A log reporting platform deployment method, device, equipment and medium

Abstract

The application discloses a log reporting platform deployment method, device, equipment and medium. The method comprises the following steps: in response to a platform instantiation instruction sent by a target server, identifying a target industry supervision domain to which the target server belongs; based on the target industry supervision domain, searching a target industry template matched in a pre-constructed industry platform template library; calling the target industry template to perform a platform instantiation operation, and generating a target log reporting platform matched with the target server. Through the technical scheme of the application, the log reporting platform deployment for different industry supervision domains can be realized, the deployment difficulty of the log reporting platform is reduced, the deployment efficiency of the log reporting platform is improved, and then the log reporting efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of data transmission, and in particular to a method, apparatus, device, and medium for deploying a log reporting platform. Background Technology

[0002] With the deepening of digital regulation in the financial industry, financial institutions are required to report business system log data to the corresponding regulatory agencies in real time or near real time. The current financial data reporting system is highly regulatory-driven, with significant differences in reporting standards, data models, interface protocols, and security requirements among various regulatory agencies. This heterogeneity in regulatory requirements across industries makes it difficult to directly reuse general data reporting platforms.

[0003] To achieve the goal of unified reporting across multiple industries, existing technologies mainly employ two platform deployment schemes. The first is the data factory model, which involves unified access to multi-source logs upstream, using industry-specific scripts to complete field mapping, format conversion, and compliance verification before distributing the data to various regulatory interfaces. The second is the SOAR platform model, which abstracts reporting tasks from different industries into process scripts, calling pre-packaged industry-specific processing flows through conditional routing. While these schemes can support multiple industries within a single platform instance, their deployment process still has significant drawbacks: platform instantiation requires loading a separate parsing engine, mapping rules, signature module, and reporting channel components for each industry, resulting in complex deployment and long initialization times; adding a new industry requires repeatedly developing an entire adapter and redeploying the platform instance, making it impossible to quickly reuse existing templates; multiple industry components share the underlying runtime environment, lacking an effective resource isolation mechanism, which easily leads to scheduling conflicts; and the monitoring and maintenance components after platform deployment are scattered, making fault location difficult.

[0004] In summary, existing log reporting platform deployment methods suffer from low deployment efficiency and complex deployment processes, which in turn lead to low log data reporting efficiency. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and medium for deploying a log reporting platform, which can solve the problems of low platform deployment efficiency and complex platform deployment process in existing log reporting platform deployment methods, resulting in low log data reporting efficiency.

[0006] In a first aspect, embodiments of the present invention provide a deployment method for a log reporting platform, the method comprising: In response to a platform instantiation command sent by the target server, the target industry regulatory domain to which the target server belongs is identified. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain, and insurance industry regulatory domain. Based on the target industry regulatory domain, a matching target industry template is retrieved from a pre-built industry-specific platform template library; The target industry template is invoked to perform platform instantiation operations, generating a target log reporting platform that matches the target server.

[0007] Secondly, embodiments of the present invention provide a deployment apparatus for a log reporting platform, the apparatus comprising: The target industry identification module is used to identify the target industry regulatory domain to which the target server belongs in response to the platform instantiation instruction sent by the target server. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain, and insurance industry regulatory domain. The template retrieval module is used to retrieve matching target industry templates from a pre-built industry-specific platform template library based on the target industry regulatory domain. The platform instantiation module is used to call the target industry template to perform platform instantiation operations and generate a target log reporting platform that matches the target server.

[0008] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to execute a deployment method for a log reporting platform according to any embodiment of the present invention.

[0009] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement a deployment method for a log reporting platform as described in any embodiment of the present invention.

