Intelligent intrusion detection method and system based on system log information

Abstract

The present invention discloses an intelligent intrusion detection method and system based on system log information. The method of the present invention comprises extracting template constant information L of each log of the system log, value information V and position information P of variable variables; obtaining a template constant vector l by using a pre-trained language model for the template constant information L const , the value information V is vectorized and truncated to obtain the value information vector v, the position information P is vectorized and truncated to obtain the position information vector p; the template constant vector l const , value information vector v and position information vector p extract features and perform feature fusion to obtain a multi-angle log sequence vector; the multi-angle log sequence vector is classified using a preset classifier. The present invention can solve the contradiction between log representation and abnormal granularity in the existing intrusion detection method, thereby effectively improving the detection accuracy of intrusion detection and ensuring the detection efficiency of intrusion detection.

Description

Technical Field

[0001] The present invention relates to computer system security technology, and in particular to an intelligent intrusion detection method and system based on system log information. Background Art

[0002] With the development of computer-related technologies and the rise of the Internet industry, more and more devices and systems are connected to the Internet. The security issues of systems in open scenarios have also received unprecedented attention and become the basic security of the country and society. Among the many system security defense technologies, the intrusion detection system (IDS) is one of the most important tools that can actively protect the system from illegal external attacks. The intrusion detection system monitors key system information, such as system logs, file systems, process records, etc., to sense whether the system has been attacked from the inside.

[0003] Traditional rule-based intrusion detection methods have shortcomings such as reliance on manual intervention, difficulty in timely updating of rule databases, and difficulty in detecting unknown intrusions. In recent years, artificial intelligence has become one of the most concerned areas in my country and even the global academic and industrial circles. It has made great achievements in image recognition and natural language processing. Using artificial intelligence technology to innovate intrusion detection technology is the development trend in the field of intrusion detection. Therefore, researchers in the fields of artificial intelligence and system security have begun to explore the use of various key data in the system for intrusion detection.

[0004] Among the multiple types of key information in the system, system log information often records the runtime status of the system and reflects the execution process of the system program. It is an important means to detect the system status and troubleshoot system failures. The essence of system logs is semi-structured text, with a structure in which the template constant part and the variable variable part are inlaid. In the field of natural language processing, natural text does not have such a rich feature of variable variables. At the same time, from the perspective of the semantics contained, the text pattern in the log text will not exceed the form of its original template. The key to the intrusion detection system based on log information is to mine the efficient representation of log sequences at different times and overcome the unbalanced distribution of data.

[0005] According to different representation methods, the current methods for intrusion detection based on log information can be divided into two categories: template extraction-based methods and digital deletion-based methods. The template extraction-based method is based on template extraction algorithms based on various principles. It traverses the log and obtains the corresponding template constant part and variable variable part at the same time. Due to the error of the template extraction algorithm itself, only the template constant part is retained to form the log sequence, and these sequences are vectorized using natural language processing technology as the representation of the log information. Finally, the prepared vectorized representation is put into the downstream model for training to obtain the final intrusion detection model. The digital deletion-based method is based on the assumption that "only numbers are variable parts". It separates the log information into digital parts and other non-digital parts, and processes the digital part into a combination of a single digital sequence and its position information in the original log, which is used as the representation of the log information. For the non-digital part, the rich information knowledge and certain fault-tolerant mechanisms in the large-scale pre-trained language model are used to efficiently represent it. Before being put into the downstream task model training, the information of the digital part is integrated into the information of the non-digital part through the attention mechanism before the downstream task training.

[0006] The template extraction-based method reduces log information to template markers, so that the sequence generation method can be used in the downstream intrusion detection process, thereby realizing anomaly detection at the level of a single log. However, since various template methods use comparison methods to extract log templates without sufficient prior knowledge, they often produce some errors when facing complex real-world logs, including log template allocation errors, incomplete log template extraction, and many other problems. The method based on digital deletion, based on the assumption that "only numbers are variable parts", ensures the integrity of log information representation. However, the failure to introduce the concept of templates also means that the granularity of anomaly detection can only sink to the sequence level.

[0007] Therefore, there is a contradiction between log representation and anomaly granularity in existing intrusion detection methods based on log information. Summary of the invention

[0008] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, an intelligent intrusion detection method and system based on system log information are provided. The present invention can solve the contradiction between log representation and anomaly granularity in the existing intrusion detection method, thereby effectively improving the detection accuracy of intrusion detection and ensuring the detection efficiency of intrusion detection.

