatically pop up a warning window to warn the user and inform the user how to take measures to repair and prevent the attack.

Preferably, the sandbox technology is used to run suspicious processes, suspicious startup items, suspicious accounts and abnormal network traffic under safe conditions, observe their behavioral characteristics to determine whether there is a virus, and if it is determined that a virus exists, the location and information of the virus are fed back to the central control module.

Preferably, the data acquisition module and the alarm module are both connected to the central control module, and the data acquisition module is used to collect and store the data information detected and collected by the hardware monitoring module and the software monitoring module.

Preferably, the alarm module includes a wireless signal transmission unit for transmitting the alarm information and the collected data to a remote mobile terminal via a wireless signal to remind the user that there is a virus invasion on the computer.

Technical effects and advantages of the present invention: Compared with the prior art, the present invention provides a computer host operation abnormality identification system based on data analysis, which has the following advantages:

The present invention can identify abnormalities in the computer host hardware data while also identifying abnormalities in the software data, so that the abnormal identification and monitoring of the computer host hardware data and software data complement each other, thereby being able to more comprehensively understand the security status of the computer host, timely discover and eliminate virus threats, and regularly back up important data storage to prevent the loss of important data, thereby improving the security of the computer host. When the computer host abnormality is detected, the computer host abnormality can be notified to the user in a timely manner, facilitating the user to discover and handle it in a timely manner.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a schematic diagram of the structure of the present invention;

FIG2 is a schematic diagram of the hardware monitoring module structure of the present invention;

FIG3 is a schematic diagram of the structure of a software monitoring module of the present invention;

FIG. 4 is a schematic diagram of the behavior analysis engine structure of the present invention.

Detailed ways

In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

The present invention provides a computer host operation abnormality identification system based on data analysis as shown in Figures 1-4, including a central control module, a hardware monitoring module, a software monitoring module, a data acquisition module and an alarm module, the hardware monitoring module and the software monitoring module are both connected to a local server, the hardware monitoring module is used for computer host hardware data abnormality identification and monitoring, the software monitoring module is used for computer host software data abnormality identification and monitoring, the hardware monitoring module and the software monitoring module are both connected to the central control module, the central control module is used for data analysis detected by the hardware monitoring module and the software monitoring module, and determines whether there are abnormalities in the computer host hardware data and software data;

The hardware monitoring module includes a timed inspection unit, a data backup unit, an abnormality monitoring unit and a temperature monitoring unit. The timed inspection unit includes a task scheduler. By creating a new task, setting the trigger and operation of the task, and setting the scheduled task, a specific program or script can be run regularly to achieve the purpose of timed inspection of the computer.

Backup data unit: Regularly back up important data and store it in a reliable cloud service to prevent data loss caused by virus attacks;

Abnormal monitoring unit: Viruses usually occupy system resources, causing the computer to run slowly. By monitoring the usage of CPU, memory, hard disk and other resources, you can determine whether there is a virus;

Temperature monitoring unit: Virus intrusion may lead to excessive use of computer hardware resources, causing the computer to heat up. By monitoring the temperature of computer hardware, it is possible to preliminarily determine whether there is a virus intrusion;

The software monitoring module is a core functional module integrated in antivirus software or security software, which is used to detect and remove viruses, Trojans and other malicious programs in the computer;

The software monitoring module includes scanning engine, virus database, behavior analysis engine, system warning reminder and sandbox technology, which can comprehensively detect and remove viruses, Trojans and other malicious programs in the computer to protect the security and stable operation of the computer;

Scanning engine: The scanning engine is the core part of the virus software detection module, responsible for scanning the files and key system areas in the computer to find potential viruses and malicious programs;

Virus database: The virus database is a database containing known virus samples and features, which is used to compare and identify viruses in the computer;

Behavior analysis engine: The behavior analysis engine monitors and analyzes the running behavior of the program to determine whether it is malicious in nature, so as to detect some unknown viruses and malicious programs;

The behavior analysis engine includes open port checking, process checking, startup item checking, system account checking, and firewall and intrusion detection systems;

Open port check: By scanning the open ports of the local machine, you can find the ports that may be opened by viruses. Scanning all open ports of the local machine from other hosts can prevent hidden ports on the local machine.

