A storage method, system and computer device for abnormal rule information violated by logs

Abstract

The present invention proposes a storage method, system and computer device for log violation exception rule information, and the method and technology include defining an exception rule table; checking the log according to the exception rule table to generate the exception rule information violated by the log; encrypting the exception rule information; storing the encrypted exception rule information in the log; and also including the step of decrypting and reading the encrypted exception rule information. The present invention adopts sixty-binary encryption and binary inversion operation, occupies a small storage space, is accurate and efficient, has extremely high log protection security, and has good scalability, supports adding exception rules in the exception rule table, and has no effect on the previously stored exception rule violation information.

Description

Technical Field

[0001] The present invention belongs to the technical field of information storage, and in particular relates to a method, system and computer equipment for storing abnormal rule information violated by a log. Background Art

[0002] In the process of rule-based anti-fraud for abnormal traffic, one log may trigger multiple rules. A common customer requirement is to record the rules violated by each log and then decide how to handle the log based on the violated rules. Therefore, a mark needs to be added to the log to record which rule the log violates.

[0003] The existing technology classifies logs according to different rules and stores the logs that violate the same rule in different categories. The existing technology will cause a waste of storage space, and logs that violate multiple rules will be stored multiple times. Summary of the invention

[0004] The embodiments of the present application provide a method, system and computer device for storing information on exception rules violated by a log, so as to at least solve the problem of using less storage space to record in a log that the log violates different exception rules.

[0005] In a first aspect, an embodiment of the present application provides a method for storing abnormal rule information violated by a log, including:

[0006] S101. Define an exception rule table;

[0007] S102. Check the log according to the exception rule table to generate the exception rule information violated by the log;

[0008] S103. Encrypting the abnormal rule information;

[0009] S104. Store the encrypted abnormal rule information into the log.

[0010] Preferably, the step S101 comprises: listing the exception rules in order, with each rule occupying one binary bit; and when a new exception rule is added, adding the new exception rule to the end of the exception rule table.

[0011] Preferably, the step S102 includes: according to the abnormal rule table, using binary to mark the violation of the log abnormal rule in order, if the abnormal rule is violated, the binary bit is recorded as 1, if the abnormal rule is not violated, the binary bit is recorded as 0.

[0012] Preferably, the step S103 includes: inverting the binary number of the abnormal rule information and converting it into the first base.

[0013] Preferably, the first system is sixty-two system.

[0014] Preferably, it also includes:

[0015] S105. Decrypting the encrypted abnormal rule information;

[0016] The step S105 comprises: converting the first hexadecimal character into a binary digit, then reversing the binary digit, and if the number of bits of the binary digit is less than the number of all exception rules, adding a zeros to the right end of the binary digit, where a is the difference between the number of exception rules in the exception rule table and the number of bits of the binary digit.

[0017] In a second aspect, an embodiment of the present application provides a storage system for abnormal rule information violated by a log, which is applicable to the above-mentioned storage method for abnormal rule information violated by a log, including a definition unit, an information generation unit, an encryption unit and a storage unit, wherein:

[0018] Definition unit: define the exception rule table;

[0019] Information generating unit: generating the abnormal rule information violated by the log according to the abnormal rule table;

[0020] Encryption unit: encrypting the abnormal rule information;

[0021] Storage unit: stores the encrypted abnormal rule information into the log.

[0022] In some of the embodiments, the definition unit lists all exception rules in order, with each rule occupying one binary bit.

[0023] In some embodiments, the information generation unit uses binary to mark the violation of the log exception rule in sequence according to the exception rule table. If the exception rule is violated, the binary bit is recorded as 1, and if the exception rule is not violated, the binary bit is recorded as 0.

[0024] In some of the embodiments, the encryption unit inverts the binary number of the abnormal rule information and converts it into sixty-binary.