[0009] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0010] An intelligent intrusion detection method based on system log information, comprising:

[0011] 1) Extract the template constant information L of each log in the system log, and the value information V and position information P of the variable variable;

[0012] 2) The template constant information L is used to obtain the template constant vector l using the preset pre-trained language model const , the value information V is vectorized and truncated to obtain the value information vector v, and the position information P is vectorized and truncated to obtain the position information vector p;

[0013] 3) The template constant vector l const , value information vector v and position information vector p extract features and perform feature fusion to obtain a multi-angle log sequence vector;

[0014] 4) Classifying the multi-angle log sequence vector using a preset classifier to obtain a sequence classification result.

[0015] Optionally, step 1) includes: for each log of the system log, using the text part containing only letters after deleting all numbers as a template constant, and using a regular expression to extract the numeric part in the system log as a single variable variable, using the content of the extracted numeric part as the value of the variable variable, and using the position of the extracted numeric part as the position of the variable variable, thereby obtaining template constant information L composed of template constants of all logs, variable variable value information V composed of variable variable values, and variable variable position information P composed of positions.

[0016] Optionally, the vectorization processing and truncation and completion in step 2) include: first converting the value information V or position information P to be processed into a numerical vector; then correcting the numerical vector to the same length, wherein the correction to the same length includes using a truncation operation to use the specified length of the front part as the content after correction to the same length when the numerical vector exceeds the specified length, and using a zero value completion operation to fill the numerical vector to the specified length when the numerical vector is less than the specified length, and the dimension of the value information vector v and the position information vector p are both l max *d v , where l max is the maximum log length, d v The length of the longest variable contained in a single log.

[0017] Optionally, step 3) includes:

[0018] 3.1) Generate a high-dimensional position information vector from the position information vector p;

[0019] 3.2) learning the features of the high-dimensional position information vector based on the attention mechanism, and fusing it with the value information vector v to obtain a high-dimensional value information vector fused with the position information;

[0020] 3.3) Extract the features of the high-dimensional value information vector of the fused position information based on the attention mechanism learning, and combine it with the template constant vector l const The template sequence vector l with variable information is obtained by fusion;

[0021] 3.4) Extract features from the template sequence vector l that integrates variable information to obtain a multi-angle log sequence vector.

[0022] Optionally, in step 3.1), generating a high-dimensional position information vector from the position information vector p means: generating a high-dimensional position information vector with a dimension of l through a preset fully connected network. max *d m A high-dimensional position information vector, where l max is the maximum log length, d m is the length of the representation vector of a single log.

[0023] Optionally, the high-dimensional value information vector of the fused position information obtained by fusing in step 3.2) includes: firstly calculating the attention value Attention1(Q, K, V) of the high-dimensional position information vector relative to the high-dimensional value information vector through a preset attention mechanism network, and the formula is as follows:

[0024]

[0025] In the above formula, the query vector Q uses a high-dimensional position information vector, the key vector K and the value vector V use high-dimensional value information, softmax represents the softmax activation function, and d k represents the dimension of the key vector K; then the attention value Attention1(Q, K, V) and the high-dimensional value information vector are summed to obtain a dimension of l max *d m The high-dimensional value information vector of the fused position information, where l max is the maximum log length, d m is the length of the representation vector of a single log.

[0026] Optionally, the template sequence vector l obtained by fusing variable information in step 3.3) includes:

[0027] First, the preset attention mechanism network is used to calculate the high-dimensional value information vector of the fused position information relative to the template constant vector l const The attention value Attention2(Q,K,V) is given by the following formula:

[0028]

[0029] In the above formula, the query vector Q adopts a high-dimensional value information vector that integrates position information, and the key vector K and value vector V adopt a template constant vector l const, softmax represents the softmax activation function, d k Represents the dimension of the key vector K; then the attention value Attention2(Q,K,V) is combined with the template constant vector l const The sum of the two gives a dimension of l max *d m The template sequence vector l of the fused variable information, where l max is the maximum log length, d m is the length of the representation vector of a single log.

[0030] Optionally, in step 3.4), extracting features from the template sequence vector l fused with variable information refers to extracting features from the template sequence vector l fused with variable information using a multi-head attention mechanism to obtain a dimension of l max *d m The multi-angle log sequence vector.

[0031] Optionally, step 4) also includes calculating the detection accuracy of the classifier, and when the detection accuracy is lower than a preset threshold, adding the system log in step 1) to the training sample of the classifier, and performing incremental learning based on the training sample using a preset incremental learning method to update the model parameters of the classifier.

