Log auditing method and platform

Abstract

The invention relates to a computer technology, and discloses a log auditing method and platform, which are used for log real-time auditing in cloud environment. The method comprises the following steps that an auditing platform respectively collects a corresponding system log from each kind of platform at a cloud end; the obtained system log is cached into a distributive asynchronous queue; when the condition that the preset triggering condition is met is determined, the system log conforming to the triggering condition is read from the distributive asynchronous queue; the auditing is performed on the system log on the basis of a rule model, wherein the rule model is generated after the machine learning training performed on the basis of the historical auditing data. Therefore compared with the single rule in the prior art, the rule model formed through data modeling on the basis of the historical auditing data has the advantages that the complicated auditing conditions can be better described; the system log generated due to complicated early warning events can be conveniently picked out, so that management personnel can conveniently and timely discover the condition and perform management.

Description

technical field [0001] This application relates to computer technology, in particular to a log audit method and platform. Background technique [0002] With the increasing application of new technologies such as cloud computing, mobile Internet, and virtualization, users are facing more and more security threats. Hosts, servers, network devices, security devices, databases, and various application service systems in the network will generate a large number of logs and events during the operation process. Faced with such a huge amount of information, managers cannot timely analyze the information due to lack of analysis methods. Accurately locate network faults and real security risks. [0003] In the traditional computer network environment, security vendors will integrate the collection, storage, analysis, alarm, archiving, reporting and other functions of log data in the cluster into a customized hardware device, and deploy the hardware device to the customer's computer c...

AI Technical Summary

Problems solved by technology

[0004] However, in the cloud computing environment, due to virtualization technology and network virtualization, traditional hardware boxes cannot be used to solve the log audit problem. Many cloud products run on complex platforms, and there will be a large number of calls between these products and each other. The operation generates a large number of logs and events, and it is necessary to audit the logs in real time in order to process various events in a timely manner. Therefore, the existing offline audit method is not suitable for the log audit requirements in the cloud environment.

[0005] However, in the existing cloud environment, there is currently no good technical solution to solve this problem.

Images