[0010] The technical solution of this invention first responds to the platform instantiation instruction sent by the target server, identifies the target industry regulatory domain to which the target server belongs, then, based on the target industry regulatory domain, retrieves a matching target industry template from a pre-built industry-specific platform template library, and finally calls the target industry template to perform a platform instantiation operation to generate a target log reporting platform matching the target server. This solves the problems of low platform deployment efficiency and complex platform deployment processes in existing log reporting platform deployment methods, which lead to low log data reporting efficiency. It enables the deployment of log reporting platforms for different industry regulatory domains, reduces the deployment difficulty of log reporting platforms, improves the deployment efficiency of log reporting platforms, and thus improves log reporting efficiency.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a deployment method for a log reporting platform according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of a deployment method for a log reporting platform according to Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of a deployment device for a log reporting platform according to Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device that implements a deployment method for a log reporting platform according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, any variations of the terms "comprising" and "having" are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Example 1 Figure 1 This is a flowchart of a log reporting platform deployment method provided in Embodiment 1 of the present invention. This embodiment can be applied to the deployment of log reporting platforms in different industry regulatory domains. The method can be executed by a log reporting platform deployment device, which can be implemented in hardware and / or software. The log reporting platform deployment device can be configured in a terminal or server with log reporting platform deployment function.

[0017] like Figure 1 As shown, the method includes: S110. In response to the platform instantiation instruction sent by the target server, identify the target industry regulatory domain to which the target server belongs.

[0018] The target industry regulatory domain includes at least one of the following: the securities industry regulatory domain, the banking industry regulatory domain, and the insurance industry regulatory domain.

[0019] Furthermore, the securities industry regulatory domain covers licensed institutions such as securities companies, futures companies, and fund management companies; the banking industry regulatory domain covers commercial banks, policy banks, rural banks, and non-bank payment institutions; and the insurance industry regulatory domain covers life insurance companies, property insurance companies, insurance asset management companies, and related insurance intermediaries.

[0020] Specifically, identifying the target industry regulatory domain to which the target server belongs includes: parsing the access port identifier and data source type identifier of the target server, matching the access port identifier and the data source type identifier with a pre-set industry regulatory domain mapping table to determine the target industry regulatory domain; wherein, the data source type identifier includes at least one of log data format characteristics, log field structure characteristics, and log protocol type characteristics.

[0021] The industry regulatory domain mapping table is a structured data table used to establish a mapping relationship between network access characteristics and financial regulatory classifications. It is stored in the platform configuration database or distributed cache, and its table structure includes: access port range field, data source format characteristic field, SSL certificate subject field, and mapping target field.

[0022] Furthermore, the access port identifier is used to characterize the network access point information of the target server in the network security management platform, and for example, includes but is not limited to TCP port number, SSL certificate subject information, and Virtual Private Network (VPN) tunnel identifier; the data source type identifier is used to characterize the format characteristics of the raw log data collected and transmitted by the target server, including at least one of log data format characteristics, log field structure characteristics, and log protocol type characteristics; further, the log field structure characteristics for example include field naming conventions, field data types, and field nesting hierarchy; the log protocol type characteristics for example include Syslog protocol, SNMP Trap protocol, Kafka message queue protocol, HTTPS / RESTful API protocol, and dedicated agent reporting protocol.

[0023] S120. Based on the target industry regulatory domain, retrieve a matching target industry template from the pre-built industry-specific platform template library.

[0024] The industry-specific platform template library is a collection of templates pre-built based on the cybersecurity regulatory requirements of the financial industry. It is stored in the database of the platform configuration center or in the distributed configuration management component to enable rapid adaptation of differentiated processing logic for different regulatory domains.

[0025] Specifically, based on the target industry regulatory domain, a matching target industry template is retrieved from a pre-built industry-specific platform template library, including: if the target industry regulatory domain is the securities industry regulatory domain, then a first exclusive template is retrieved and invoked; if the target industry regulatory domain is the banking industry regulatory domain, then a second exclusive template is retrieved and invoked; if the target industry regulatory domain is the insurance industry regulatory domain, then a third exclusive template is retrieved and invoked.

[0026] In this embodiment, the first dedicated template, the second dedicated template, and the third dedicated template are all defined using structured description languages ​​such as JSON, YAML, or XML, and support hot reloading and version management.