[0032] In addition, the present invention also provides an intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the steps of the intelligent intrusion detection method based on system log information.

[0033] In addition, the present invention also provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used to be executed by a computer device to implement the steps of the intelligent intrusion detection method based on system log information.

[0034] Compared with the prior art, the present invention has the following advantages: the present invention comprises extracting the template constant information L of each log of the system log, and the value information V and position information P of the variable variable, and further generating the template constant vector l const , value information vector v and position information vector p, and the template constant vector l const , value information vector v and position information vector p are used to extract features and perform feature fusion to obtain a multi-angle log sequence vector as a classification input feature, which can comprehensively characterize the attributes of the log, improve the accuracy and robustness of intrusion detection using logs, and solve the contradiction between log characterization and anomaly granularity in existing intrusion detection methods, thereby effectively improving the detection accuracy of intrusion detection and ensuring the detection efficiency of intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The figure is a schematic diagram of data flow of the method according to the embodiment of the present invention.

[0036] Figure 2 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0037] Figure 3 The figure is a schematic diagram of the training process of SmartLog according to an embodiment of the present invention.

[0038] Figure 4 The figure is a schematic diagram of the test flow of SmartLog according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] like Figure 1 and Figure 2 As shown, the intelligent intrusion detection method based on system log information in this embodiment includes:

[0040] 1) Extract the template constant information L of each log in the system log, and the value information V and position information P of the variable variable;

[0041] 2) The template constant information L is used to obtain the template constant vector l using the preset pre-trained language model const , the value information V is vectorized and truncated to obtain the value information vector v, and the position information P is vectorized and truncated to obtain the position information vector p;

[0042] 3) The template constant vector l const , value information vector v and position information vector p extract features and perform feature fusion to obtain a multi-angle log sequence vector;

[0043] 4) Classifying the multi-angle log sequence vector using a preset classifier to obtain a sequence classification result.

[0044] Log information is often divided into a template constant part and a variable variable part. The constant part is usually written in the code statement of the log print, and the variable part is determined by the variable value when the system is running. The log template retains the constant part in the log and marks the variable part with a placeholder, so that the log output by the same log printing code is mapped to a template. The method of obtaining log templates by static analysis is often difficult to carry out due to the complexity of software code and the closed source nature of the system. Therefore, experts and scholars began to explore methods such as clustering comparison to obtain log templates directly from the output logs without relying on software source code. However, in the absence of prior knowledge, log template extraction algorithms often have many problems such as unsatisfactory extraction effect, low extraction efficiency, and the need to traverse the entire data set completely, making it impossible to implement intrusion detection in real-time systems. In real log systems, there are many different variable parts. Perfect analysis of log templates can dig out the hidden internal logical relationship of the system, but it also brings huge implementation costs. The digital variable part often contains a description of the corresponding log attribute, while the non-digital variable part contains a description of information such as the sender of the behavior and the behavior status. Therefore, the present invention separates the digital variable part in the separation and extraction part, and for the difference of non-numeric variables, the prior knowledge of the pre-trained language model is relied on to distinguish at the downstream non-numeric part vectorization representation. In this embodiment, in the log information separation and extraction part, the assumption that "only numbers are variable parts" is used as a premise, and the digital part is separated from the non-numeric part by relying on a simple regular expression. The system log is the result of using a log tool to record the operating status of each component of the system. For example, during the login process after startup, the system often records the login history of multiple users in a special file, "2222-02-02 02:02:02, Bob log in." As described in the above example, time and name are the content parts of the log that specify the attributes of the login behavior, and specific login behaviors such as logging in and logging out are completely consistent for different users. The former is the variable variable information, and the latter is the template constant information. Since the text information in this embodiment will be represented as different vectors through the pre-trained model, no special processing is performed on the string variable information (such as Bob in the example); however, for the numeric variable information (such as the time in the example), this patent uses a simple regular expression to extract all the numbers one by one and calculate the position of the number (that is, the single number is in the nth string separated by spaces) as the variable variable position vector, and the corresponding number is used as the variable position value vector; at the same time, all the numbers in the template constant information are deleted to obtain the text part containing only letters.Specifically, in this embodiment, step 1) includes: for each log of the system log, the text part containing only letters obtained after deleting all numbers is used as a template constant, and a regular expression is used to extract the numeric part in the system log as a single variable variable, the content of the extracted numeric part is used as the value of the variable variable, and the position of the extracted numeric part is used as the position of the variable variable, thereby obtaining template constant information L composed of template constants of all logs, variable variable value information V composed of variable variable values, and variable variable position information P composed of positions. The template constant of any i-th log can be expressed as:.

