Event analysis method, device, electronic device and storage medium

Abstract

The present invention provides an event analysis method, device, electronic device and storage medium, wherein the method comprises: obtaining pattern rules, and associating the pattern rules to generate a pattern matching link; obtaining an input event stream, and matching the event source in the input event stream with the pattern matching link; if the event source successfully matches the pattern matching link, obtaining a pattern matching state link; based on the pattern matching state link, obtaining an event link analysis result of the input event stream. The present invention obtains pattern rules, and then associates the obtained pattern rules to generate a pattern matching link, and then matches the event source in the input event stream to be analyzed with the pattern matching link to obtain a pattern matching state link, so as to completely and accurately trace back events and make accurate analysis.

Description

Technical Field

[0001] The present invention relates to the field of data analysis technology, and in particular to an event analysis method, device, electronic equipment and storage medium. Background Art

[0002] As ubiquitous sensor networks and smart devices continue to collect more and more data, we are faced with the challenge of analyzing the growing data stream in near real-time. Being able to quickly respond to changing trends or provide up-to-date business intelligence can be the deciding factor between a company's success or failure. The key problem in real-time processing is detecting event patterns in data streams.

[0003] Currently, traditional data processing is mainly based on relational databases. When faced with massive amounts of data, the processing capacity is limited. When faced with heterogeneous data and multidimensional data, there are high delays and low throughput in the collection, analysis, and processing. There are performance bottlenecks and it is unable to meet the needs of customers for data analysis, association, and processing in the new environment.

[0004] At present, the shortcomings of traditional data association analysis are as follows:

[0005] 1. The data source is single. The data source of traditional data correlation analysis is mainly static storage data. However, with the development of Internet business, more and more demands are required for rapid analysis and processing of real-time data.

[0006] 2. Lack of big data processing capabilities. When faced with massive data, heterogeneous data, and multi-dimensional data, data collection, analysis, processing, and storage will encounter huge challenges.

[0007] 3. Currently, the correlation analysis capability is mainly based on single events, and lacks the ability to perform temporal pattern matching on multiple continuously incoming different events.

[0008] 4. Currently, conventional event analysis methods are limited (limited to filtering, conversion, aggregation, connection, etc.) and conventional operations, and lack the ability to analyze a series of complex events. Summary of the invention

[0009] The present invention provides an event analysis method, device, electronic device and storage medium, which are used to solve the defects of the prior art that the data source is single and the event analysis capability is insufficient, and achieve the purpose of accurately analyzing multiple data.

[0010] The present invention provides an event analysis method, comprising:

[0011] Acquire pattern rules, and associate the pattern rules to generate pattern matching links;

[0012] Acquire an input event stream, and match an event source in the input event stream with the pattern matching link;

[0013] If the event source successfully matches the pattern matching link, obtaining a pattern matching state link;

[0014] Based on the pattern matching state link, an event link analysis result of the input event stream is obtained.

[0015] According to an event analysis method provided by the present invention, matching the event source in the input event stream with the pattern matching link comprises:

[0016] Obtaining configuration conditions of the pattern rule;

[0017] Based on the configuration conditions, event sources in the input event stream are matched with the pattern matching links.

[0018] According to an event analysis method provided by the present invention, matching the event source in the input event stream with the pattern matching link comprises:

[0019] Obtaining configuration conditions and configuration quantifiers of the pattern rule;

[0020] Based on the configuration condition and the configuration quantifier, an event source in the input event stream is matched with the pattern matching link.

[0021] According to an event analysis method provided by the present invention, associating the pattern rules to generate a pattern matching link includes:

[0022] Creating a starting node of the pattern matching link;

[0023] Associating the pattern rules having a business logic relationship to generate an initial pattern matching link;

[0024] A pattern matching link is generated based on the start node and the initial pattern matching link.

[0025] According to an event analysis method provided by the present invention, associating the pattern rules having a business logic relationship to generate an initial pattern matching link includes:

[0026] According to at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, the pattern rules are associated and an initial pattern matching link is generated;

[0027] The first link triggering strategy includes: after the pattern rules in the initial pattern matching link are initially matched to the first corresponding event source, each of the pattern rules is matched with each corresponding event source in the input event stream;

[0028] The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores non-corresponding event sources after initially matching the second corresponding event source until successfully matching another corresponding event source;

[0029] The third link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the third corresponding event source is matched for the first time, and obtains all the corresponding event sources that are successfully matched.