[0027] Furthermore, the first dedicated template includes: first configuration metadata and first industry processing rules, the first industry processing rules including: first standard security event rules, transaction day judgment logic, automatic attack event reporting rules, and globally unique auto-incrementing flag generation logic; the second dedicated template includes: second configuration metadata and second industry processing rules, the second industry processing rules including: dual regulatory channel configuration, file format reporting processing logic, and financial basic data platform interface adaptation logic; the third dedicated template includes: third configuration metadata and third industry processing rules, the third industry processing rules including: interface specification adaptation logic, policy registration platform standard security event template, and reporting channel configuration.

[0028] Specifically, the first configuration metadata includes the securities industry regulatory reporting interface address, data encryption algorithm configuration, and certificate management strategy; the first standard security event rule is the security event rule corresponding to the target industry regulatory field. In this embodiment, the first standard security event rule can specifically be the "Guideline for Classification and Grading of Information Security Events in the Securities and Futures Industry," etc.; the trading day judgment logic is used to distinguish between securities market trading days and non-trading days to achieve differentiated event reporting timeliness requirements; the automatic attack event reporting rule is used to automatically trigger a supplementary reporting mechanism for historical related events when an Advanced Persistent Threat (APT) attack is detected; and the globally unique auto-incrementing flag generation logic generates a unique event identifier that meets regulatory requirements based on the Snowflake algorithm or database sequence.

[0029] Furthermore, in the second dedicated template, the second configuration metadata includes authentication information, data compression strategies, and transmission timeout thresholds for the dual reporting channels of the People's Bank of China and the State Financial Regulatory Commission; the second industry processing rules include dual regulatory channel configuration, file format reporting processing logic, and financial basic data platform interface adaptation logic; the dual regulatory channel configuration is used to simultaneously support parallel reporting to the People's Bank of China's financial basic data center and the State Financial Regulatory Commission's off-site supervision system; the file format reporting processing logic is used to support multi-format encapsulation such as ZIP encrypted compressed packages, XML messages, and PDF attachments that comply with financial industry regulatory requirements; the financial basic data platform interface adaptation logic is used to realize message format conversion, field mapping, and transmission protocol adaptation with the People's Bank of China's financial basic data platform.

[0030] Furthermore, in the third dedicated template, the third configuration metadata includes the policy registration platform interface address, an insurance industry-specific field dictionary, and data anonymization rules; the third industry processing rules include interface specification adaptation logic, a policy registration platform standard security event template, and reporting channel configuration; the interface specification adaptation logic is used to adapt to the policy registration platform interface specification; the policy registration platform standard security event template is used to pre-set security event field templates that meet the regulatory requirements of the insurance industry, such as insurance-specific fields including the scope of policy business impact and the number of customer information leaks; the reporting channel configuration is used to support automatic switching between primary and backup channels, breakpoint resumption, and real-time monitoring of transmission status.

[0031] S130. Call the target industry template to perform platform instantiation operation and generate a target log reporting platform that matches the target server.

[0032] The technical solution of this invention first responds to the platform instantiation instruction sent by the target server, identifies the target industry regulatory domain to which the target server belongs, then, based on the target industry regulatory domain, retrieves a matching target industry template from a pre-built industry-specific platform template library, and finally calls the target industry template to perform a platform instantiation operation to generate a target log reporting platform matching the target server. This enables the deployment of log reporting platforms for different industry regulatory domains, reduces the deployment difficulty of log reporting platforms, improves the deployment efficiency of log reporting platforms, and thus improves the log reporting efficiency.

[0033] Example 2 Figure 2 This is a flowchart of a deployment method for a log reporting platform provided in Embodiment 2 of the present invention. This embodiment is a refinement based on the above embodiment. In this embodiment, the method of calling the target industry template to perform platform instantiation operation and generating a target log reporting platform that matches the target server is specifically refined.

[0034] like Figure 2 As shown, the method includes: S210. In response to the platform instantiation instruction sent by the target server, identify the target industry regulatory domain to which the target server belongs.

[0035] The target industry regulatory domain includes at least one of the following: the securities industry regulatory domain, the banking industry regulatory domain, and the insurance industry regulatory domain.

[0036] S220. Based on the target industry regulatory domain, retrieve a matching target industry template from the pre-built industry-specific platform template library.

