Method and device for detecting abnormal log, medium and program product

Abstract

The invention relates to the technical field of network security, in particular to a method and equipment for detecting an abnormal log, a medium and a program product. The method comprises the following steps: aiming at a plurality of to-be-detected logs, based on a first action, operating a sliding window, and selecting a plurality of target logs from the plurality of logs by utilizing the operated sliding window; performing anomaly detection on the plurality of target logs based on a pre-constructed anomaly detection model; and if no abnormal log exists in the plurality of target logs, determining a second action for operating and using the sliding window next time based on the similarity among the plurality of target logs and the similarity between the plurality of target logs and other logs except the sliding window. By means of the method, the association between the logs can be analyzed, then the continuous abnormal logs can be detected, and high detection accuracy is obtained.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, medium and program product for detecting abnormal logs. Background Art

[0002] Log sequence anomaly detection refers to the process of identifying abnormal events that do not conform to normal behavior patterns in the log data generated by a large number of systems or applications. In the field of network security, these abnormal events may indicate that the system is being invaded, unauthorized access, cracking and other unexpected behaviors.

[0003] Traditional abnormal log detection methods require tedious steps such as data collection, normalization, and rule matching. Rule matching is to match log data with each rule in the rule base. If they match, it is determined that there are abnormal events in the log data. However, the method of detecting abnormal logs through the rule base is limited to the analysis of a single log, ignoring the correlation between logs, and unable to detect continuous abnormal logs. Summary of the invention

[0004] The embodiments of the present application provide a method, device, medium, and program product for detecting abnormal logs, which can analyze the association between logs and further detect continuous abnormal logs to obtain higher detection accuracy.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting abnormal logs, the method comprising:

[0006] For the multiple logs to be detected, based on the first action, operating the sliding window, and selecting multiple target logs from the multiple logs by using the operated sliding window;

[0007] Performing anomaly detection on the multiple target logs based on a pre-built anomaly detection model, wherein the anomaly detection model is trained based on multiple sample logs and sample anomaly logs among the multiple sample logs;

[0008] If there is no abnormal log in the multiple target logs, a second action for operating the sliding window next time is determined based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window.

[0009] In a possible implementation, determining the second action to be used for the next operation on the sliding window includes any one of the following:

[0010] If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, determining to move the sliding window;

[0011] If there are adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, it is determined to change the length of the sliding window.

[0012] In a possible implementation, if there are no adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, determining to move the sliding window includes any one of the following:

[0013] If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the left boundary of the sliding window and other logs to the left of the left boundary is greater than the preset similarity, determining to shift the sliding window left according to a first preset length;

[0014] If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the right boundary of the sliding window and other logs to the right of the right boundary is greater than the preset similarity, it is determined to shift the sliding window right according to the second preset length.

[0015] In a possible implementation, if there are adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, determining to transform the length of the sliding window includes any one of the following:

[0016] If there is an adjacent target log with a similarity greater than a preset similarity among the multiple target logs, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the left of the left boundary of the sliding window is greater than the preset similarity, then determining to extend the left boundary of the sliding window by a third preset length;

[0017] If there is an adjacent target log among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the right of the right boundary of the sliding window is greater than the preset similarity, then determining to extend the right boundary of the sliding window by a fourth preset length;

[0018] If there is an adjacent target log with a similarity greater than a preset similarity among the multiple target logs, and the adjacent target log is not adjacent to the other logs, it is determined to reduce the length of the sliding window according to a fifth preset length.

[0019] In a possible implementation manner, the multiple logs to be detected are obtained in the following manner:

[0020] Structural processing of multiple original logs obtained from the log audit system;

[0021] The error logs whose field meanings cannot be identified are filtered out from the multiple original logs after structured processing to obtain multiple logs to be detected.

[0022] In a possible implementation, after selecting a plurality of target logs from the plurality of logs using the operated sliding window and before performing anomaly detection on the plurality of target logs based on a pre-built anomaly detection model, the method further includes:

[0023] For any target log, extract key information in the any target log, and convert the key information into a feature vector;

[0024] Concatenate the feature vectors of each target log to obtain a concatenated feature vector;

[0025] The performing anomaly detection on the multiple target logs based on the pre-built anomaly detection model includes:

[0026] Inputting the concatenated feature vector into the anomaly detection model to obtain a result vector;

[0027] If the value of the element in the result vector indicating the existence of an abnormal log is greater than the values ​​of other elements in the result vector, it is determined that there is an abnormal log in the multiple target logs.

[0028] In a possible implementation, the method further includes:

[0029] Using a pre-built classification model, classify the abnormal logs in the logs to be detected based on the abnormality detection model to obtain the abnormality category and threat level corresponding to the abnormal log;

[0030] The classification model is obtained by training based on sample anomaly logs, as well as anomaly categories and threat levels of the sample anomaly logs.

[0031] In a second aspect, an embodiment of the present application provides a device for detecting abnormal logs, the device comprising:

[0032] A selection module, configured to operate the sliding window based on the first action for the plurality of logs to be detected, and select a plurality of target logs from the plurality of logs using the operated sliding window;

[0033] A detection module, configured to perform anomaly detection on the plurality of target logs based on a pre-built anomaly detection model, wherein the anomaly detection model is trained based on a plurality of sample logs and sample anomaly logs among the plurality of sample logs;

[0034] An action determination module is used to determine a second action to be used for the next operation on the sliding window based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window when there is no abnormal log in the multiple target logs.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0036] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method of the first aspect above.

