Cloud computing software log audit management system

Abstract

The invention belongs to the technical field of cloud computing, and discloses a cloud computing software log auditing management system, which comprises a log collection module, a log auditing module and a log auditing module, the data processing module is used for preprocessing the collected software log data to obtain effective log data, and performing unsupervised clustering on the effective log data according to similarity by adopting a clustering algorithm to obtain log clusters; the feature extraction module is used for performing feature extraction on the data in each log cluster to obtain log features; the intelligent analysis alarm module is used for performing prediction by taking the log features as the input of the log analysis model based on the constructed log analysis model, obtaining a danger score and performing alarm processing based on the danger score; and the software log management and security auditing capabilities of the system in the cloud computing environment are effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and more specifically, to a cloud computing software log audit management system. Background Art

[0002] The patent application with the publication number CN118568309A discloses a method for tracing the entire process of internal data circulation in an enterprise based on log auditing, including: obtaining internal log data; extracting and deleting the timestamp, level and component information of the log message to complete preprocessing; constructing a variable-length log parsing tree based on a tree framework, parsing the log data, and realizing preliminary identification of log templates and log parameters; setting an intra-group similarity threshold, if the intra-group similarity corresponding to the initially identified log template is lower than the threshold, the corresponding log group is re-parsed using hierarchical clustering; setting an inter-group similarity threshold, if the similarity between two log groups is higher than the threshold, the two log groups are merged; extracting log messages about the data flow direction and the timestamps corresponding to the log messages, and forming a directed traceability graph according to the data transmission direction; realizing fully automatic non-fixed-length log parsing on the basis of ensuring the accuracy; and ensuring that the data flow process is clear and visible by generating a directed traceability graph.

[0003] The existing log management system is applied in a distributed manner in a cloud computing environment. The amount of logs generated by different services and nodes is huge. Centralized log management is inefficient in processing log data of such a scale, and log data cannot be analyzed in real time, resulting in an inability to respond in time when security incidents occur, affecting the security of the system. At the same time, different industry regulations require that log data have high compliance, and the existing system lacks flexibility in compliance auditing.

[0004] In view of this, the present invention proposes a cloud computing software log audit management system to solve the above problems. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions: A cloud computing software log audit management system, comprising: a log collection module: collecting software log data from multiple nodes in a cloud computing environment;

[0006] Data processing module: pre-process the collected software log data to obtain valid log data, use clustering algorithm to perform unsupervised clustering of valid log data according to similarity, and obtain log clustering clusters;

[0007] Feature extraction module: extract features from the data in each log cluster to obtain log features;

[0008] Intelligent analysis and alarm module: Based on the constructed log analysis model, log features are used as the input of the log analysis model for prediction, the risk score is obtained, and alarm processing is performed based on the risk score.

[0009] Furthermore, the method of collecting software log data includes:

[0010] Deploy lightweight log agents on different nodes in the cloud computing environment and automatically collect log data through lightweight log agents.

[0011] Furthermore, the pre-processing method includes:

[0012] Punctuation marks and spaces in the collected software log data are removed to obtain text log data, and each word Ewo in the text log data is analyzed by machine word segmentation based on a preset machine dictionary to obtain word data, which includes: the total number of words in the text log data, the number of times Ewo appears in the text log data, and the total number of text log data containing Ewo;

[0013] Based on the word data, each word Ewo is counted to obtain the overall frequency corresponding to Ewo, and the overall frequency is sorted from large to small. The words with the top A overall frequency in each text log data are extracted as global popular words, and the number of occurrences of each word in the global popular words is counted to obtain the popular frequency of each word in the global popular words. Based on the preset frequency threshold, the global popular words with a popular frequency greater than or equal to the frequency threshold are used as detection words, and the detection words are weighted based on the popular frequency. The formula for weight calculation is: Among them, Wei b Represents the weight of the b-th detection word, Val b represents the mass frequency of the bth detection word, All represents the sum of the mass frequencies of all detection words, and b represents the index of the detection word;

[0014] The text log data is scored based on the weight of the detection word. The score calculation formula is: Among them, H i represents the score value of the i-th text log data, Size represents the total number of detected words, represents the overall frequency of the bth detection word in the i-th text log data, W b represents the bth detection word; preset score threshold TGrade; H i The software log data corresponding to the text log data of ≥TGrade is marked as abnormal data, and all software log data marked as abnormal data are removed from the collected software log data to obtain valid log data.