[0025] Preferably, it also includes a decryption unit, which decrypts and reads the encrypted exception rule information, including: converting the first hexadecimal character into a binary digit, then reversing the binary digit, and if the number of bits of the binary digit is less than the number of all exception rules, then adding a zeros to the right end of the binary digit, where a is the difference between the number of exception rules in the exception rule table and the number of bits of the binary digit.

[0026] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for storing abnormal rule information violated by a log as described in the first aspect above is implemented.

[0027] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for storing abnormal rule information violated by a log as described in the first aspect above.

[0028] Compared with the related art, the embodiment of the present application provides a method for storing abnormal rule information violated by a log:

[0029] 1. After conversion to sixty-binary, the length will be significantly shortened, that is, the number of characters will be reduced. The encrypted sixty-binary value should be put into the log, so the size of log storage can be reduced, and the reading speed of subsequent programs will be accelerated, which takes up less storage space and is accurate and efficient.

[0030] 2. The result after conversion to sixty-two binary is a random combination of numbers, lowercase letters and uppercase letters. The visual effect is similar to garbled code. The sixty-two binary information in the field can play a confidentiality role. If there is no exception rule table, it is impossible to reverse the situation that the log violates the exception rule. The customer's log protection security is extremely high, which can prevent non-related personnel from cracking to a certain extent;

[0031] 3. Including the step of reversing the binary number, the method proposed in the present application has good scalability, supports adding new exception rules to the exception rule table, and has no impact on the previously stored exception rule violation information.

[0032] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 It is a flow chart of a method for storing abnormal rule information violated by a log according to an embodiment of the present application;

[0035] Figure 2 A framework diagram of a storage system for abnormal rule information violated by a log in an embodiment of the present application;

[0036] Figure 3is a framework diagram of a computer device according to an embodiment of the present application;

[0037] In the above picture:

[0038] 11. Definition unit; 12. Information generation unit; 13. Encryption unit; 14. Storage unit; 15. Decryption unit; 21. Processor; 22. Memory; 23. Communication interface; 20. Bus. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0040] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0041] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0042] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices.

[0043] The so-called log refers to a collection of certain operations and their results of the objects specified by the system in time order. The operating system is designed with various log files, such as application logs, security logs, system logs, Scheduler service logs, FTP logs, WWW logs, DNS server logs, etc. These vary depending on the services enabled in your system. When we perform some operations on the system, these log files usually record some related content of our operations, which is very useful for system security personnel. For example, if someone performs an IPC probe on the system, the system will quickly record the IP, time, user name, etc. used by the prober in the security log. After using FTP to probe, the IP, time, user name used for the probe, etc. will be recorded in the FTP log. Each log file consists of log records, and each log record describes a separate system event. Usually, the system log is a text file that can be read directly by the user, which contains a timestamp and a message or other information specific to the subsystem.

[0044] See also Figure 1 , is a flow chart of a method for storing abnormal rule information violated by a log in an embodiment of the present application, comprising the following steps:

[0045] S101, define an exception rule table;

[0046] S102, checking the log according to the abnormal rule table, and generating abnormal rule information violated by the log;

[0047] S103, encrypting the abnormal rule information;

[0048] S104, storing the encrypted abnormal rule information in the log;

[0049] S105, decrypting and reading the encrypted abnormal rule information.

[0050] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] Among them, in S101, the step of defining the abnormal rule table includes listing the abnormal rules in order, and each rule occupies one binary bit.

[0052] In step S102, the log is checked according to the exception rule table, and the step of generating the exception rule information violated by the log includes marking the violation of the log exception rule in sequence using binary according to the exception rule table, if the exception rule is violated, the binary bit is recorded as 1, if the exception rule is not violated, the binary bit is recorded as 0.

[0053] In step S103, the step of encrypting the abnormal rule information includes: inverting the binary number of the abnormal rule information and converting it into a base other than binary. In this embodiment, it is converted into sixty-binary.

