Log correlation analysis method and device, storage medium and equipment

Abstract

The invention discloses a log correlation analysis method and device, a storage medium and equipment, and the method comprises the steps: obtaining a plurality of logs collected by a log source, and constructing a log set based on each log and the generation time of each log; according to the generation time of each log, dividing each log in the log set to obtain a plurality of item sets; eliminating redundant events in each item set to obtain each effective item set; inquiring events contained in each effective item set, obtaining all the occurred events, and constructing a first item set based on all the occurred events; performing frequent item set mining on the first item set to obtain a frequent item set; analyzing the frequent item set to obtain a plurality of subsets; for the confidence coefficient between any two subsets, if the confidence coefficient between any two subsets is greater than a preset confidence coefficient threshold value, determining that the events respectively contained in any two subsets have strong correlation. According to the scheme, the accuracy of log correlation analysis can be effectively improved.

Description

technical field [0001] The present application relates to the field of log event correlation analysis, and in particular to a log correlation analysis method, device, storage medium and equipment. Background technique [0002] With the development of modern Internet technology, enterprises may deploy various IT systems internally or externally. These systems generate a large number of logs every day. These logs include operating system logs, network behavior logs, application logs, and network infrastructure. Logs, security host logs, etc. The log data always records the activities of various IT devices, contains rich operation and maintenance and security knowledge, and is an important basis for fault root analysis and security event tracing in information security. [0003] Due to the huge amount of log data and its rapid growth over time, it will be very difficult to rely on manual analysis. With the development of big data technology, data storage capabilities are becomi...

AI Technical Summary

Problems solved by technology

However, event correlation analysis contains two problems: the first is that the item set segmentation method selected by event correlation analysis is to extract all the feature data of each log as an item set, resulting in a dense number of item sets and a decrease in the accuracy of event correlation analysis The second is that there is no classification and integration of similar feature data in the log information, and there is a lack of methods and devices for uniformly classifying similar events in the log into the same item

Therefore, the current log correlation analysis lacks flexibility, and can only conduct correlation analysis for specific situations, and cannot dynamically correct log event correlation, reducing the accuracy of analysis results

Images