[0015] Furthermore, the formula for performing word statistics is: Among them, TD i，Ewo Represents the overall frequency of Ewo in the i-th text log data, Num i，Ewo Represents the number of times Ewo appears in the i-th text log data, Sum i represents the total number of words in the i-th text log data, N represents the total number of text log data, and M Ewo Represents the total number of text log data containing Ewo, and i represents the index of the text log data.

[0016] Furthermore, the method of performing unsupervised clustering includes:

[0017] The bag-of-words model is used to vectorize the effective log data to obtain the log vector. The regular parsing method is used to parse the effective log data to obtain the log call relationship. Based on the log vector and the log call relationship, the effective log data is used as the node of the graph. The similarity of the log vector is calculated using the Euclidean distance formula to obtain the vector similarity value. The vector similarity value is used as the edge weight to connect the nodes with the log call relationship to construct an undirected log graph.

[0018] Based on the constructed undirected log graph, each node in the undirected log graph is taken as a node cluster separately, and each node in the undirected log graph is calculated in area to obtain the node cluster value; based on the node cluster value, the undirected log graph is clustered, and the cluster merging method includes: trying to merge the jth node and the kth node in the undirected log graph by enumeration method to form a new node cluster, and performing incremental calculation on the formed new node cluster to obtain the cluster increment; when the cluster increment is a positive value, the jth node in the undirected log graph is merged into the kth node to form a new node cluster, and the sum of the node cluster value of the kth node in the undirected log graph and the cluster increment is used as the node cluster value of the new node cluster; when the cluster increment is a non-positive value, other nodes are tried to be merged into the kth node, and the process is repeated until the cluster increment calculated after no node is merged is positive, and the other nodes are nodes other than the jth node that have edges connected to the kth node;

[0019] The new node cluster is used as a new node, and the sum of the weights of all connected edges between node clusters is used as the weight of the new edges between nodes to form a node cluster undirected graph. The node cluster undirected graph is subjected to the cluster merging operation, and the operation is repeated until the node cluster undirected graph no longer changes; at this time, each node in the node cluster undirected graph is a log clustering cluster.

[0020] Furthermore, the formula for performing area calculation is:

[0021] Among them, Mod jrepresents the node cluster value of the jth node in the undirected log graph, m represents the total number of edges in the undirected log graph, Node represents the index set of nodes that have edges connected to the jth node in the undirected log graph, LW j，k Represents the weight of the edge between the jth node and the kth node in the undirected log graph, Sid j Represents the degree of the jth node in the undirected log graph, Sid k represents the degree of the kth node in the undirected log graph, f(j, k) represents the judgment function, j and k are the indexes of the nodes in the undirected log graph; the judgment logic of the judgment function is, based on the preset weight threshold, when the weight of the edge connecting the jth node and the kth node is greater than or equal to the weight threshold, the value of the judgment function is 1, when the weight of the edge connecting the jth node and the kth node is less than the weight threshold, the value of the judgment function is 0.

[0022] Furthermore, the formula for performing the incremental calculation is:

[0023] Among them, ΔMval j represents the cluster increment of the jth node moving to the kth node in the undirected log graph, Mod k represents the node cluster value of the k-th node in the undirected log graph, φ represents the number of edges inside the node cluster, SS represents the sum of the weights of the edges inside the node cluster, and SC represents the sum of the weights of all edges connected to the j-th node except the edge connected to the k-th node in the undirected log graph.

[0024] Furthermore, the method of performing feature extraction includes:

[0025] The text convolutional neural network is used to extract features from the data in the log clustering cluster to obtain log feature data. The log features include keywords, date and time, host IP and error codes.

[0026] Furthermore, the log analysis model is constructed in the following manner:

[0027] Collect historical log feature data and historical risk scores of group D. The historical log feature data includes: historical keywords, historical date and time, historical host IP or historical error code. Based on the historical log feature data and historical risk scores, the historical log feature data is used as the input of the log analysis model, the predicted risk score is used as the output of the log analysis model, and the historical risk score is used as the prediction target of the log analysis model for model training. The log analysis model is constructed. The log analysis model is a linear regression model, and the target loss function of the log analysis model is: Among them, MSE is the mean square error, Su is the total amount of historical log feature data, and F g The gth historical risk score, F'g is the g-th predicted risk score; minimizing the value of the target loss function is used as the training goal to obtain a log analysis model with the minimum value of the target loss function.