[0030] According to an event analysis method provided by the present invention, matching the event source in the input event stream with the pattern matching link comprises:

[0031] According to the non-deterministic finite automatic object, the pattern matching link is state-converted to generate an initial pattern matching state link;

[0032] Matching event sources in the input event stream with the initial pattern matching state link.

[0033] The present invention also provides an event analysis device, comprising:

[0034] A rule association module, used to obtain pattern rules, associate the pattern rules, and generate a pattern matching link;

[0035] A data input module, used for acquiring an input event stream and matching an event source in the input event stream with the pattern matching link;

[0036] An event matching module, configured to obtain a pattern matching state link if the event source successfully matches the pattern matching link;

[0037] The result output module is used to obtain the event link output result of the input event stream based on the pattern matching state link.

[0038] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above-mentioned event analysis methods when executing the computer program.

[0039] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the event analysis methods described above are implemented.

[0040] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned event analysis methods are implemented.

[0041] The event analysis method, device, electronic device and storage medium provided by the present invention obtain pattern rules and then temporally associate the obtained pattern rules to generate a pattern matching link; then, the event source in the input event stream to be analyzed is matched with the pattern matching link, and a pattern matching state link is obtained when the event source in the input event stream successfully matches the pattern matching link; by analyzing the pattern matching state link, the event can be completely and accurately traced back and an accurate analysis can be made. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a flow chart of the event analysis method provided by the present invention;

[0044] Figure 2 It is a structural schematic diagram of the pattern rules of the event analysis method provided by the present invention;

[0045] Figure 3 It is a schematic diagram of a pattern matching state link provided by the present invention;

[0046] Figure 4 is a schematic diagram of the structure of the event analysis device provided by the present invention;

[0047] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] The terms "first", "second", etc. in the specification of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein. In addition, the term "and / or" in the specification represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0050] Combine the following Figure 1-Figure 5 The present invention describes an event analysis method, device, electronic device and storage medium.

[0051] Figure 1 FIG. 1 is a flow chart of the event analysis method provided by the present invention. Figure 1 As shown, the present invention provides an event analysis method, wherein the execution subject may be a terminal or a server, the terminal is for example a computer, a vehicle-mounted terminal, etc., and the method comprises the following steps:

[0052] Step 101: Acquire pattern rules, associate the pattern rules, and generate pattern matching links.

[0053] It can be understood that in the present invention, the big data real-time stream analysis engine (Flink streaming analysis engine) is used as the technical basis. The Flink streaming analysis engine has the characteristics of high throughput and low latency, and is very suitable for processing streaming data.

[0054] Specifically, a specific event is usually composed of multiple events, that is, multiple event sources with time sequence can form an event stream. Before analyzing the event, the target data will be collected in advance according to the scenario of the event to be analyzed, the target event stream will be obtained, and the target event sources that constitute the target event stream will be obtained, and corresponding pattern rules will be created based on the multiple target event sources obtained.

[0055] The pattern rule in the present invention refers to a rule for identifying an event source.

[0056] For example, if a network leak occurs in the company, the company can first collect relevant network security event flows in advance through network log records and other methods based on the scenario of the network leak. In a network security incident, the administrator's confidential files are stolen. Three different event sources are involved in this network security incident: the administrator's confidential machine login event, the administrator's confidential machine confidential file copy event, and the administrator's confidential machine logout event.

[0057] Three pattern rules can be created based on three different event sources: login matching pattern, confidential file copying pattern, and logout matching pattern. The login matching pattern is used to detect whether the acquired event source contains the behavior of logging into a confidential machine; the confidential file copying pattern is used to detect whether the acquired event source contains abnormal confidential file copying actions; and the logout matching pattern is used to detect whether the acquired event source contains the behavior of logging out of a confidential machine.

[0058] Figure 2 is a schematic diagram of the structure of the pattern rules of the event analysis method provided by the present invention, such as Figure 2 As shown, after creating multiple pattern rules, the multiple pattern rules can be associated and connected according to relationships such as timing and logic to generate a pattern matching link.

[0059] For example, in the above-mentioned network security incident, after creating three pattern rules including login matching pattern, confidential file copying pattern and logout matching pattern, the login matching pattern, confidential file copying pattern and logout matching pattern are sequentially associated in the order in which the events occur to form a pattern matching link.

[0060] Step 102: Acquire an input event stream, and match an event source in the input event stream with the pattern matching link.