[0037] The target industry templates include: a first exclusive template, a second exclusive template, or a third exclusive template.

[0038] S230. Parse the first exclusive template, the second exclusive template, or the third exclusive template to obtain the corresponding configuration metadata and industry processing rules.

[0039] The configuration metadata includes: industry identification information, regulatory interface specification version information, component dependency information, and data flow definition information that are matched with the regulatory domains of each target industry.

[0040] S240. Initialize the target server environment based on the configuration metadata to obtain the platform runtime environment.

[0041] The process of initializing the target server environment based on the configuration metadata to obtain the platform runtime environment includes: loading a parsing engine, a verification engine, and a reporting engine that match the target industry regulatory domain according to the industry identification information and the regulatory interface specification version information; instantiating a reporting channel component, a storage component, and a monitoring component corresponding to the target industry regulatory domain according to the component dependency information; and configuring the data flow path between the parsing engine, the verification engine, the reporting engine, the reporting channel component, the storage component, and the monitoring component according to the data flow definition information.

[0042] Specifically, the parsing engine is used to perform format recognition and structured extraction on the raw log data accessed by the target server; the verification engine is used to perform compliance verification on the parsed structured data, including, for example, field integrity verification, data type verification, and business rule verification; the reporting engine is used to encapsulate and transmit the verified data according to regulatory requirements; further, the reporting channel component is used to establish a network connection with the regulatory agency platform; the storage component is used to persistently store the raw logs, parsing results, and reporting records; and the monitoring component is used to collect platform operating status indicators in real time, including, for example, CPU / memory usage monitoring, data throughput monitoring, reporting success rate monitoring, and anomaly alarm monitoring.

[0043] In this embodiment, the configuration of the data flow path includes: defining the input / output interface contract between each component, configuring the data buffer queue, setting the flow control strategy, and configuring the failover mechanism.

[0044] Those skilled in the art should understand that initializing the target server's environment to obtain the corresponding platform runtime environment under the premise of known configuration metadata is a mature existing technology. This embodiment only introduces the method, without going into detail about its specific steps and principles.

[0045] S250. Establish a data flow link between the platform runtime environment and the industry processing rules in order to deploy the target log reporting platform.

[0046] The data flow link refers to dynamically binding various functional components in the platform runtime environment with industry processing rules to form an executable log processing pipeline.

[0047] Specifically, establishing the data flow path includes: loading the first industry processing rule, the second industry processing rule, or the third industry processing rule into the rule engine of the platform runtime environment, enabling the verification engine to classify events according to the security event classification standards of the corresponding industry; injecting the transaction day judgment logic, dual supervision channel configuration, or interface specification adaptation logic into the reporting engine, enabling the reporting engine to execute industry-specific business logic; and configuring the automatic attack event reporting rule, file format reporting processing logic, or standard security event template of the policy registration platform as processing nodes in the data flow path, so that log data triggers the corresponding processing logic when passing through the node.

[0048] Furthermore, the deployment process includes: starting the service instances of the parsing engine, verification engine, and reporting engine; initializing the network connection pool of the reporting channel component; mounting the data persistence volume of the storage component; and activating the data collection probe of the monitoring component. For example, when the target industry regulatory domain is the securities industry regulatory domain, the platform will deploy a log reporting instance that supports transaction day judgment and automatic supplementary reporting logic; when the target industry regulatory domain is the banking industry regulatory domain, the platform will deploy a log reporting instance that supports dual-channel parallel reporting and multi-format encapsulation; when the target industry regulatory domain is the insurance industry regulatory domain, the platform will deploy a log reporting instance that supports policy registration platform interface adaptation and data anonymization. At this point, the industry-specific deployment of the target log reporting platform is complete, and the target log reporting platform can begin receiving and processing log data reporting requests from the target server.

[0049] Those skilled in the art should understand that deploying the platform runtime environment to obtain the platform operation is a mature existing technology. This embodiment only introduces the method, without going into detail about the specific steps and principles.