[0028] Furthermore, the method for performing alarm processing includes: presetting a risk score threshold, and triggering a risk alarm when the risk score is greater than or equal to the risk score threshold.

[0029] The technical effects and advantages of a cloud computing software log audit management system of the present invention are as follows:

[0030] The present invention collects software log data efficiently and in real time through a lightweight log agent; improves the validity of log data, reduces noise interference, and facilitates subsequent data analysis through preprocessing of log data; automatically identifies patterns and anomalies in log data through unsupervised clustering, ensures the accuracy and stability of clustering, and improves the system's processing ability for complex log data; provides a rich information basis for log analysis through feature extraction; and automatically triggers a danger alarm when a potential security risk is detected through model prediction. This mechanism can quickly respond to and handle potential security issues, thereby improving the security and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of a cloud computing software log audit management system of the present invention;

[0032] Figure 2 The present invention is a schematic diagram of a cloud computing software log audit management method. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] Example 1

[0035] See also Figure 1 As shown, a cloud computing software log audit management system described in this embodiment includes: a log collection module: collecting software log data from multiple nodes in a cloud computing environment;

[0036] Data processing module: pre-process the collected software log data to obtain valid log data, use clustering algorithm to perform unsupervised clustering of valid log data according to similarity, and obtain log clustering clusters;

[0037] Feature extraction module: extract features from the data in each log cluster to obtain log features;

[0038] Intelligent analysis and alarm module: Based on the constructed log analysis model, log features are used as the input of the log analysis model for prediction, the risk score is obtained, and alarm processing is performed based on the risk score.

[0039] The modules are connected to each other via wired and / or wireless means to achieve data transmission between modules.

[0040] Methods for collecting software log data include: deploying lightweight log agents on different nodes in a cloud computing environment and automatically collecting log data through lightweight log agents; lightweight log agents are tools for collecting, transmitting and processing log data, with low resource usage, high efficiency and simplicity. They are usually deployed on various servers, containers, applications or devices to collect log information generated by systems and applications in real time.

[0041] The collected software log data is preprocessed, and the preprocessing method includes: removing punctuation marks and spaces in the collected software log data to obtain text log data, and based on a preset machine dictionary, using a machine word segmentation method to perform word analysis on each word Ewo in the text log data to obtain word data, and the word data includes: the total number of words in the text log data, the number of times Ewo appears in the text log data, and the total number of text log data containing Ewo; the machine dictionary is a sufficiently large dictionary that contains all possible words, and the machine word segmentation method is a method of matching the character string to be analyzed with the entries in the machine dictionary according to a certain strategy. If a character string is found in the dictionary, the match is successful (i.e., a word is recognized).

[0042] Based on the word data, word statistics are performed on each word Ewo. The formula for word statistics is: Among them, TD i，Ewo Represents the overall frequency of Ewo in the i-th text log data, Num i，Ewo Represents the number of times Ewo appears in the i-th text log data, Sum i represents the total number of words in the i-th text log data, N represents the total number of text log data, and M Ewo Represents the total number of text log data containing the word Ewo, and i represents the index of the text log data.

[0043] Sort the words from large to small according to the overall frequency, extract the words with the top A overall frequency in each text log data as global popular words, count the number of times each word appears in the global popular words, obtain the popular frequency of each word in the global popular words, and based on the preset frequency threshold, use the global popular words with a popular frequency greater than or equal to the frequency threshold as detection words, and calculate the weight of the detection words based on the popular frequency. The formula for weight calculation is: Among them, Wei b Represents the weight of the b-th detection word, Val b Represents the mass frequency of the bth detection word, All represents the sum of the mass frequencies of all detection words, b represents the index of the detection word, the global mass word is a word that appears more frequently in the text log data, and the detection word is a word used to detect the difference of a single text log data in the overall text log data.

[0044] The text log data is scored based on the weight of the detection word. The score calculation formula is: Among them, H i represents the score value of the i-th text log data, Size represents the total number of detected words, represents the overall frequency of the bth detection word in the i-th text log data, W b represents the bth detection word; preset score threshold TGrade; H i The software log data corresponding to the text log data of ≥TGrade is marked as abnormal data, and all software log data marked as abnormal data are removed from the collected software log data to obtain valid log data.