[0037] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method in the above-mentioned first aspect.

[0038] In a fifth aspect, an embodiment of the present application provides a computer program product, which is used to enable a computer to execute the method in the first aspect above.

[0039] The method for detecting abnormal logs provided in the embodiment of the present application uses an anomaly detection model to perform anomaly detection on the target log in the sliding window. When no anomaly is found, the correlation between adjacent logs is analyzed to further determine the next action of the sliding window, so as to select a new target log for anomaly detection until the log to be detected is detected. This method breaks away from the constraints of a fixed rule base and can make full use of the temporal correlation between logs to further identify continuous abnormal logs. After the abnormal log is located, the abnormal log is passed to the classification model for secondary evaluation to infer the abnormal category and threat level. This method can more accurately identify different types of abnormal behaviors, reduce false positives and false negatives, and help security teams respond to high-risk events efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0041] Figure 1 A schematic diagram of a sliding window action applicable to an embodiment of the present application;

[0042] Figure 2A flowchart of a method for detecting abnormal logs provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of a first preprocessing process provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of a second preprocessing process provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of intelligent agent detection provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of a network structure provided for an embodiment of the present application;

[0047] Figure 7 Another schematic diagram of a network structure provided in an embodiment of the present application;

[0048] Figure 8 A schematic diagram of a classification process provided for an embodiment of the present application;

[0049] Fig. 9 A schematic diagram of the overall framework of a method for detecting abnormal logs provided in an embodiment of the present application;

[0050] Fig.10 A schematic diagram of the overall process of a method for detecting abnormal logs provided in an embodiment of the present application;

[0051] Fig.11 A schematic diagram of a device for detecting abnormal logs provided in an embodiment of the present application;

[0052] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0054] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can represent two situations: A and B are directly connected and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0055] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with the requirements of relevant national laws and regulations.

[0056] Some technical terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0057] Log: Data obtained from the log audit system. Logs are divided into normal logs and abnormal logs. Normal logs represent the device operation status recorded when the monitored device is not attacked, and abnormal logs represent the device operation status recorded when the monitored device is attacked. The attacks suffered by the monitored devices are network attacks, such as suspicious device intrusion, virus intrusion, monitored device buffer overflow, worm activity, brute force cracking, etc. The embodiments of this application do not specifically limit the intrusion type.

[0058] Anomaly detection model: The anomaly detection model can be a deep Q-network (Deep Q-Network, DQN), which can also be called a Q network. The embodiments of the present application do not specifically limit the type of anomaly detection network.

[0059] Sliding window: used to select a target log from multiple logs to be selected. The embodiment of the present application does not specifically limit the initial length of the sliding window.

[0060] Sliding window actions: The sliding window actions provided in the present application embodiment include 7 types. Figure 1As shown, white indicates multiple logs to be detected, gray indicates the sliding window, and black indicates the changes after the sliding window performs an action. For example, right shift is to move the entire sliding window to the right; left shift is to move the entire sliding window to the left; right bracket is to bracket the right boundary of the sliding window to the right, and the left boundary is fixed; left bracket is to bracket the left boundary of the sliding window to the left, and the right boundary is fixed; contraction is to shorten the length of the sliding window, and only the left boundary can be moved, or only the right boundary can be moved, or the left boundary and the right boundary can be moved at the same time, which is not specifically limited in the embodiments of the present application; jumping is to move the sliding window from the current position to another position, which is similar to left shift and right shift, but compared with jumping, the step length of left shift and right shift is shorter; triggering means that there are abnormal logs in the current sliding window, and no action is performed on the sliding window temporarily.

[0061] Target log: the log within the sliding window.

[0062] Other logs: logs outside the sliding window.

[0063] The method for detecting abnormal logs in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0064] In view of the problem that the association between logs is ignored in the current abnormal log detection method, resulting in inaccurate detection, the embodiment of the present application provides a method for detecting abnormal logs, such as Figure 2 As shown, the method includes:

[0065] S201: for a plurality of logs to be detected, based on a first action, operating a sliding window, and selecting a plurality of target logs from the plurality of logs using the operated sliding window.

[0066] In the embodiment of the present application, the multiple logs to be detected are obtained by first preprocessing the original logs obtained from the log audit system. The first preprocessing step is as follows: Figure 3 shown.

[0067] 1. Obtain the original log from the log audit system; the original log is irregular text data, and the original data includes multiple items, for example, 1,000 items.

[0068] 2. Structuring each piece of raw data; that is, arranging irregular text data into structured data. Structured data is also called row data, which is logically expressed and implemented by a two-dimensional table structure, strictly following the data format and length specifications. It is usually presented in the form of a table, tree structure or relational model. Structured data can be shown in Table 1 below.

[0069] Table 1

[0070] Field 1 Value 1 Field 2 Value 2 Field 3 Value 3 ... ... Field n Value n

[0071] 3. Filter out error logs whose field meanings cannot be identified from the multiple original logs after structured processing to obtain multiple logs to be tested. Since the log audit system usually contains basic events and unresolved events, unresolved events refer to logs whose field meanings cannot be fully identified. This part of the log usually has incomplete information extraction, so it is filtered out. Filter the original logs that have been structured to remove redundant information and ensure data consistency. It is also possible to first filter the multiple original logs obtained and then perform structured processing. The embodiment of the present application does not specifically limit the order of structured processing and filtering.