[0050] The technical solution of this invention first responds to the platform instantiation command sent by the target server, identifies the target industry regulatory domain to which the target server belongs, then, based on the target industry regulatory domain, retrieves a matching target industry template from a pre-built industry-specific platform template library, then parses the first, second, or third exclusive template to obtain the corresponding configuration metadata and industry processing rules, and initializes the target server environment based on the configuration metadata to obtain the platform runtime environment, and finally establishes a data flow link between the platform runtime environment and the industry processing rules to deploy the target log reporting platform. This achieves the deployment of log reporting platforms for different industry regulatory domains, reduces the deployment difficulty of the log reporting platform, improves the deployment efficiency of the log reporting platform, and thus improves the log reporting efficiency.

[0051] Example 3 Figure 3 This is a schematic diagram of the deployment device for a log reporting platform provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: The target industry identification module 310 is used to identify the target industry regulatory domain to which the target server belongs in response to the platform instantiation instruction sent by the target server. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain and insurance industry regulatory domain. The template retrieval module 320 is used to retrieve matching target industry templates from a pre-built industry-specific platform template library based on the target industry regulatory domain. The platform instantiation module 330 is used to call the target industry template to perform platform instantiation operations and generate a target log reporting platform that matches the target server.

[0052] The technical solution of this invention first responds to the platform instantiation instruction sent by the target server, identifies the target industry regulatory domain to which the target server belongs, then, based on the target industry regulatory domain, retrieves a matching target industry template from a pre-built industry-specific platform template library, and finally calls the target industry template to perform a platform instantiation operation to generate a target log reporting platform matching the target server. This enables the deployment of log reporting platforms for different industry regulatory domains, reduces the deployment difficulty of log reporting platforms, improves the deployment efficiency of log reporting platforms, and thus improves the log reporting efficiency.

[0053] Based on the above embodiments, the target industry identification module 310 is specifically used to: parse the access port identifier and data source type identifier of the target server, match the access port identifier and the data source type identifier with a preset industry regulatory domain mapping table, and determine the target industry regulatory domain; wherein, the data source type identifier includes at least one of log data format characteristics, log field structure characteristics, and log protocol type characteristics.

[0054] Based on the above embodiments, the template retrieval module 320 includes: The first retrieval unit is used to retrieve and call the first exclusive template if the target industry regulatory domain is the securities industry regulatory domain. The second retrieval unit is used to retrieve and call the second exclusive template if the target industry regulatory domain is the banking regulatory domain. The third retrieval unit is used to retrieve and call the third dedicated template if the target industry regulatory domain is the insurance industry regulatory domain.

[0055] Based on the above embodiments, the platform instantiation module 330 includes: The template parsing unit is used to parse the first exclusive template, the second exclusive template, or the third exclusive template to obtain the corresponding configuration metadata and industry processing rules. An environment initialization unit is used to initialize the target server's environment based on the configuration metadata to obtain the platform runtime environment. The link establishment unit is used to establish a data flow link between the platform runtime environment and the industry processing rules in order to deploy the target log reporting platform.

[0056] Based on the above embodiments, the environment initialization unit includes: The engine loading unit is used to load a parsing engine, a verification engine, and a reporting engine that match the target industry regulatory domain, based on the industry identification information and the regulatory interface specification version information. The component loading unit is used to instantiate the reporting channel component, storage component, and monitoring component corresponding to the target industry regulatory domain according to the component dependency information. The path configuration unit is used to configure the data flow path between the parsing engine, the verification engine, the reporting engine, the reporting channel component, the storage component, and the monitoring component according to the data flow direction definition information.

[0057] The log reporting platform deployment device provided in this embodiment of the invention can execute the log reporting platform deployment method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0058] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0059] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0060] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0061] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a method for deploying a log reporting platform.

[0062] Accordingly, the method includes: In response to a platform instantiation command sent by the target server, the target industry regulatory domain to which the target server belongs is identified. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain, and insurance industry regulatory domain. Based on the target industry regulatory domain, a matching target industry template is retrieved from a pre-built industry-specific platform template library; The target industry template is invoked to perform platform instantiation operations, generating a target log reporting platform that matches the target server.