Process check: Check the running processes, especially using process check software with paths and startup parameters. If there are unknown processes or processes with suspicious parameters, there may be signs of viruses, so list them as suspicious processes.

Startup item check: Check the computer's startup items, including services, scheduled tasks, etc. If there are suspicious startup items, there may be viruses hiding by modifying system settings or adding illegal services, etc., and they will be listed as suspicious startup items;

System account check: Check the system account information, especially the administrator account and guest account. If there are unknown accounts or abnormal account behavior, there may be backdoors left by malicious attackers, and they will be listed as suspicious accounts.

Firewall and Intrusion Detection System: Firewall and IDS can monitor and check the network connection of the computer. In particular, when there is no normal program connected to the network, viruses may transmit data in the network, causing abnormal network traffic. By monitoring network traffic, it can be found whether there are network anomalies caused by viruses. If there are unknown network connections or abnormal network traffic, there is a possibility that the virus transmits data through the network through backdoors, etc., so as to detect and prevent external attacks and the spread of malicious code;

System warning reminder: When a possible virus attack is detected, the system can automatically pop up a warning window to remind the user and tell the user how to take measures to repair and prevent it;

Sandbox technology: used to run suspicious processes, suspicious startup items, suspicious accounts and abnormal network traffic under safe conditions, observe their behavior characteristics to determine whether there is a virus. If a virus is found, the location and information of the virus will be fed back to the central control module;

The data acquisition module and the alarm module are both connected to the central control module. The data acquisition module is used to collect and store the data information detected and collected by the hardware monitoring module and the software monitoring module;

The alarm module includes a wireless signal transmission unit, which is used to transmit the alarm information and the collected data to the remote mobile terminal through wireless signals to remind the user that there is a virus invasion on the computer;

Working principle: By identifying abnormalities in the computer host hardware data, the software data can be identified abnormally at the same time, so that the abnormal identification and monitoring of the computer host hardware data and software data complement each other, so that the security status of the computer host can be more comprehensively understood, virus threats can be discovered and removed in a timely manner, and important data storage can be backed up regularly to prevent the loss of important data. While improving the security of the computer host, when the computer host abnormality is detected, the computer host abnormality can be notified to the user in time, so that the user can discover and deal with it in time.

Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims (10)

1. A computer host operation abnormality screening system based on data analysis is characterized in that: the system comprises a central control module, a hardware monitoring module, a software monitoring module, a data acquisition module and an alarm module, wherein the hardware monitoring module and the software monitoring module are connected with a local server, the hardware monitoring module is used for screening and monitoring abnormal hardware data of a computer host, the software monitoring module is used for screening and monitoring abnormal software data of the computer host, the hardware monitoring module and the software monitoring module are connected with the central control module, and the central control module is used for analyzing data detected by the hardware monitoring module and the software monitoring module and judging whether the abnormal hardware data and the abnormal software data of the computer host exist.

2. The system for screening for anomalies in operation of a host computer based on data analysis of claim 1, wherein: the hardware monitoring module comprises a timing checking unit, a backup data unit, an abnormality monitoring unit and a temperature monitoring unit, wherein the timing checking unit comprises a task planning program, a trigger and operation of a task are set by creating a new task, and a specific program or script can be run regularly by setting the planning task so as to realize the purpose of checking the computer at regular time.

3. The system for screening for abnormal operation of a computer host based on data analysis of claim 2, wherein: the backup data unit: the important data is regularly backed up and stored in a reliable cloud service, so that the data loss caused by virus attack can be prevented;

the abnormality monitoring unit: viruses often occupy system resources, resulting in slow computer operation. Whether viruses exist or not can be judged by monitoring the occupation condition of resources such as a CPU, a memory, a hard disk and the like;

the temperature monitoring unit: the virus invasion may cause excessive use of computer hardware resources, so that the computer heats up, and by monitoring the temperature of the computer hardware, whether the virus invasion exists can be primarily judged.