[0072] There may be multiple logs to be detected, for example, 900. When detecting 900 logs, the detection scheme of the embodiment of the present application is to first select a log segment (that is, multiple target logs) from the 900 logs through an adjustable sliding window. The initial selection can start from the first log, or it can be randomly selected. The embodiment of the present application does not make specific restrictions. Then, anomaly detection is performed on the log segment. Before performing anomaly detection, it is necessary to perform a second preprocessing on the multiple target logs in the log segment to facilitate anomaly detection. The steps of the second preprocessing are as follows: Figure 4 shown.

[0073] 1. For any target log, extract the key information from any target log.

[0074] First, the target log is segmented into several words through word segmentation tools such as Jieba and NLTK; then key information is extracted, such as source IP port, destination IP port, geographic location, etc. The embodiment of the present application does not specifically limit the category of key information.

[0075] 2. Convert the key information in any target log into a feature vector.

[0076] Use pre-trained word vector files and word vector matrices to vectorize key information, obtain specific vector representations of key information, and combine and output vector representations of text to facilitate machine learning model processing.

[0077] 3. Concatenate the feature vectors of each target log to obtain a concatenated feature vector. The dimension of the concatenated feature vector is determined by the number of target logs contained in the sliding window. For example, if the sliding window contains 6 target logs, the concatenated feature vector is a 6-dimensional feature vector.

[0078] Due to the differences between different key information, the obtained feature vectors may be different. Therefore, the feature vector corresponding to each target log is used as the input of TextCNN. After passing through the convolution layer, pooling layer and fully connected layer of TextCNN, a fixed-length feature vector, i.e., a concatenated feature vector, is directly output. The number of columns of the convolution kernel of TextCNN is the same as the number of columns of the word vector matrix to ensure that the anomaly detection model can correctly process the input data.

[0079] Data preprocessing can reduce the size of the data set, ensure the comparability and consistency of the data, and thus improve the reliability of the anomaly detection model. In order to make better decisions, the above raw data is subjected to the first preprocessing and the second preprocessing.

[0080] The above-mentioned step of vectorizing a single log may be performed before selecting a target log using a sliding window, and this embodiment of the present application does not specifically limit this.

[0081] S202: Perform anomaly detection on the multiple target logs based on a pre-built anomaly detection model.

[0082] The anomaly detection model in the embodiment of the present application is DQN, which is a deep reinforcement learning algorithm suitable for solving continuous control and decision-making problems, mainly optimizing strategies through the interaction between the agent and the environment. Figure 5 As shown, given the agent and the environment, the agent first observes the state of the current environment, and then performs an action, at which point the environment feeds back a reward to the agent. The goal of the agent is to maximize the cumulative reward it obtains. In an embodiment of the present application, the target log is the environmental state that the agent needs to observe, and the dynamic adjustment of the range of abnormal logs is used as the action, that is, the action of the sliding window, and then the reward function is designed according to the degree of overlap of the abnormal range. After the agent observes the target log within the sliding window range, it outputs an action to adjust the sliding window size or trigger an abnormality. The environment feeds back the reward obtained by the agent based on the indicator to guide the learning process of the agent. After multiple rounds of iterative training, the DQN reinforcement learning algorithm prompts the agent to extract the optimal strategy from historical data and accurately identify continuous log fragments.

[0083] The structure of DQN is as follows Figure 6As shown in the figure, the model receives vectorized logs through the time series pool to more effectively process the time series features between logs. First, the sliding window collects log fragments in the time series pool by adjusting the sliding window range, and then sends them to the 4096-dimensional fully connected layer. At the same time, a 28-dimensional vector is concatenated, which records the four historical actions performed by the agent. Each historical decision is represented by a 7-dimensional binary. The corresponding position of the action taken is set to 1, and the rest is 0. Then, it passes through three 1024-dimensional fully connected layers. Finally, the softmax classifier is used to classify the next action of the sliding window, such as Figure 1 The 7 types of actions shown. The training loss function uses mean square error loss and the optimizer is Adam.

[0084] In the embodiment of the present application, if the Q network directly outputs the Q value of each state-action pair, then all 7 state-action pairs need to be forwarded once, and the action with the largest Q value is found by comparison, which causes the amount of computation of the method to increase linearly with the number of actions. In order to solve the above-mentioned computational bottleneck, the Q network in the embodiment of the present application first outputs the Q value vector of all available actions in the current state at one time, then one-hot encodes the selected action, and performs a dot product operation with the Q value vector using this encoding vector, and finally obtains a single Q value scalar. This technique avoids redundant calculations and significantly reduces the time complexity of the algorithm. The specific Q network structure is shown in the attached figure. Figure 7 shown.

[0085] In multiple logs, abnormal logs may appear in any time period, so the primary task of detection is to locate the range of abnormal logs. In the embodiment of the present application, a mechanism for adaptively adjusting the current sliding window size is introduced, and reinforcement learning is used to allow the intelligent agent to learn dynamic adjustment strategies through the Q network to automatically adjust the position and size of the sliding window, with the goal of making the sliding window accurately cover the potential abnormal area.

[0086] The anomaly detection model is trained based on multiple sample logs and sample anomaly logs in the multiple sample logs. The sample logs also need to be subjected to the first preprocessing mentioned above on the original logs obtained. For example, after the first preprocessing, 1000 sample logs are obtained, and the range of the anomaly logs in the 1000 sample logs is marked to construct the training set and test set of the anomaly detection model.