[0045] L i =[l i1 ,l i2 ,…,l in ],

[0046] In the above formula, L i is the template constant set of the i-th log, l i1 ,l i2 ,…,l in They are the 1st to nth template constants of the i-th log, and n is the number of template constants in the template constant set.

[0047] The value information of any i-th log can be expressed as:

[0048] V i =[v i1 ,v i2 ,…,v in ],

[0049] In the above formula, V i is the value information set of the i-th log, v i1 ,v i2 ,…,v in They are the 1st to nth value information of the i-th log, and n is the number of value information in the value information set (here it is assumed to be the same as the number of template constants).

[0050] The location information of any i-th log can be expressed as:

[0051] P i =[p i1 ,p i2 ,…,p in ],

[0052] In the above formula, P i is the location information set of the i-th log, p i1 ,p i2 ,…,p inare the 1st to nth position information of the ith log, respectively, and n is the number of position information in the position information set (here it is assumed to be the same as the number of template constants). Through the above method, a comprehensive representation of the system log can be obtained.

[0053] In step 2), the template constant information L is obtained by using the preset pre-trained language model with a dimension of l max *d m Template constant vector l const The pre-trained language model used is a large-scale neural network model in the field of natural language processing that learns efficient text vector representation by setting tasks such as self-supervised learning. Currently, many institutions have used a large amount of computing power to train different pre-trained models for different text tasks, and these models can be downloaded from open source websites. This embodiment only involves the application of the pre-trained language model, so its specific implementation will not be described in detail here.

[0054] The lengths of log sequences involved in different record objects vary. In the preprocessing stage, this embodiment completes or truncates the text information sequence, value information sequence, and position information sequence to unify the length for subsequent processing. Vectorization processing refers to converting the numbers in the original text into numerical vectors, which is convenient for subsequent truncation and completion before being put into the neural network. The log tool records an object in the program, but different program objects have different life cycles and execution processes. Therefore, the lengths of log sequences for different objects are also different. Therefore, different log sequences need to be corrected to the same length. For sequences that are too long, truncation operations are used, and the front part of the sequence is used as a sample; for sequences that are too short, zero-value completion operations are used to fill them to a preset length. Specifically, the vectorization processing and truncation and completion in step 2) of this embodiment include: first, converting the value information V or position information P to be processed into a numerical vector; then correcting the numerical vector to the same length, wherein the correction to the same length includes using a truncation operation to use the specified length of the front part as the content after correction to the same length when the numerical vector exceeds the specified length, and using a zero value completion operation to fill the numerical vector to the specified length when the numerical vector is less than the specified length, and the dimension of the value information vector v and the position information vector p are both l max *d v , where l max is the maximum log length, d v The length of the longest variable contained in a single log.

[0055] Step 3) Convert the template constant vector l const, value information vector v and position information vector p extract features and perform feature fusion to obtain a multi-angle log sequence vector, the obtained position information can be fused into the digital information through an attention mechanism composed of a fully connected network, and then the digital information fused with the position information is integrated into the text sequence information through the same structural attention mechanism. In this embodiment, step 3) includes:

[0056] 3.1) Generate a high-dimensional position information vector from the position information vector p;

[0057] 3.2) learning the features of the high-dimensional position information vector based on the attention mechanism, and fusing it with the value information vector v to obtain a high-dimensional value information vector fused with the position information;

[0058] 3.3) Extract the features of the high-dimensional value information vector of the fused position information based on the attention mechanism learning, and combine it with the template constant vector l const The template sequence vector l with variable information is obtained by fusion;

[0059] 3.4) Extract features from the template sequence vector l that integrates variable information to obtain a multi-angle log sequence vector.

[0060] In this embodiment, in step 3.1), generating a high-dimensional position information vector from the position information vector p means: generating a high-dimensional position information vector from the position information vector p through a preset fully connected network with a dimension of l max *d m A high-dimensional position information vector, where l max is the maximum log length, d m is the length of the representation vector of a single log. Since the length of the variable position information is different from the length of the representation vector representing the text, putting it into a fully connected network can obtain a higher-dimensional data representation and stronger detection performance. In this embodiment, the fully connected network consists of two linear layers and one ReLU activation layer to obtain the representation of the input in a high-dimensional space.