[0061] It can be understood that after the pattern matching link is generated, the input event stream to be analyzed is obtained, and the input event stream includes multiple event sources. The input event stream is input into the pattern matching link to determine whether the event source in the input event stream conforms to the pattern rules in the pattern matching link, that is, whether it can match the pattern rules in the pattern matching link.

[0062] Step 103: If the event source successfully matches the pattern matching link, a pattern matching state link is obtained.

[0063] It can be understood that when each event source in the input event stream to be analyzed can match the pattern rules in the corresponding pattern matching link, a pattern matching state link is generated. When each event source in the input event stream cannot match the pattern rules in the corresponding pattern matching link, the input event stream is considered to not meet the conditions and the information is discarded.

[0064] Step 104: Based on the pattern matching state link, obtain an event link analysis result of the input event stream.

[0065] It can be understood that after the pattern matching state link is obtained, the pattern matching state link includes the complete information of the input event stream, and the traceability and analysis can be performed based on the complete information of the input event stream.

[0066] The event analysis method provided by the present invention obtains pattern rules and then sequentially associates the obtained pattern rules to generate a pattern matching link; then, the event source in the input event stream to be analyzed is matched with the pattern matching link, and a pattern matching state link is obtained when the event source in the input event stream successfully matches the pattern matching link; by analyzing the pattern matching state link, the event can be completely and accurately traced back and an accurate analysis can be made.

[0067] Furthermore, matching the event source in the input event stream with the pattern matching link includes:

[0068] Obtaining configuration conditions of the pattern rule;

[0069] Based on the configuration conditions, event sources in the input event stream are matched with the pattern matching links.

[0070] It can be understood that, in this embodiment, a configuration condition is set for each pattern rule in the pattern matching link, and only when the input event source meets the configuration condition, the event source can be matched with the pattern rule. After the event source in the input event stream and the pattern rule in the pattern matching link are successfully matched for the first time, other event sources in the input event stream are further matched with the pattern matching link.

[0071] For example, configuration conditions can include the following:

[0072] First, when obtaining the event source, matching is performed by determining whether the event source contains specific conditions.

[0073] Second, when obtaining the event source, matching is performed by determining whether the event source contains any one of multiple specific conditions.

[0074] Third, when obtaining the event source, specify a stop condition, that is, after the given condition is met, there will be no corresponding event source to match.

[0075] The present invention matches the event sources in the input event stream by acquiring the configuration conditions of the pattern rules, thereby further improving the accuracy of event analysis.

[0076] Furthermore, matching the event source in the input event stream with the pattern matching link includes:

[0077] Obtaining configuration conditions and configuration quantifiers of the pattern rule;

[0078] Based on the configuration condition and the configuration quantifier, an event source in the input event stream is matched with the pattern matching link.

[0079] It can be understood that, in this embodiment, configuration conditions and configuration quantifiers are set for each pattern rule in the pattern matching link, and only when the input event source meets the requirements of the configuration conditions and configuration quantifiers can the event source be matched with the pattern rule. After the event source in the input event stream and the pattern rule in the pattern matching link are successfully matched for the first time, other event sources in the input event stream are further matched with the pattern matching link.

[0080] For example, configuration conditions can include the following:

[0081] First, when obtaining the event source, matching is performed by determining whether the event source contains specific conditions.

[0082] Second, when obtaining the event source, matching is performed by determining whether the event source contains any one of multiple specific conditions.

[0083] Third, when obtaining the event source, specify a stop condition, that is, after the given condition is met, there will be no corresponding event source to match.

[0084] For another example, configuration quantifiers may include the following points:

[0085] First, when obtaining the event source, the pattern rule matches the event source 4 times.

[0086] Second, when obtaining the event source, the pattern rule matches the event source 4 times or more.

[0087] Third, when obtaining an event source, the pattern rule matches the event source 2, 3, or 4 times.

[0088] Fourth, when obtaining the event source, set a limit time. The event source will not be matched outside the limit time range.

[0089] For example, in a network security incident, after creating three pattern rules including login matching pattern, confidential file copying pattern and logout matching pattern, the login matching pattern detects the administrator's confidential machine login event. When it is detected that the administrator's confidential machine login event is triggered four times and the time is within ten minutes, the event is considered to match the pattern rule.

[0090] The present invention matches the event source in the input event stream by acquiring the configuration conditions and configuration quantifiers of the pattern rules, thereby further improving the accuracy of event analysis.