[0087] The DQN training process can be implemented as follows:

[0088] Build a reinforcement learning environment and design a Q network to accurately extract log data features. Initialize the sliding window size and define the action as Figure 1The seven behaviors that can adjust the window interval and trigger anomalies are shown in the figure. The reward function is designed and the reward value r for each action is calculated. The new log data after the action is executed is used as the next state s'. The preprocessed training set is input into the algorithm to start learning how to choose the best action under a given state. DQN optimizes future choices by continuously observing the state, outputting actions, calculating reward values, and updating parameters. This process continues to iterate until the expected level is reached. The training of 1,000 sample logs is regarded as one round, and it is evaluated every 1,000 rounds until convergence. By changing the random seed used for model training, the model is trained multiple times and the best version is selected.

[0089] Combined with the original DQN algorithm, the complete algorithm pseudo code is given:

[0090] Combined with the original DQN algorithm, the complete algorithm pseudo code is given as follows:

[0091] Initialize training data set D, sequence pool B, sliding window ω , discount factor γ

[0092] Initialize network Q and parameters θ, target network Q' and parameters θ'

[0093] For episode=1,....,M do

[0094] For t=1,....,T do

[0095] Observe the log S in the sliding window from B for training

[0096] Randomly select an action with probability ε, and execute action a with probability 1-ε t = argmax a Q(s t ,a t ;θ)

[0097] Adjust the size of the sliding window ω, and then calculate the reward function based on the selected action, where

[0098] When selecting a trigger action:

[0099] When the jump action is selected:

[0100] When selecting other actions: r t (s,a)=max 1≤i≤n sign(IoU(ω',g)-IoU(ω,g))

[0101] calculate

[0102] Gradient descent is used to update the parameters θ of the initialized network Q, where the loss function is:

[0103] L=(y t -Q(s t ,a t ;θ)) 2

[0104] The update of the parameters of the target network Q is completed every C steps θ'←θ

[0105] End For

[0106] End For

[0107] Among them, the above r t Represents the current reward function, a t is the action currently executed by the sliding window; ω represents the position range of the current sliding window; g represents the log range with abnormalities; IoU represents the ratio of intersection to union. In the embodiment of the present application, IoU(ω,g)=span(ω∩g) / span(ω∪g). When IoU is greater than the preset threshold, a positive reward is given, otherwise a negative reward is given. Span represents the set of all linear combinations generated by a vector set; s t are multiple logs in the current sliding window; argmax means finding the parameter with the maximum score, and argmax in the embodiment of the present application means finding the action a with the maximum Q value t+1 ; a t+1 The next action to be performed by the sliding window; s t+1 Indicates the multiple logs obtained by the sliding window next time (that is, after executing action a t+1 Multiple logs inside the back).

[0108] Specifically, the Q network, target Q network and sliding window are initialized, and the preprocessed data is sent to the sequence pool. After observing the log data in the sliding window, the agent starts to select actions, where the actions are left shift, right shift, left expansion, right expansion, contraction, jump and trigger. The agent randomly selects actions with a probability of ∈ and selects the action with the largest Q value with a probability of 1-∈. This probability decreases linearly with the increase of training steps.

[0109] After executing the action, the position or size of the sliding window is updated, or an anomaly is marked. Then the agent calculates the reward value and obtains the next observation state through the designed reward function. The agent updates the Q network parameters using the gradient descent method and uses the mean square error loss for back propagation, where the loss function is:

[0110] Every few rounds, the parameters of the Q network are updated to the target Q network.

[0111] Among them, L is the loss function, r t represents the current reward function, γ is the discount coefficient, a t+1 represents the next action to be performed by the sliding window, Q' represents the Q value of the target Q network, and s t+1 represents the multiple logs obtained by the sliding window next time, θ' is the parameter of the target Q network, Q is the initialized Q network, θ is the parameter of the initialized Q network, s t are multiple logs in the current sliding window, a t The action currently executed by the sliding window.

[0112] After the anomaly detection model is trained through the above implementation method, it can be used to perform anomaly detection on multiple newly acquired logs to be detected. Specifically, the concatenated feature vectors of multiple target logs in the current sliding window are input into the anomaly detection model to obtain a result vector. If the value of the element in the result vector representing the existence of an abnormal log is greater than the value of other elements in the result vector, it is determined that there is an abnormal log in the multiple target logs.

[0113] For example, the result vector is [0.1, 0.1, 0.05, 0.05, 0.1, 0.1, 0.7], the 0th element is 0.1, the 1st element is 0.1, the 2nd element is 0.05, the 3rd element is 0.05, the 4th element is 0.1, the 5th element is 0.1, and the 6th element is 0.7. The 6th element is used to indicate whether there is an abnormal log, that is, it corresponds to Figure 1 In the trigger action, the sixth element is greater than other elements, indicating that there are abnormal logs in the current target log. After determining that there are abnormal logs in the current target log, the target log is marked, that is, the position of the target log in the multiple logs to be detected is marked, for example, "logs 3 to 6 are abnormal", to support the subsequent classification and threat level of the abnormal logs, and then take corresponding protection measures according to the category and threat level of the abnormal logs.

[0114] S203: If there is no abnormal log in the multiple target logs, determine a second action for operating the sliding window next time based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window.