[0061] Since value information and position information are information describing variable variables from different physical meanings, and the two also have hidden connections. Therefore, in order to achieve the fusion of value information and position information, the high-dimensional value information vector of the fused position information in step 3.2) of this embodiment includes: firstly, calculating the attention value Attention1(Q, K, V) of the high-dimensional position information vector relative to the high-dimensional value information vector through a preset attention mechanism network, and the formula is as follows:

[0062]

[0063] In the above formula, the query vector Q uses a high-dimensional position information vector, the key vector K and the value vector V use high-dimensional value information, softmax represents the softmax activation function, and dk represents the dimension of the key vector K; then the attention value Attention1(Q, K, V) and the high-dimensional value information vector are summed to obtain a dimension of l max *d m The high-dimensional value information vector of the fused position information, where l max is the maximum log length, d m is the length of the characterization vector of a single log. In this embodiment, the attention value Attention1(Q, K, V) of the high-dimensional position information vector relative to the high-dimensional value information vector is calculated through a preset attention mechanism network. The higher the attention value Attention1(Q, K, V), the greater the contribution of the value of the position to the characterization. In the attention mechanism network, the high-dimensional position information is used as a query vector, and the high-dimensional value information is used as a key vector and a value vector. After the dot product operation, the similarity of different vectors can be obtained, thereby obtaining the value information with the "position information" attention added. The attention value Attention1(Q, K, V) symbolizes that the value information vector with more weight should be given based on the position information. It should be noted that the attention mechanism network is an existing neural network structure, so its specific structure and implementation will not be described in detail here. In addition, when the high-dimensional value information vector of the fused position information is obtained in step 3.2), a fixed weight can be simply used for weighted fusion.

[0064] Since the variable information and the template constant information L are information describing the system log from different physical meanings, the two also have a hidden connection. Therefore, in order to achieve the fusion of the variable information and the template constant information L, the template sequence vector l of the fused variable information in step 3.3) of this embodiment includes: firstly, the high-dimensional value information vector of the fused position information is calculated relative to the template constant vector l through the preset attention mechanism network. const The attention value Attention2(Q,K,V) is given by the following formula:

[0065]

[0066] In the above formula, the query vector Q adopts a high-dimensional value information vector that integrates position information, and the key vector K and value vector V adopt a template constant vector l const , softmax represents the softmax activation function, d k Represents the dimension of the key vector K; then the attention value Attention2(Q,K,V) is combined with the template constant vector l const The sum of the two gives a dimension of l max *d m The template sequence vector l of the fused variable information, where l max is the maximum log length, d mis the length of the representation vector of a single log. In this embodiment, the high-dimensional value information vector of the fused position information is calculated by the preset attention mechanism network relative to the template constant vector l const The higher the attention value Attention2(Q,K,V), the greater the contribution of the value at that position to the representation. The high-dimensional value information vector of the fused position information is used as the query vector, and the template constant vector l const As key vector and value vector. After the dot product operation, the similarity of different vectors can be obtained, thereby obtaining a template vector with added "position information" attention. The attention value Attention2(Q, K, V) represents that the template constant vector should be given more weight based on the high-dimensional value information vector that integrates the position information. In addition, when the template sequence vector l that integrates the variable information is obtained by fusion in step 3.3), it is also possible to simply use fixed weights for weighted fusion.

[0067] In step 3.4), the feature extraction of the template sequence vector l fused with variable information can be performed by using a desired feature extraction neural network as needed. For example, as an optional implementation, in step 3.4 of this embodiment, the feature extraction of the template sequence vector l fused with variable information refers to the use of a multi-head attention mechanism to extract features from the template sequence vector l fused with variable information, and obtain a dimension of l max *d m There are many ways to calculate attention. This embodiment uses the common dot product attention to calculate attention, that is:

[0068]

[0069] In the above formula, the query vector Q, key vector K and value vector V are all converted from the original input through linear transformation, which constitutes the self-attention mechanism calculation, d k Represents the dimension of the key vector K. The key vector K and the value vector V correspond one to one. The inner product of each element in the query vector Q and each element in the key vector K is calculated, followed by a softmax layer to obtain the similarity weights between the query vector Q and each element in the key vector K. The high-attention part in the value vector V is obtained by means of the obtained weights, thereby obtaining the final result. The above-described process is the calculation process of a single attention mechanism. For the multi-head attention mechanism, different weights are used for multiple calculations, and the results of multiple calculations are concatenated. Finally, the dot product is scaled to the dimension of the original input to obtain the final attention result. It should be noted that the multi-head attention mechanism is an existing feature extraction method, and the required specific network structure can be adopted as needed.