[0045] The effective log data is clustered unsupervisedly, and the method of performing the unsupervised clustering includes: using a bag-of-words model to vectorize the effective log data to obtain log vectors, using a regular parsing method to perform log parsing on the effective log data to obtain log call relationships; based on the log vectors and the log call relationships, using the effective log data as nodes of the graph, similarity calculations are performed on the log vectors using a Euclidean distance formula to obtain vector similarity values, using the vector similarity values ​​as edge weights, edge connecting nodes with log call relationships, and constructing an undirected log graph; the regular parsing method is a method of matching text data using regular expressions, which is used to extract specific information from large texts, for example: the regular expression [AZ] represents matching all uppercase letters, and the matching results in the English text "ENGLISH english English" are "ENGLISH" and "E", and the log call relationship is the information of the source service and the target service in the effective log data.

[0046] Based on the constructed undirected log graph, each node in the undirected log graph is taken as a node cluster, and the area calculation is performed on each node in the undirected log graph. The formula for area calculation is: Among them, Mod j represents the node cluster value of the jth node in the undirected log graph, m represents the total number of edges in the undirected log graph, Node represents the index set of nodes that have edges connected to the jth node in the undirected log graph, LW k，k Represents the weight of the edge between the jth node and the kth node in the undirected log graph, Sid j Represents the degree of the j-th node in the undirected log graph (i.e., the total number of edges connected to the j-th node), Sid k represents the degree of the kth node in the undirected log graph, f(j, k) represents the judgment function, j and k are the indexes of the nodes in the undirected log graph; the judgment logic of the judgment function is, based on the preset weight threshold, when the weight of the edge connecting the jth node and the kth node is greater than or equal to the weight threshold, the value of the judgment function is 1, when the weight of the edge connecting the jth node and the kth node is less than the weight threshold, the value of the judgment function is 0.

[0047] The undirected log graph is clustered based on the node cluster value. The cluster merging method includes: trying to merge the jth node and the kth node in the undirected log graph by enumeration method to form a new node cluster, and performing incremental calculation on the formed new node cluster. The incremental calculation formula is: Among them, ΔMval j represents the cluster increment of the jth node moving to the kth node in the undirected log graph, Mod k represents the node cluster value of the k-th node in the undirected log graph, φ represents the number of edges inside the node cluster, SS represents the sum of the weights of the edges inside the node cluster, and SC represents the sum of the weights of all edges connected to the j-th node except the edge connected to the k-th node in the undirected log graph; when the cluster increment is a positive value, the j-th node in the undirected log graph is merged into the k-th node to form a new node cluster, and the sum of the node cluster value of the k-th node in the undirected log graph and the cluster increment is used as the node cluster value of the new node cluster; when the cluster increment is a non-positive value, try to merge other nodes into the k-th node, and repeat until the cluster increment calculated after no nodes are merged is a positive value, and the other nodes are nodes that have edges connected to the k-th node except the j-th node.

[0048] The new node cluster is used as a new node, and the sum of the weights of all connected edges between node clusters is used as the weight of the new edges between nodes to form a node cluster undirected graph. The node cluster undirected graph is subjected to the cluster merging operation, and the operation is repeated until the node cluster undirected graph no longer changes; at this time, each node in the node cluster undirected graph is a log clustering cluster.

[0049] The text convolutional neural network is used to extract features from the data in the log clustering cluster to obtain log feature data. The log features include keywords, date and time, host IP and error codes.

[0050] Collect historical log feature data and historical risk scores (based on manually assessed scores) of group D. The historical log feature data includes historical keywords, historical date and time, historical host IP or historical error code. Based on the historical log feature data and historical risk scores, the historical log feature data is used as the input of the log analysis model, the predicted risk score is used as the output of the log analysis model, and the historical risk score is used as the prediction target of the log analysis model for model training. The log analysis model is constructed. The log analysis model is a linear regression model, and the target loss function of the log analysis model is: Among them, MSE is the mean square error, Su is the total amount of historical log feature data, and F g The gth historical risk score, F' g is the g-th predicted risk score; minimizing the value of the target loss function is used as the training goal to obtain a log analysis model with the smallest value of the target loss function, and the historical log feature data and the log feature data are of the same type.

[0051] Based on the constructed log analysis model, log features are used as the input of the log analysis model for prediction, and a risk score is obtained. A risk score threshold is preset, and a risk alarm is triggered when the risk score is greater than or equal to the risk score threshold.