[0115] In the field of network security, in the face of continuous attacks, logs also show coherent characteristics. Traditional methods are limited to the analysis of a single log, fail to make full use of the correlation information between logs, and cannot accurately detect abnormal logs. In order to solve this problem, the embodiment of the present application combines the anomaly detection model with the sliding window, which can capture the log context timing information while identifying abnormal features. Abnormal logs are generated when a device is attacked by a network. Continuous logs under the same network attack have similarities, such as the source IP port may be the same, so continuous abnormal logs can be obtained by analyzing the similarity between the logs.

[0116] S202 provides an implementation method for detecting the presence of abnormal logs in multiple target logs. However, when there are no abnormal logs in the multiple target logs, other logs need to be detected. At this time, an action needs to be performed on the sliding window so that the sliding window selects other logs. Specifically, the second action used for the next operation on the sliding window can be determined based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window.

[0117] When performing anomaly detection on multiple target logs, the anomaly detection model can not only identify anomaly features, but also further analyze the correlation between adjacent logs (that is, the degree of similarity) to predict the next action of the sliding window. After the next action is performed on the sliding window, the probability of detecting an abnormal log in the selected target log is higher. The second action includes any of the following:

[0118] (1) Move left.

[0119] When there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the left boundary of the sliding window and other logs to the left of the left boundary is greater than the preset similarity, it is determined to shift the sliding window left according to the first preset length.

[0120] If there are no similar logs in the multiple target logs, it indicates that the multiple target logs do not contain continuous abnormal logs, and the similarity between the target log located at the left boundary of the sliding window and other logs to the left of the left boundary is greater than the preset similarity, indicating that the target log located at the left boundary of the sliding window and other logs to the left of the left boundary may belong to the same attack log. In this case, the sliding window is shifted left, and the embodiment of the present application does not specifically limit the step size of the left shift.

[0121] The above-mentioned "similarity analysis between logs" can be performed by an anomaly detection model, and in specific implementation, a result vector is used to indicate the sliding window to perform an action. Similar to the result vector in S202 above, after the concatenated feature vectors corresponding to multiple target logs are input into the anomaly detection model, the anomaly detection model will output an intermediate result, that is, the result vector corresponding to the concatenated feature vector. The result vector is a 7-dimensional vector, and the 0 to 6 dimensions of the result vector correspond to left shift, right shift, left bracket, right bracket, contraction, jump and trigger, respectively. Triggering indicates that there are abnormal logs in multiple target logs. The embodiment of the present application does not specifically limit the actions represented by the elements of each dimension in the result vector.

[0122] For example, the result vector is [0.7, 0.1, 0.05, 0.05, 0.1, 0.1, 0.1], and the value of the element in the 0th dimension is the largest, so it is determined that the sliding window is shifted left by the first preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window is shifted left is high, and also indicating that the target log located at the left boundary of the sliding window is similar to other logs outside the left boundary, and may be logs generated under the same network attack.

[0123] (2) Move right.

[0124] If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the right boundary of the sliding window and other logs to the right of the right boundary is greater than the preset similarity, it is determined to shift the sliding window right according to the second preset length.

[0125] If there are no similar logs in the multiple target logs, it indicates that the multiple target logs do not contain continuous abnormal logs, and the similarity between the target log located at the right boundary of the sliding window and other logs to the right of the right boundary is greater than the preset similarity, indicating that the target log located at the right boundary of the sliding window and other logs to the right of the right boundary may belong to logs generated under the same attack. In this case, the sliding window is moved right, and the embodiment of the present application does not specifically limit the step size of the right shift.

[0126] The above-mentioned "similarity analysis between logs" can be performed through an anomaly detection model, and in specific implementation, a result vector is used to instruct the sliding window to perform an action. For example, if the result vector is [0.1, 0.7, 0.05, 0.05, 0.1, 0.1, 0.1], and the value of the element in the first dimension is the largest, it is determined that the sliding window is shifted right according to the second preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window is shifted right is high, and it also indicates that the target log located at the right boundary of the sliding window is similar to other logs outside the right boundary, and may be a log generated under the same network attack.

[0127] (3) Left bracket.

[0128] If there are adjacent target logs among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the left of the left boundary of the sliding window is greater than the preset similarity, then it is determined to extend the left boundary of the sliding window to the third preset length.

[0129] If there are similar adjacent logs in multiple target logs, it indicates that the multiple target logs may contain some continuous abnormal logs, and the adjacent target logs are similar to other logs to the left of the left boundary of the sliding window, indicating that the adjacent target logs and other logs to the left of the left boundary of the sliding window may belong to logs generated under the same attack (for example, two adjacent target logs on the left boundary of the sliding window and one other log on the left of the left boundary). At this time, the sliding window can be left-bracketed (similar adjacent target logs after left shift may not be in the sliding window), and the embodiment of the present application does not specifically limit the step size of the left bracket.

[0130] The above-mentioned "similarity analysis between logs" can be performed through an anomaly detection model, and in specific implementation, a result vector is used to instruct the sliding window to perform an action. For example, if the result vector is [0.1, 0.1, 0.7, 0.05, 0.1, 0.1, 0.1], and the value of the element in the second dimension is the largest, it is determined that the sliding window is left-bracketed according to the third preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window is left-bracketed is high, and it also indicates that the target log adjacent to the left boundary of the sliding window is similar to other logs outside the left boundary, and may be a log generated under the same network attack.