[0063] In some embodiments, a method for deploying a log reporting platform can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for deploying a log reporting platform described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform a method for deploying a log reporting platform by any other suitable means (e.g., by means of firmware).

[0064] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0065] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0066] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0067] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0068] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0069] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0070] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

Claims

1. A deployment method for a log reporting platform, characterized in that, include: In response to a platform instantiation command sent by the target server, the target industry regulatory domain to which the target server belongs is identified. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain, and insurance industry regulatory domain. Based on the target industry regulatory domain, a matching target industry template is retrieved from a pre-built industry-specific platform template library; The target industry template is invoked to perform platform instantiation operations, generating a target log reporting platform that matches the target server.

2. The method according to claim 1, characterized in that, Identifying the target industry regulatory domain to which the target server belongs includes: The access port identifier and data source type identifier of the target server are parsed, and the access port identifier and data source type identifier are matched with a preset industry regulatory domain mapping table to determine the target industry regulatory domain; The data source type identifier includes at least one of log data format characteristics, log field structure characteristics, and log protocol type characteristics.

3. The method according to claim 1, characterized in that, Based on the target industry regulatory domain, a matching target industry template is retrieved from a pre-built industry-specific platform template library, including: If the target industry regulatory domain is the securities industry regulatory domain, then the first exclusive template is retrieved and invoked; If the target industry regulatory domain is the banking regulatory domain, then the second exclusive template is retrieved and invoked; If the target industry regulatory domain is the insurance industry regulatory domain, then the third exclusive template will be retrieved and invoked.

4. The method according to claim 3, characterized in that, The first dedicated template includes: first configuration metadata and first industry processing rules. The first industry processing rules include: first standard security event rules, transaction day judgment logic, automatic attack event reporting rules, and globally unique auto-incrementing flag generation logic. The second exclusive template includes: second configuration metadata and second industry processing rules. The second industry processing rules include: dual regulatory channel configuration, file format reporting processing logic, and financial basic data platform interface adaptation logic. The third exclusive template includes: third configuration metadata and third industry processing rules. The third industry processing rules include: interface specification adaptation logic, standard security event template for the policy registration platform, and reporting channel configuration.

5. The method according to any one of claims 1-4, characterized in that, The platform instantiation operation is performed by calling the target industry template to generate a target log reporting platform that matches the target server, including: Parse the first exclusive template, the second exclusive template, or the third exclusive template to obtain the corresponding configuration metadata and industry processing rules; Based on the configuration metadata, the target server is initialized to obtain the platform runtime environment; Establish a data flow link between the platform runtime environment and the industry processing rules in order to deploy the target log reporting platform.

6. The method according to claim 5, characterized in that, The configuration metadata includes: industry identification information, regulatory interface specification version information, component dependency information, and data flow definition information that are matched with the regulatory domains of each target industry.

7. The method according to claim 5, characterized in that, Based on the configuration metadata, the target server is initialized to obtain the platform runtime environment, including: Based on the industry identification information and the regulatory interface specification version information, load the parsing engine, verification engine and reporting engine that match the target industry regulatory domain; Based on the component dependency information, instantiate the reporting channel component, storage component, and monitoring component corresponding to the target industry regulatory domain; Based on the data flow definition information, configure the data flow path between the parsing engine, the verification engine, the reporting engine, the reporting channel component, the storage component, and the monitoring component.

8. A deployment device for a log reporting platform, characterized in that, include: The target industry identification module is used to identify the target industry regulatory domain to which the target server belongs in response to the platform instantiation instruction sent by the target server. The target industry regulatory domain includes at least one of the following: securities industry regulatory domain, banking industry regulatory domain, and insurance industry regulatory domain. The template retrieval module is used to retrieve matching target industry templates from a pre-built industry-specific platform template library based on the target industry regulatory domain. The platform instantiation module is used to call the target industry template to perform platform instantiation operations and generate a target log reporting platform that matches the target server.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a deployment method for a log reporting platform according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute a deployment method for a log reporting platform according to any one of claims 1-7.

Images