[0052] This embodiment uses a lightweight log agent to efficiently and in real time collect software log data; through preprocessing of log data, the validity of log data is improved, noise interference is reduced, and subsequent data analysis is facilitated; through unsupervised clustering, patterns and anomalies in log data are automatically identified to ensure the accuracy and stability of clustering and enhance the system's ability to process complex log data; through feature extraction, a rich information basis is provided for log analysis; through model prediction, when potential security risks are detected, the system can automatically trigger a danger alarm. This mechanism can quickly respond to and handle potential security issues and improve the security and reliability of the system.

[0053] Example 2

[0054] See also Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, and a cloud computing software log audit management method is provided, including:

[0055] S1, collects software log data from multiple nodes in the cloud computing environment;

[0056] S2. Preprocess the collected software log data to obtain valid log data, and use a clustering algorithm to perform unsupervised clustering on the valid log data based on similarity to obtain log clustering clusters;

[0057] S3, extracting features from the data in each log cluster to obtain log features;

[0058] S4. Based on the constructed log analysis model, the log features are used as the input of the log analysis model for prediction, the risk score is obtained, and the alarm processing is performed based on the risk score.

[0059] Example 3

[0060] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the operation mode of the cloud computing software log audit management method provided above is implemented.

[0061] Since the electronic device introduced in this embodiment is an electronic device used to implement a cloud computing software log audit management method in the embodiment of this application, based on the cloud computing software log audit management method introduced in the embodiment of this application, the technical personnel of this field can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application is not introduced in detail here. As long as the technical personnel of this field implement the electronic device used in the cloud computing software log audit management method in the embodiment of this application, it belongs to the scope of protection of this application.

[0062] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0063] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A cloud computing software log audit management system, characterized in that: include: Log collection module: collects software log data from multiple nodes in the cloud computing environment; Data processing module: pre-process the collected software log data to obtain valid log data, use clustering algorithm to perform unsupervised clustering of valid log data according to similarity, and obtain log clustering clusters; Feature extraction module: extract features from the data in each log cluster to obtain log features; Intelligent analysis and alarm module: Based on the constructed log analysis model, log features are used as the input of the log analysis model for prediction, the risk score is obtained, and alarm processing is performed based on the risk score.

2. A cloud computing software log audit management system according to claim 1, characterized in that: The method of collecting software log data includes: Deploy lightweight log agents on different nodes in the cloud computing environment and automatically collect log data through lightweight log agents.

3. A cloud computing software log audit management system according to claim 2, characterized in that: The method of pre-processing comprises: Punctuation marks and spaces in the collected software log data are removed to obtain text log data, and each word Ewo in the text log data is analyzed by machine word segmentation based on a preset machine dictionary to obtain word data, which includes: the total number of words in the text log data, the number of times Ewo appears in the text log data, and the total number of text log data containing Ewo; Based on the word data, each word Ewo is counted to obtain the overall frequency corresponding to Ewo, and the overall frequency is sorted from large to small. The words with the top A overall frequency in each text log data are extracted as global popular words, and the number of occurrences of each word in the global popular words is counted to obtain the popular frequency of each word in the global popular words. Based on the preset frequency threshold, the global popular words with a popular frequency greater than or equal to the frequency threshold are used as detection words, and the detection words are weighted based on the popular frequency. The formula for weight calculation is: Among them, Wei b Represents the weight of the b-th detection word, Val b represents the mass frequency of the bth detection word, All represents the sum of the mass frequencies of all detection words, and b represents the index of the detection word; The text log data is scored based on the weight of the detection word. The score calculation formula is: Among them, H i represents the score value of the i-th text log data, Size represents the total number of detected words, represents the overall frequency of the bth detection word in the i-th text log data, W b represents the bth detection word; preset score threshold TGrade; H i The software log data corresponding to the text log data of ≥TGrade is marked as abnormal data, and all software log data marked as abnormal data are removed from the collected software log data to obtain valid log data.

4. A cloud computing software log audit management system according to claim 3, characterized in that: The formula for word statistics is: Among them, TD i，Ewo Represents the overall frequency of Ewo in the i-th text log data, Num i，Ewo Represents the number of times Ewo appears in the i-th text log data, Sum i represents the total number of words in the i-th text log data, N represents the total number of text log data, and M Ewo Represents the total number of text log data containing Ewo, and i represents the index of the text log data.