[0054] Here, the sexagenary system is further described. The sexagenary system is a commonly used system in the computer field, which consists of numbers, lowercase letters and uppercase letters. The advantages of using the sexagenary system for encryption in the embodiment of the present application are:

[0055] 1. After conversion to sixty-binary, the length will be significantly shortened, that is, the number of characters will be reduced. The encrypted sixty-binary value should be put into the log, so the size of log storage can be reduced and the reading speed of subsequent programs will be accelerated;

[0056] 2. The result after conversion to sixty-base is a random combination of numbers, lowercase letters and uppercase letters. The visual effect is similar to garbled code, which can prevent non-related personnel from cracking it to a certain extent;

[0057] In step S105, the step of decrypting and reading the encrypted exception rule information includes: converting the sixty binary characters into binary digits, then reversing the binary digits, and if the number of bits of the binary digits is less than the number of all exception rules, then adding a zeros to the right end of the binary digit, where a is the difference between the number of exception rules in the exception rule table and the number of bits of the binary digit.

[0058] The purpose of the above step S105 is to ensure that the binary sequence after decryption is the same as the binary sequence before decryption.

[0059] The following provides a specific embodiment 1 to further illustrate the present application.

[0060] First, define an exception rule table, which has four exception rules, namely, Y0, Y1, Y2, and Y3, and arrange them in this order; check the log in this embodiment according to the exception rule table, and if the three rules Y0, Y2, and Y3 are violated, and the exception rule Y1 is not violated, then the binary bit at the Y0 position is recorded as 1, the binary bit at the Y1 position is 0, the binary bit at the Y2 position is 1, and the binary bit at the Y3 position is 1. In summary, the exception rule information violated by the generated log is recorded as 1011; reverse the binary number of the exception rule information, and obtain the binary number of the reversed exception rule information as 1101, which is then converted into sixty-binary as d.

[0061] When the exception rule information needs to be read, the sixty-binary number must be decrypted first, and the sixty-binary character d must be converted into a binary number, which is 1101. Then the binary number is reversed, which is 1011, which is the same as the initial exception rule information. The number of bits of the binary number is equal to the number of all exception rules, so there is no need to perform a zero-filling operation.

[0062] The following provides a specific embodiment 2 to further illustrate the present application.

[0063] First, define an exception rule table, which has four exception rules, Y0, Y1, Y2, and Y3, and arrange them in this order; check the log in this embodiment according to the exception rule table, and if the two rules Y0 and Y2 are violated, and the exception rules Y1 and Y3 are not violated, then the binary bit at the Y0 position is recorded as 1, the binary bit at the Y1 position is 0, the binary bit at the Y2 position is 1, and the binary bit at the Y3 position is 0. In summary, the exception rule information violated by the generated log is recorded as 1010; reverse the binary number of the exception rule information, and obtain the binary number of the inverted exception rule information as 0101, and then convert it into sixty-binary as 5.

[0064] When the exception rule information needs to be read, the sixty-binary number must be decrypted first, and the sixty-binary character 5 must be converted into a binary number, which is 101. Then the binary number is reversed, which is 101. If the number of bits of the binary number is less than the number of all exception rules, a 0 is added to the right end of the binary number, which is 1010, which is the same as the initial exception rule information.

[0065] The following specific embodiment 3 is provided to further illustrate the present application, so as to illustrate the necessity of reversing the binary number in the encryption step.

[0066] First, define an exception rule table, with three exception rules, Y0, Y1, and Y2, arranged in this order; check the log in this embodiment according to the exception rule table, and if exception rule Y2 is violated, and exception rules Y0 and Y1 are not violated, then the exception rule information violated in the generated log is recorded as 001, and the binary number of the exception rule information is reversed to obtain the binary number 100 of the reversed exception rule information, which is then converted into sixty-binary as 4.

[0067] When the exception rule information needs to be read, the sixty-binary number must be decrypted first, and the sixty-binary character 4 must be converted into a binary number, which is 100. Then the binary number is reversed, which is 001. The number of bits of the binary number is equal to the number of all exception rules, so there is no need to perform a zero-filling operation.