4. The system for screening for anomalies in operation of a host computer based on data analysis of claim 1, wherein: the software monitoring module is a core function module integrated in antivirus software or security software and is used for detecting and eliminating malicious programs such as viruses, trojans and the like in a computer;

the software monitoring module comprises a scanning engine, a virus library, a behavior analysis engine, a system warning prompt and a sandbox technology, and is used for comprehensively detecting and eliminating malicious programs such as viruses, trojans and the like in the computer and protecting the safe and stable operation of the computer.

5. The system for screening for anomalies in operation of a computer host based on data analysis of claim 4, wherein: the scan engine: the scanning engine is a core part of the virus software detection module and is responsible for scanning files and system key areas in a computer to search potential viruses and malicious programs;

virus library: the virus library is a database containing known virus samples and characteristics for use in aligning and identifying viruses in a computer.

6. The system for screening for anomalies in operation of a computer host based on data analysis of claim 5, wherein: the behavior analysis engine: the behavior analysis engine judges whether the program has malicious properties or not by monitoring and analyzing the running behavior of the program so as to detect some unknown viruses and malicious programs;

the behavior analysis engine comprises an open port check, a process check, a startup check, a system account check, a firewall and an intrusion detection system;

open port inspection: by scanning the open ports of the host, the ports which are possibly opened by viruses can be found, and all the open ports of the host are scanned from other hosts, so that the hidden ports on the host can be prevented;

process viewing: checking running processes, in particular checking software with processes with path and start parameters, if there is an unknown process or a process with suspicious parameters, there is a performance that may be a virus, and listing it as suspicious process;

initiating item checking: checking starting items of a computer, including services, planning tasks and the like, and if suspicious starting items exist, performing hidden expression by viruses through modifying system settings or adding illegal services and the like, and listing the suspicious starting items as suspicious starting items;

system account checking: checking account information of the system, particularly an administrator account and a guest account, and if an unknown account or abnormal account behavior exists, a backdoor which possibly is left by a malicious attacker exists, and the backdoor is listed as a suspicious account;

firewall and intrusion detection system: the firewall and the IDS can monitor and check the network connection condition of the computer, especially under the condition that no normal program is connected with the network, viruses can transmit data in the network to cause network traffic abnormality, whether the network abnormality caused by the viruses exists can be found by monitoring the network traffic, if unknown network connection or abnormal network traffic exists, the possibility that the viruses transmit data through a back door and the like exists, and therefore external attacks and transmission of malicious codes can be found and prevented.

7. The data analysis-based computer host operation anomaly screening system of claim 6, wherein: the system alerts the reminder: when detecting that a virus attack is possible, the system can automatically pop up a warning window, send a prompt to a user and inform the user how to take measures to repair and prevent.

8. The data analysis-based computer host operation anomaly screening system of claim 7, wherein: the sand box technology comprises the following steps: the method is used for running suspicious processes, suspicious starting items, suspicious accounts and abnormal network flow under the safety condition, observing the behavior characteristics of the suspicious processes, suspicious starting items, suspicious accounts and abnormal network flow to judge whether viruses exist or not, and feeding back the positions and information of the viruses to the central control module if the viruses exist.

9. The system for screening for anomalies in operation of a host computer based on data analysis of claim 1, wherein: the data acquisition module and the alarm module are both connected with the central control module, and the data acquisition module is used for carrying out data acquisition and storage on the data information detected and collected by the hardware monitoring module and the software monitoring module.

10. The data analysis-based computer host operation anomaly screening system of claim 9, wherein: the alarm module comprises a wireless signal transmission unit and is used for transmitting alarm information and acquired data to a remote mobile terminal through wireless signals to remind a user of virus invasion of a computer.