5. A cloud computing software log audit management system according to claim 4, characterized in that: The method of performing unsupervised clustering includes: The bag-of-words model is used to vectorize the effective log data to obtain the log vector. The regular parsing method is used to parse the effective log data to obtain the log call relationship. Based on the log vector and the log call relationship, the effective log data is used as the node of the graph. The similarity of the log vector is calculated using the Euclidean distance formula to obtain the vector similarity value. The vector similarity value is used as the edge weight to connect the nodes with the log call relationship to construct an undirected log graph. Based on the constructed undirected log graph, each node in the undirected log graph is taken as a node cluster separately, and each node in the undirected log graph is calculated in area to obtain the node cluster value; based on the node cluster value, the undirected log graph is clustered, and the cluster merging method includes: trying to merge the jth node and the kth node in the undirected log graph by enumeration method to form a new node cluster, and performing incremental calculation on the formed new node cluster to obtain the cluster increment; when the cluster increment is a positive value, the jth node in the undirected log graph is merged into the kth node to form a new node cluster, and the sum of the node cluster value of the kth node in the undirected log graph and the cluster increment is used as the node cluster value of the new node cluster; when the cluster increment is a non-positive value, other nodes are tried to be merged into the kth node, and the process is repeated until the cluster increment calculated after no node is merged is positive, and the other nodes are nodes other than the jth node that have edges connected to the kth node; The new node cluster is used as a new node, and the sum of the weights of all connected edges between node clusters is used as the weight of the new edges between nodes to form a node cluster undirected graph. The node cluster undirected graph is subjected to the cluster merging operation, and the operation is repeated until the node cluster undirected graph no longer changes; at this time, each node in the node cluster undirected graph is a log clustering cluster.

6. A cloud computing software log audit management system according to claim 5, characterized in that: The formula for calculating the area is: Among them, Mod j represents the node cluster value of the jth node in the undirected log graph, m represents the total number of edges in the undirected log graph, Node represents the index set of nodes that have edges connected to the jth node in the undirected log graph, LW j，k Represents the weight of the edge between the jth node and the kth node in the undirected log graph, Sid j Represents the degree of the jth node in the undirected log graph, Sid k represents the degree of the kth node in the undirected log graph, f(j, k) represents the judgment function, j and k are the indexes of the nodes in the undirected log graph; the judgment logic of the judgment function is, based on the preset weight threshold, when the weight of the edge connecting the jth node and the kth node is greater than or equal to the weight threshold, the value of the judgment function is 1, when the weight of the edge connecting the jth node and the kth node is less than the weight threshold, the value of the judgment function is 0.

7. A cloud computing software log audit management system according to claim 6, characterized in that: The formula for calculating the increment is: Among them, ΔMval j represents the cluster increment of the jth node moving to the kth node in the undirected log graph, Mod k represents the node cluster value of the k-th node in the undirected log graph, φ represents the number of edges inside the node cluster, SS represents the sum of the weights of the edges inside the node cluster, and SC represents the sum of the weights of all edges connected to the j-th node except the edge connected to the k-th node in the undirected log graph.

8. A cloud computing software log audit management system according to claim 7, characterized in that: The method for extracting features includes: The text convolutional neural network is used to extract features from the data in the log clustering cluster to obtain log feature data. The log features include keywords, date and time, host IP and error codes.

9. A cloud computing software log audit management system according to claim 8, characterized in that: The log analysis model is constructed in the following manner: Collect historical log feature data and historical risk scores of group D. The historical log feature data includes: historical keywords, historical date and time, historical host IP or historical error code. Based on the historical log feature data and historical risk scores, the historical log feature data is used as the input of the log analysis model, the predicted risk score is used as the output of the log analysis model, and the historical risk score is used as the prediction target of the log analysis model for model training. The log analysis model is constructed. The log analysis model is a linear regression model, and the target loss function of the log analysis model is: Among them, MSE is the mean square error, Su is the total amount of historical log feature data, and F g The gth historical risk score, F' g is the g-th predicted risk score; minimizing the value of the target loss function is used as the training goal to obtain a log analysis model with the minimum value of the target loss function.

10. A cloud computing software log audit management system according to claim 9, characterized in that: The method for performing alarm processing includes: A risk score threshold is preset, and a risk alarm is triggered when the risk score is greater than or equal to the risk score threshold.

Images