[0068] At this time, an exception rule Y3 is added to the exception rule table. The log in this embodiment does not violate the exception rule Y3. At this time, the exception rule information violated by the generated log is recorded as 0010. The binary number of the exception rule information is reversed to obtain the reversed binary number 0100 of the exception rule information, which is then converted to 4 in sixty-binary. When the exception rule information needs to be read, the sixty-binary number must be decrypted first, and the sixty-binary character 4 must be converted to a binary number, which is 100. Then, the binary number is reversed to 001. The number of bits of the binary number is less than the number of all exception rules. Then, a 0 is added to the right end of the binary number to 0010, which is the same as the initial exception rule information.

[0069] On the contrary, if the encryption step in this embodiment does not include inverting the binary number, then before adding the exception rule Y3, the exception rule information is recorded as 001, which is directly converted into sixty-binary as 1, the sixty-binary number is decrypted, and the sixty-binary character 1 is converted into a binary number, which is 1, which is inconsistent with the initial exception rule information; after adding the exception rule Y3, the exception rule information is recorded as 0010, which is directly converted into sixty-binary as 2, and the sixty-binary character 2 is converted into a binary number, which is 10. At this time, the exception rule information is inconsistent with the information 0010 before encryption.

[0070] In summary, it is necessary to reverse the binary number during encryption to ensure scalability, support new rules, and have no impact on previously stored exception rule violation information.

[0071] The following provides a specific embodiment 4 to further illustrate the present application.

[0072] First, define an exception rule table, which has four exception rules, namely, Y0, Y1, Y2, and Y3, and arrange them in this order; check the log in this embodiment according to the exception rule table, and if the three rules Y0, Y2, and Y3 are violated, and the exception rule Y1 is not violated, then the binary bit at the Y0 position is recorded as 1, the binary bit at the Y1 position is 0, the binary bit at the Y2 position is 1, and the binary bit at the Y3 position is 1. In summary, the exception rule information violated by the generated log is recorded as 1011; reverse the binary number of the exception rule information, and obtain the binary number of the reversed exception rule information as 1101, which is then converted into sixty-binary as d.

[0073] When the exception rule information needs to be read, the sixty-binary number must be decrypted first, and the sixty-binary character d must be converted into a binary number, which is 1101. Then the binary number is reversed, which is 1011. The number of bits of the binary number is equal to the number of all exception rules, so there is no need to perform a zero-filling operation.

[0074] At this time, a new exception rule Y4 is added to the exception rule table of this embodiment. The log in this embodiment violates this rule. The exception rule information is recorded as 10111, which is t after encryption and 10111 after decryption, which is the same as the initial exception rule information.

[0075] The embodiment of the present application provides a storage system for abnormal rule information violated by a log, which is applicable to the above-mentioned storage method for abnormal rule information violated by a log. The description has been made and will not be repeated here. As used below, the terms "module", "unit", "subunit", etc. can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable. Figure 2 The framework diagram of the storage system of the abnormal rule information violated by the log in the embodiment of the present application includes a definition unit 11, an information generation unit 12, an encryption unit 13, a storage unit 14 and a decryption unit 15, wherein:

[0076] Definition unit: define the exception rule table;

[0077] Information generating unit: generating the abnormal rule information violated by the log according to the abnormal rule table;

[0078] Encryption unit: encrypting the abnormal rule information;

[0079] Storage unit: storing the encrypted abnormal rule information into the log;

[0080] Decryption unit: decrypts and reads the encrypted abnormal rule information.

[0081] It should be noted that the above-mentioned units can be functional units or program units, and can be implemented by software or hardware. For units implemented by hardware, the above-mentioned units can be located in the same processor; or the above-mentioned units can be located in different processors in any combination.

[0082] In addition, combined Figure 1 The method for storing abnormal rule information violated by a log described in the embodiment of the present application can be implemented by a computer device. Figure 3 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0083] The computer device may include a processor 21 and a memory 22 storing computer program instructions.