[0091] Furthermore, associating the pattern rules to generate a pattern matching link includes:

[0092] Creating a starting node of the pattern matching link;

[0093] Associating the pattern rules having a business logic relationship to generate an initial pattern matching link;

[0094] A pattern matching link is generated based on the start node and the initial pattern matching link.

[0095] It can be understood that after creating the pattern rules corresponding to the event source, a matching action will be performed on the event source, and a starting node will be created. The pattern rules with business logic relationships will be sequentially associated to generate an initial pattern matching link.

[0096] Among them, the business logic relationship can be understood for different businesses. For example, in a network security incident, according to three different event sources: administrator confidential machine login event, administrator confidential machine confidential file copy event and administrator confidential machine logout event, three pattern rules are created: login matching pattern, confidential file copy pattern and logout matching pattern. The three pattern rules are in the order of business logic relationship, first the login matching pattern, then the confidential file copy pattern and the logout matching pattern. After associating the related pattern rules, a pattern matching link can be formed.

[0097] The present invention can further improve the accuracy of event analysis by associating pattern rules with business logic relationships and associating multiple event sources.

[0098] Furthermore, associating the pattern rules having a business logic relationship to generate an initial pattern matching link includes:

[0099] According to at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, the pattern rules are associated and an initial pattern matching link is generated;

[0100] The first link triggering strategy includes: after the pattern rules in the initial pattern matching link are initially matched to the first corresponding event source, each of the pattern rules is matched with each corresponding event source in the input event stream;

[0101] The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores non-corresponding event sources after initially matching the second corresponding event source until successfully matching another corresponding event source;

[0102] The third link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the third corresponding event source is matched for the first time, and obtains all the corresponding event sources that are successfully matched.

[0103] It can be understood that after creating the pattern rule corresponding to the event source, the pattern rule can be associated through at least one of the first link triggering policy, the second link triggering policy and the third link triggering policy.

[0104] Among them, the first link triggering strategy includes: after the pattern rules in the initial pattern matching link are first matched to the first corresponding event source, the pattern rules in the initial pattern matching link are matched with each corresponding event source in the input event stream until the pattern rules in the initial pattern matching link are matched, and then the matching is stopped.

[0105] For example, the pattern rule is preset to "A followed by Bn". After the A event source is matched successfully, the event stream [A, B1, B2] can be matched successfully, but the event stream [A, C, B1, B2] cannot be matched successfully.

[0106] The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the first matching to the second corresponding event source until another corresponding event source is matched.

[0107] For example, the pattern rule is preset to "A follows Bn". After the A event source is matched successfully, the event stream [A, C, B1, B2] can be matched successfully and matched as the event stream [A, B1]. That is, the non-corresponding event source C is ignored until the next event source that meets Bn is successfully matched.

[0108] The third link triggering strategy includes: after the pattern rule in the initial pattern matching link is matched to the third corresponding event source for the first time, the non-corresponding event source is ignored, and all matching corresponding event sources are obtained.

[0109] For example, the pattern rule is preset to "include A and Bn". After the event source A is matched successfully, the event stream [A, C, B1, B2] can be matched, that is, the non-corresponding event source C is ignored, and each event source that meets Bn, such as B1 and B2, is obtained and matched as the event stream [A, B1] and the event stream [A, B2].

[0110] The present invention associates pattern rules through at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, and generates an initial pattern matching link, which can increase the scope of event analysis and is conducive to analyzing complex events.

[0111] Furthermore, matching the event source in the input event stream with the pattern matching link includes:

[0112] According to the non-deterministic finite automatic object, the pattern matching link is state-converted to generate an initial pattern matching state link;

[0113] Matching event sources in the input event stream with the initial pattern matching state link.

[0114] It can be understood that Figure 3 Schematic diagram of the pattern matching state link provided by the present invention. Figure 3 As shown, during the operation, the relationship between the upper and lower nodes of the link above the pattern matching link is completed through non-deterministic finite automatic objects, and the expressions of each state and state transition between each pattern rule in the pattern matching link are completed to generate the initial pattern matching state link.

[0115] Then, the event sources in the input event stream are matched with the initial pattern matching state link. If the event sources in the input event stream successfully match the initial pattern matching state link, that is, the event sources in the input event stream can successfully match the pattern rules in the initial pattern matching state link, then a pattern matching state link is generated. If the event sources in the input event stream fail to match the initial pattern matching state link, that is, the event sources in the input event stream fail to match the pattern rules in the initial pattern matching state link, then the input event stream is discarded.