[0131] (4)Right bracket.

[0132] If there are adjacent target logs among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the right of the right border of the sliding window is greater than the preset similarity, then it is determined to extend the right border of the sliding window to the fourth preset length.

[0133] If there are similar adjacent logs in multiple target logs, it indicates that the multiple target logs may contain some continuous abnormal logs, and the adjacent target logs are similar to other logs to the right of the right boundary of the sliding window, indicating that the adjacent target logs and other logs to the right of the right boundary of the sliding window may belong to logs generated under the same attack (for example, two adjacent target logs on the right boundary of the sliding window and one other log on the right of the right boundary). At this time, the sliding window can be right-bracketed (the similar adjacent target logs after right shift may not be in the sliding window), and the embodiment of the present application does not specifically limit the step size of the right bracket.

[0134] The above-mentioned "similarity analysis between logs" can be performed through an anomaly detection model, and in specific implementation, a result vector is used to instruct the sliding window to perform an action. For example, if the result vector is [0.1, 0.1, 0.05, 0.7, 0.1, 0.1, 0.1], and the value of the element in the third dimension is the largest, then it is determined that the sliding window is right-bracketed according to the fourth preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window is right-bracketed is high, and also indicating that the target log adjacent to the right boundary of the sliding window is similar to other logs outside the right boundary, and may be a log generated under the same network attack.

[0135] (5) Contraction.

[0136] If there is an adjacent target log with a similarity greater than a preset similarity among the multiple target logs, and the adjacent target log is not adjacent to the other logs, it is determined to reduce the length of the sliding window according to a fifth preset length.

[0137] There are adjacent target logs among the multiple target logs whose similarity is greater than the preset similarity, and the adjacent target logs are not adjacent to the other logs, indicating that the similarity of the adjacent logs in the middle part of the multiple target logs in the sliding window is relatively high. No abnormality is detected, which may be because there are a large number of normal logs on both sides and the characteristics of the abnormal logs are not obvious. At this time, the sliding window needs to be shrunk, and the embodiment of the present application does not specifically limit the length of the shrinkage.

[0138] The above-mentioned "similarity analysis between logs" can be performed through an anomaly detection model, and in specific implementation, a result vector is used to instruct the sliding window to perform an action. For example, if the result vector is [0.1, 0.1, 0.05, 0.05, 0.7, 0.1, 0.1], and the value of the element in the fourth dimension is the largest, it is determined that the sliding window is shrunk according to the fifth preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window is shrunk is relatively high.

[0139] (6) Jump.

[0140] If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, the similarity between the target log at the left boundary of the sliding window and other logs to the left of the left boundary is less than the preset similarity, and the similarity between the target log at the right boundary of the sliding window and other logs to the right of the right boundary is less than the preset similarity. In other words, the multiple target logs in the sliding window are not similar to each other, and the multiple target logs are not similar to other surrounding logs. In this case, the sliding window needs to be jumped, and the embodiment of the present application does not specifically limit the jump length.

[0141] In addition to jumping, tentative actions can also be performed on the sliding window, that is, left shift, right shift, left bracket or right bracket can be performed. Since there are no similar adjacent target logs in multiple target logs and they will not exist after shrinking, the tentative action will not be shrinking.

[0142] The above-mentioned "similarity analysis between logs" can be performed through an anomaly detection model, and in specific implementation, a result vector is used to instruct the sliding window to perform an action. For example, if the result vector is [0.1, 0.1, 0.05, 0.05, 0.1, 0.7, 0.1], and the value of the element in the fifth dimension is the largest, it is determined that the sliding window will jump according to the sixth preset length, indicating that the probability of detecting an abnormal log in the new log selected after the sliding window jumps is high.

[0143] Specifically, the anomaly detection model can perform seven actions to adjust the time window. Among them, left shift, right shift, left expansion, right expansion and contraction are all regular changes to the time window; the jump action transfers the time window from the current position to other positions, thereby preventing the anomaly detection model from being trapped in the current position; the trigger action is used to terminate the search by discovering the abnormal range, and after determining that there are abnormal logs in the current sliding window, before the log to be detected has not completed the detection, it is necessary to select new logs through the sliding window for anomaly detection.

[0144] Furthermore, after obtaining the abnormal logs among the multiple logs to be detected, the categories and threat levels of the abnormal logs can be further analyzed, thereby providing a strong basis for subsequent security response measures.

[0145] Specifically, a pre-built classification model is used to classify the abnormal logs in the logs to be detected based on the anomaly detection model to obtain the abnormality categories and threat levels corresponding to the abnormal logs; wherein the classification model is based on sample abnormal logs, and the abnormality categories and threat levels of the sample abnormal logs are trained.

[0146] The classification model is trained with a large number of logs and can more accurately identify different types of abnormal behaviors, such as Figure 8 The intrusion, virus, buffer overflow, worm, brute force cracking, etc. shown in the above data can improve the accuracy of threat detection; the classification model can reduce false positives based on historical data and pattern recognition, while reducing the risk of underreporting due to human factors, ensuring that important threats are not ignored; the classification model can not only identify abnormal categories, but also assess the threat level according to the severity and potential impact of the abnormality, helping the security team to respond to high-risk events efficiently; the threat level can be divided into four levels: no risk, low risk, medium risk and high risk, which are not specifically limited in the embodiments of this application. The above classification model can be a vertical artificial intelligence large model, which is not specifically limited in the embodiments of this application.