[0084] Specifically, the processor 21 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0085] Among them, the memory 22 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 22 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 22 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 22 may be inside or outside the data processing device. In a specific embodiment, the memory 22 is a non-volatile memory. In a specific embodiment, the memory 22 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory (FLASH), or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0086] The memory 22 may be used to store or cache various data files that need to be processed and / or used for communication, as well as possible computer program instructions executed by the processor 21 .

[0087] The processor 21 reads and executes the computer program instructions stored in the memory 22 to implement any one of the methods for storing the abnormal rule information violated by the log in the above embodiments.

[0088] In some embodiments, the computer device may further include a communication interface 23 and a bus 20. Figure 2 As shown, the processor 21, the memory 22, and the communication interface 23 are connected via a bus 20 and communicate with each other.

[0089] The communication port 23 can realize data communication with other components such as external devices, image / data acquisition devices, databases, external storage, and image / data processing workstations.

[0090] The bus 20 includes hardware, software or both, and couples the components of the electronic device to each other. The bus 20 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 20 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 20 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0091] The computer device can execute a method for storing abnormal rule information violated by a log in an embodiment of the present application.

[0092] In addition, in combination with a method for storing abnormal rule information violated by a log in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any method for storing abnormal rule information violated by a log in the above embodiment is implemented.

[0093] The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes.

[0094] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for storing abnormal rule information violated by a log, characterized in that: include: S101. Define an exception rule table; S102. Check the log according to the abnormal rule table to generate abnormal rule information violated by the log, wherein, according to the abnormal rule table, the violation of the log abnormal rule is marked in sequence using binary, if the abnormal rule is violated, the binary bit is recorded as 1, if the abnormal rule is not violated, the binary bit is recorded as 0; S103. Encrypting the abnormal rule information; S104. Store the encrypted abnormal rule information into the log.

2. The method for storing abnormal rule information violated by a log according to claim 1, characterized in that: The step S101 includes: listing the exception rules in order, with each rule occupying one binary bit; when adding an exception rule, adding the newly added exception rule to the end of the exception rule table.

3. The method for storing abnormal rule information violated by a log according to claim 2, characterized in that: The step S103 includes: inverting the binary number of the abnormal rule information and converting it into the first base.

4. The method for storing abnormal rule information violated by a log according to claim 3, characterized in that: The first system is sixty-two.

5. The method for storing abnormal rule information violated by a log according to claim 3, characterized in that: Also includes: S105. Decrypt and read the encrypted abnormal rule information; The step S105 comprises: converting the first hexadecimal character into a binary digit, then reversing the binary digit, and if the number of bits of the binary digit is less than the number of all exception rules, adding a zeros to the right end of the binary digit, where a is the difference between the number of exception rules in the exception rule table and the number of bits of the binary digit.

6. A storage system for abnormal rule information violated by logs, characterized in that: include: Definition unit: define the exception rule table; An information generating unit: generating the log violation exception rule information according to the exception rule table, wherein according to the exception rule table, the violation of the log exception rule is marked in sequence using binary, if the exception rule is violated, the binary bit is recorded as 1, if the exception rule is not violated, the binary bit is recorded as 0; Encryption unit: encrypting the abnormal rule information; Storage unit: stores the encrypted abnormal rule information into the log.

7. The storage system for abnormal rule information violated by logs according to claim 6, characterized in that: The encryption unit includes inverting the binary number of the abnormal rule information and converting it into the first base, and also includes a decryption unit. The decryption unit decrypts and reads the encrypted abnormal rule information, including: converting the first base character into a binary number, then inverting the binary number, if the number of bits of the binary number is less than the number of all abnormal rules, then adding a zeros to the right end of the binary number, where a is the difference between the number of abnormal rules in the abnormal rule table and the number of bits of the binary number.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for storing abnormal rule information violated by a log according to any one of claims 1 to 5 is implemented.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for storing abnormal rule information violated by a log according to any one of claims 1 to 5 is implemented.

Images