[0116] Among them, there are three ways of state migration:

[0117] First, the update method: it indicates that an event source in the event stream successfully matches the pattern rule, updates the status of the current pattern rule to a new status, and advances to the next pattern rule for matching.

[0118] Second, direct advancement: when the event source matches the pattern rule, the current pattern rule state does not change, and the event source is directly advanced to match the next pattern rule.

[0119] Third, ignore mode: when the event source is matched with the pattern rule, if the match is unsuccessful, the current event source is ignored and the current pattern rule status does not change.

[0120] For example, in a network security incident, after associating multiple pattern rules, performing state transitions, and generating an initial pattern matching state link, an initial pattern matching state link is obtained in the order of login matching pattern, confidential file copying pattern, and logout matching pattern.

[0121] Then, the event stream including the administrator's confidential machine login event, the administrator's confidential machine confidential file copy event, and the administrator's confidential machine logout event is input into the initial pattern matching state link, and the pattern rules in the initial pattern matching state link are identified and matched to generate a pattern matching state link.

[0122] The present invention matches the event source in the input event stream with the initial pattern matching link to obtain the pattern matching state link, thereby accurately analyzing the input event and obtaining the high-order features of the event.

[0123] The event analysis device provided by the present invention is described below. The event analysis device described below and the event analysis method described above can be referenced to each other.

[0124] Figure 4 is a schematic diagram of the structure of the event analysis device provided by the present invention, such as Figure 4 As shown, the present invention provides an event analysis device, including a rule association module 401, a data input module 402, an event matching module 403 and a result output module 404, wherein:

[0125] The rule association module 401 is used to obtain pattern rules, associate the pattern rules, and generate a pattern matching link; the data input module 402 is used to obtain the input event stream, and match the event source in the input event stream with the pattern matching link; the event matching module 403 is used to obtain the pattern matching state link if the event source successfully matches the pattern matching link; the result output module 404 is used to obtain the event link output result of the input event stream based on the pattern matching state link.

[0126] The event analysis device provided by the present invention obtains pattern rules and then temporally associates the obtained pattern rules to generate a pattern matching link; then matches the event source in the input event stream to be analyzed with the pattern matching link, and obtains the pattern matching state link when the event source in the input event stream successfully matches the pattern matching link; by analyzing the pattern matching state link, the event can be completely and accurately traced back and an accurate analysis can be made.

[0127] Optionally, the event matching module is further used to:

[0128] Obtaining configuration conditions of the pattern rule;

[0129] Based on the configuration conditions, the event source in the input event stream is matched with the pattern matching link to obtain a pattern matching state link.

[0130] Optionally, the event matching module is further used to:

[0131] Obtaining configuration conditions and configuration quantifiers of the pattern rule;

[0132] Based on the configuration condition and the configuration quantifier, the event source in the input event stream is matched with the pattern matching link to obtain a pattern matching state link.

[0133] Optionally, the rule association module is further used to:

[0134] Creating a starting node of the pattern matching link;

[0135] Associating the pattern rules having a business logic relationship to generate an initial pattern matching link;

[0136] A pattern matching link is generated based on the start node and the initial pattern matching link.

[0137] Optionally, the rule association module is further used to:

[0138] According to at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, the pattern rules are associated and an initial pattern matching link is generated;

[0139] The first link triggering strategy includes: after the pattern rules in the initial pattern matching link are initially matched to the first corresponding event source, each of the pattern rules is matched with each corresponding event source in the input event stream;

[0140] The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores non-corresponding event sources after initially matching the second corresponding event source until successfully matching another corresponding event source;

[0141] The third link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the third corresponding event source is matched for the first time, and obtains all the corresponding event sources that are successfully matched.

[0142] Optionally, the event matching module is further used to:

[0143] According to the non-deterministic finite automatic object, the pattern matching link is state-converted to generate an initial pattern matching state link;

[0144] Matching event sources in the input event stream with the initial pattern matching state link.

[0145] Figure 5 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 5As shown, the electronic device may include: a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502 and the memory 503 communicate with each other through the communication bus 504. The processor 501 may call the logic instructions in the memory 503 to execute the event analysis method provided by the above-mentioned method embodiments, which method, for example, includes: obtaining pattern rules, associating the pattern rules, and generating a pattern matching link; obtaining an input event stream, and matching the event source in the input event stream with the pattern matching link; if the event source successfully matches the pattern matching link, obtaining a pattern matching state link; and obtaining an event link analysis result of the input event stream based on the pattern matching state link.