[0147] The following is based on Fig. 9 and Fig.10 The process of a method for detecting abnormal logs provided in an embodiment of the present application is described in detail.

[0148] Fig. 9 An overall block diagram of a method for detecting abnormal logs provided in an embodiment of the present application. First, the sample log data obtained from the log audit system is preprocessed, and then the feature vector of the preprocessed log is input into the anomaly detection model to be trained. During the model training process, the feature vector is used as a learning environment, and actions are defined to dynamically adjust the sliding window, and the reward function is updated, and finally a trained anomaly detection model is obtained. The anomaly detection model is used to identify abnormal log fragments from multiple logs to be detected, for example, the abnormal logs are "2 to 5", "20 to 23", "126 to 127"; after obtaining the abnormal log, the abnormal log can be further input into the classification model to obtain the category and threat level of the abnormal log.

[0149] Fig.10 An overall flow chart of a method for detecting abnormal logs provided in an embodiment of the present application.

[0150] S1001: Acquire multiple logs to be tested from the log audit system;

[0151] S1002: Preprocessing the multiple logs to be detected; the preprocessing process is the same as the implementation method in S201 above, and will not be repeated here;

[0152] S1003: Input the pre-processed multiple logs into the pre-trained anomaly detection model;

[0153] S1004: Outputting abnormal logs from multiple logs from the abnormality detection model; the abnormality detection process is implemented as in S202 to S203 above, and will not be repeated here.

[0154] S1005: Determine the category and threat level of the abnormal log using the pre-trained classification model.

[0155] The embodiment of the present application adopts DQN reinforcement learning to identify the behavior patterns behind abnormal logs, which skips the process of security experts designing rule bases, and the detection performance is more comprehensive; moreover, the embodiment of the present application introduces a sliding window with adaptive resizing, continuously improves and optimizes strategies, gets rid of the constraints of fixed rule bases, and can make full use of the temporal correlation between logs, continuously discover new threats and attacks, and improve the level of network security; in addition, the embodiment of the present application designs a log sequence anomaly detection framework based on reinforcement learning. After the anomaly detection model completes the anomaly location, the abnormal logs within the range are passed to the classification model specializing in the security field for secondary evaluation. The classification model infers the anomaly category and threat level, which can more accurately identify different types of abnormal behaviors and reduce false alarm and omission rates.

[0156] Based on the same inventive concept, the embodiment of the present application also provides a device for detecting abnormal logs, such as Fig.11 As shown, the device comprises:

[0157] A selection module 1101 is used to operate the sliding window based on the first action for the multiple logs to be detected, and select multiple target logs from the multiple logs by using the operated sliding window;

[0158] A detection module 1102 is used to perform anomaly detection on the multiple target logs based on a pre-built anomaly detection model, where the anomaly detection model is trained based on multiple sample logs and sample anomaly logs in the multiple sample logs;

[0159] The action determination module 1103 is used to determine the second action to be used for the next operation on the sliding window based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window when there is no abnormal log in the multiple target logs.

[0160] In a possible implementation, the action determination module 1103 is used to:

[0161] When there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, determining to move the sliding window;

[0162] When there are adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, it is determined to change the length of the sliding window.

[0163] In a possible implementation, the action determination module 1103 is used to:

[0164] When there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the left boundary of the sliding window and other logs to the left of the left boundary is greater than the preset similarity, determining to shift the sliding window left according to a first preset length;

[0165] When there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the right boundary of the sliding window and other logs to the right of the right boundary is greater than the preset similarity, it is determined to shift the sliding window right according to the second preset length.

[0166] In a possible implementation, the action determination module 1103 is used to:

[0167] When there is an adjacent target log among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the left of the left boundary of the sliding window is greater than the preset similarity, determining to extend the left boundary of the sliding window by a third preset length;

[0168] When there is an adjacent target log among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the right of the right boundary of the sliding window is greater than the preset similarity, determining to extend the right boundary of the sliding window by a fourth preset length;

[0169] When there are adjacent target logs among the multiple target logs whose similarity is greater than a preset similarity, and the adjacent target log is not adjacent to the other logs, it is determined to reduce the length of the sliding window according to a fifth preset length.

[0170] In a possible implementation, the detection module 1102 is configured to obtain the multiple logs to be detected in the following manner:

[0171] Structural processing of multiple original logs obtained from the log audit system;

[0172] The error logs whose field meanings cannot be identified are filtered out from the multiple original logs after structured processing to obtain multiple logs to be detected.

[0173] In a possible implementation, the device further includes a preprocessing module, which is used to:

[0174] For any target log, extract key information in the any target log, and convert the key information into a feature vector;

[0175] Concatenate the feature vectors of each target log to obtain a concatenated feature vector;

[0176] The detection module 1102 is used to:

[0177] Inputting the concatenated feature vector into the anomaly detection model to obtain a result vector;

[0178] If the value of the element in the result vector indicating the existence of an abnormal log is greater than the values ​​of other elements in the result vector, it is determined that there is an abnormal log in the multiple target logs.

[0179] In a possible implementation, the device further includes a classification module, which is used to:

[0180] Using a pre-built classification model, classify the abnormal logs in the logs to be detected based on the abnormality detection model to obtain the abnormality category and threat level corresponding to the abnormal log;

[0181] The classification model is obtained by training based on sample anomaly logs, as well as anomaly categories and threat levels of the sample anomaly logs.

