Anomaly detection method, computer storage medium and program product

Abstract

The embodiment of the invention provides an anomaly detection method, a computer storage medium and a program product. The method comprises the steps: obtaining a field value of a to-be-detected target field from a to-be-detected log, extracting the key information of the field value, and obtaining a fingerprint of the to-be-detected log; inquiring whether the fingerprint of the to-be-detected log corresponds to the abnormal operation or not according to a preset corresponding relation between the fingerprint and the abnormal operation, wherein the corresponding relation is obtained according to a result obtained by conducting abnormal operation detection on the field in the historical log and the fingerprint in the historical log; and determining whether to perform abnormal operation detection on the to-be-detected log or not according to a query result. According to the scheme provided by the embodiment of the invention, preliminary abnormal operation detection can be realized through the key information extraction operation and the query operation, and the complexity of the two operations is o (1) so that the resource consumed in the detection process is less.

Description

technical field [0001] The embodiments of the present application relate to the technical field of data security, and in particular to an anomaly detection method, a computer storage medium, and a program product. Background technique [0002] In data security scenarios, the more commonly used method is feature matching, such as matching regular expressions with feature databases, string matching, and other operations. However, the above method consumes a lot of processing resources. For example, a match may involve hundreds of regular expressions, resulting in a sudden increase in CPU resources occupied. [0003] In addition, as the rules for judging data security continue to increase, the content that needs to be matched continues to increase. For example, the number of regular expressions involved in the matching process continues to increase, resulting in an increase in the resources required to detect data security. In view of this, the technical problem that needs to ...

AI Technical Summary

Problems solved by technology

However, the above method consumes a lot of processing resources. For example, a match may involve hundreds of regular expressions, resulting in a sudden increase in the occupied CPU resources.

[0003] In addition, as the rules for judging data security continue to increase, the content that needs to be matched continues to increase. For example, the number of regular expressions involved in the matching process continues to increase, resulting in an increase in the resources required to detect data security.

Images