[0146] In addition, the logic instructions in the above-mentioned memory 503 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0147] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the event analysis method provided by the above-mentioned method embodiments. The method, for example, includes: obtaining pattern rules, associating the pattern rules, and generating a pattern matching link; obtaining an input event stream, and matching the event source in the input event stream with the pattern matching link; if the event source successfully matches the pattern matching link, obtaining a pattern matching state link; based on the pattern matching state link, obtaining the event link analysis result of the input event stream.

[0148] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the event analysis method provided by the above-mentioned method embodiments. The method, for example, includes: obtaining pattern rules, and associating the pattern rules to generate a pattern matching link; obtaining an input event stream, and matching the event source in the input event stream with the pattern matching link; if the event source successfully matches the pattern matching link, obtaining a pattern matching state link; based on the pattern matching state link, obtaining an event link analysis result of the input event stream.

[0149] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0150] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An event analysis method, characterized in that: include: Acquire pattern rules, and associate the pattern rules to generate pattern matching links; Acquire an input event stream, and match an event source in the input event stream with the pattern matching link; If the event source successfully matches the pattern matching link, obtaining a pattern matching state link; Based on the pattern matching state link, obtaining an event link analysis result of the input event stream; The step of associating the pattern rules to generate a pattern matching link includes: Creating a starting node of the pattern matching link; Associating the pattern rules having a business logic relationship to generate an initial pattern matching link; generating a pattern matching link based on the starting node and the initial pattern matching link; The step of associating the pattern rules having a business logic relationship to generate an initial pattern matching link includes: According to at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, the pattern rules are associated and an initial pattern matching link is generated; The first link triggering strategy includes: after the pattern rules in the initial pattern matching link are initially matched to the first corresponding event source, each of the pattern rules is matched with each corresponding event source in the input event stream; The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores non-corresponding event sources after initially matching the second corresponding event source until successfully matching another corresponding event source; The third link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the third corresponding event source is matched for the first time, and obtains all the corresponding event sources that are successfully matched.

2. The event analysis method according to claim 1, characterized in that: The matching the event source in the input event stream with the pattern matching link comprises: Obtaining configuration conditions of the pattern rule; Based on the configuration conditions, event sources in the input event stream are matched with the pattern matching links.

3. The event analysis method according to claim 1, characterized in that: The matching the event source in the input event stream with the pattern matching link comprises: Obtaining configuration conditions and configuration quantifiers of the pattern rule; Based on the configuration condition and the configuration quantifier, an event source in the input event stream is matched with the pattern matching link.

4. The event analysis method according to claim 1, characterized in that: The matching the event source in the input event stream with the pattern matching link comprises: According to the non-deterministic finite automatic object, the pattern matching link is state-converted to generate an initial pattern matching state link; Matching event sources in the input event stream with the initial pattern matching state link.

5. An event analysis device, characterized in that: include: A rule association module, used to obtain pattern rules, associate the pattern rules, and generate a pattern matching link; A data input module, used for acquiring an input event stream and matching an event source in the input event stream with the pattern matching link; An event matching module, configured to obtain a pattern matching state link if the event source successfully matches the pattern matching link; A result output module, used for obtaining an event link output result of the input event stream based on the pattern matching state link; The step of associating the pattern rules to generate a pattern matching link includes: Creating a starting node of the pattern matching link; Associating the pattern rules having a business logic relationship to generate an initial pattern matching link; generating a pattern matching link based on the starting node and the initial pattern matching link; The step of associating the pattern rules having a business logic relationship to generate an initial pattern matching link includes: According to at least one of the first link triggering strategy, the second link triggering strategy and the third link triggering strategy, the pattern rules are associated and an initial pattern matching link is generated; The first link triggering strategy includes: after the pattern rules in the initial pattern matching link are initially matched to the first corresponding event source, each of the pattern rules is matched with each corresponding event source in the input event stream; The second link triggering strategy includes: the pattern rule in the initial pattern matching link ignores non-corresponding event sources after initially matching the second corresponding event source until successfully matching another corresponding event source; The third link triggering strategy includes: the pattern rule in the initial pattern matching link ignores the non-corresponding event source after the third corresponding event source is matched for the first time, and obtains all the corresponding event sources that are successfully matched.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the event analysis method according to any one of claims 1 to 4 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the event analysis method according to any one of claims 1 to 4 are implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the event analysis method according to any one of claims 1 to 4 are implemented.

Images