[0182] Based on the same inventive concept, the embodiment of the present application further provides an electronic device, the device is as follows: Fig.12 shown. Fig.12 The electronic device 120 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0183] like Fig.12 As shown, the electronic device 120 is in the form of a general electronic device. The components of the electronic device 120 may include but are not limited to: the at least one processor 121, the at least one memory 122, and a bus 123 connecting different system components (including the memory 122 and the processor 121).

[0184] The processor 121 is used to read and execute instructions in the memory 122, so that the at least one processor can execute a method for detecting abnormal logs provided in the above embodiment.

[0185] Bus 123 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0186] The memory 122 and the memory 1202 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1221 and / or a cache memory 1222 , and may further include a read-only memory (ROM) 1223 .

[0187] Memory 122 and memory 1202 may also include a program / utility 1225 having a set (at least one) of program modules 1224, such program modules 1224 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0188] The electronic device 120 may also communicate with one or more external devices 124 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable an administrator to interact with the electronic device 120, and / or communicate with any device that enables the electronic device 120 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 125. Furthermore, the electronic device 120 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 126. As shown, the network adapter 126 communicates with other modules for the electronic device 120 via a bus 123. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 120, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0189] In some possible implementations, various aspects of a method for detecting abnormal logs provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for detecting abnormal logs according to various exemplary implementations of the present application described above in this specification.

[0190] In addition, the present application also provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program is used to enable a computer to execute any of the methods described in the above embodiments.

[0191] These computer program instructions may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0193] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0194] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal logs, characterized in that: The method comprises: For the multiple logs to be detected, based on the first action, operating the sliding window, and selecting multiple target logs from the multiple logs by using the operated sliding window; Performing anomaly detection on the multiple target logs based on a pre-built anomaly detection model, wherein the anomaly detection model is trained based on multiple sample logs and sample anomaly logs among the multiple sample logs; If there is no abnormal log in the multiple target logs, a second action for operating the sliding window next time is determined based on the similarity between the multiple target logs and the similarity between the multiple target logs and other logs outside the sliding window.

2. The method according to claim 1, characterized in that The determining of the second action to be used for the next operation on the sliding window includes any one of the following: If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, determining to move the sliding window; If there are adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, it is determined to change the length of the sliding window.

3. The method according to claim 2, characterized in that If there are no adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, determining to move the sliding window includes any one of the following: If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the left boundary of the sliding window and other logs to the left of the left boundary is greater than the preset similarity, determining to shift the sliding window left according to a first preset length; If there are no adjacent target logs with a similarity greater than a preset similarity among the multiple target logs, and the similarity between the target log located at the right boundary of the sliding window and other logs to the right of the right boundary is greater than the preset similarity, it is determined to shift the sliding window right according to the second preset length.

4. The method according to claim 2, characterized in that: If there are adjacent target logs whose similarity is greater than a preset similarity among the multiple target logs, determining to change the length of the sliding window includes any one of the following: If there is an adjacent target log with a similarity greater than a preset similarity among the multiple target logs, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the left of the left boundary of the sliding window is greater than the preset similarity, then determining to extend the left boundary of the sliding window by a third preset length; If there is an adjacent target log among the multiple target logs whose similarity is greater than a preset similarity, the adjacent target log is adjacent to the other logs, and the similarity between the adjacent target log and other logs to the right of the right boundary of the sliding window is greater than the preset similarity, then determining to extend the right boundary of the sliding window by a fourth preset length; If there is an adjacent target log with a similarity greater than a preset similarity among the multiple target logs, and the adjacent target log is not adjacent to the other logs, it is determined to reduce the length of the sliding window according to a fifth preset length.

5. The method according to claim 1, characterized in that The multiple logs to be detected are obtained in the following manner: Structural processing of multiple original logs obtained from the log audit system; The error logs whose field meanings cannot be identified are filtered out from the multiple original logs after structured processing to obtain multiple logs to be detected.

6. The method according to claim 1, characterized in that After selecting a plurality of target logs from the plurality of logs by using the operated sliding window, and before performing anomaly detection on the plurality of target logs based on the pre-built anomaly detection model, the method further includes: For any target log, extract key information in the any target log, and convert the key information into a feature vector; Concatenate the feature vectors of each target log to obtain a concatenated feature vector; The performing anomaly detection on the multiple target logs based on the pre-built anomaly detection model includes: Inputting the concatenated feature vector into the anomaly detection model to obtain a result vector; If the value of the element in the result vector indicating the existence of an abnormal log is greater than the values ​​of other elements in the result vector, it is determined that there is an abnormal log in the multiple target logs.

7. The method according to claim 1, characterized in that The method further comprises: Using a pre-built classification model, classify the abnormal logs in the logs to be detected based on the abnormality detection model to obtain the abnormality category and threat level corresponding to the abnormal log; The classification model is obtained by training based on sample anomaly logs, as well as anomaly categories and threat levels of the sample anomaly logs.

8. An electronic device, characterized in that: The device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can execute any one of the methods of claims 1-7.

9. A computer storage medium, characterized in that The computer storage medium stores a computer program, and the computer program is used to make a computer execute any one of the methods according to claims 1-7.

10. A computer program product, characterized in that The computer program product is used to make a computer execute the method according to any one of claims 1 to 7.

Images