[0070] In recent years, the Transformer model and its variants have shown excellent performance in sequence models. Therefore, in this embodiment, some structures in the Transformer model are used to form a feature extractor. As can be seen from the foregoing, the feature extractor used in the method of this embodiment consists of two parts: a fully connected layer and a multi-head attention layer, wherein the fully connected layer is used to execute step 3.1), and the multi-head attention layer is used to execute step 3.4). By drawing on the representative structure in the Transformer for feature extraction, the learning effect of the neural network is improved, and the detection accuracy is higher. In addition, in order to avoid problems such as gradient explosion or gradient dissipation caused by excessive network depth, a residual connection module is constructed between the multi-head attention layer and the fully connected layer in this embodiment. Through this residual connection module, problems such as gradient explosion or gradient dissipation caused by excessive network depth can be effectively avoided.

[0071] In this embodiment, the classifier in step 4) is a deep fully connected network, through which the final anomaly detection can be performed to obtain a sequence classification result (normal or abnormal).

[0072] In this embodiment, when training the feature extractor and classifier, a softmax layer is set at the output of the classifier and the cross entropy loss function is used as the final classification loss function. For the sake of simplicity, the intelligent intrusion anomaly detection system composed of the feature extractor and the classifier is referred to as SmartLog in this embodiment. Figure 1 , each text block in the figure represents the current state of the data, and the arrows represent various operations on the data. First, the log information is separated into a template constant part and a variable variable part. In addition to the information of its value, the variable variable part also has the position information of the variable in the log. In this embodiment, a multi-gradient attention mechanism (multiple attention mechanisms in steps 3.1 to 3.4) is designed to integrate the position information into the value information through the attention mechanism, and then integrate the variable variable information containing the value information and the position information into the template constant part. Next, the comprehensive log information is input into the downstream anomaly detection model, and the multi-attention mechanism is used to learn the multi-angle representation of different aspects of the anomaly detection task, and the high-dimensional data representation is extracted through the deep fully connected layer. Finally, the prepared training data is put into the classifier to obtain the intrusion detection model.

[0073] See also Figure 2, SmartLog mainly includes modules such as deletion extraction, representation learning, anomaly detection, and incremental learning. Deletion extraction is mainly responsible for data preprocessing, separating the template constant part of the data from the variable part, so as to obtain the input of the downstream representation learning module. Representation learning is mainly responsible for integrating different parts of the original data to form a complete representation of the data, and mapping different types of representations to the same continuous space through the attention mechanism, so as to learn the connection between heterogeneous data parts as the input of the downstream anomaly detection network; anomaly detection refers to the classification learning of the output of the representation learning module, learning complete and diverse classification representations through the multi-head attention mechanism, and learning efficient classification results through multi-layer fully connected network learning; incremental learning refers to the timely and rapid model update of the anomaly detection module, so that the anomaly detection module can capture the local information of the system in time, and learn more representative anomaly detection knowledge through abnormal sample playback.

[0074] like Figure 3 As shown in the figure, in the training phase, the multi-angle information of the log is first separated by preprocessing technology, and then the impact of data imbalance is alleviated by upsampling abnormal samples, and then the neural network parameters of SmartLog are updated based on the processed training set. When the number of training times i reaches the specified number of training rounds epoch, this embodiment will stop training and take the best model on the validation set as the initial SmartLog.

[0075] like Figure 4 As shown, during the testing phase, this embodiment will decide whether to perform incremental learning on the model based on the performance of the actual data. Within the specified time window, when the detection effect is lower than the set threshold, this embodiment will extract normal samples in the current window and abnormal samples in the abnormal sample pool collected during the test process together with the abnormal samples in the current window to form a training set for incremental learning. Incremental learning of the model based on the newly composed samples enables SmartLog to obtain more representative local abstract knowledge and continuously adjust the detection representation to optimize the performance on the entire test data set. At the same time, this embodiment will visualize the multi-gradient attention mechanism in the representation (the multiple attention mechanisms in steps 3.1 to 3.4), improve the interpretability of anomalies, optimize the detection granularity, and can cooperate with security personnel to judge the fine-grained abnormal part in the log sequence.

[0076] In addition, the present embodiment also provides an intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, the microprocessor being programmed or configured to execute the steps of the aforementioned intelligent intrusion detection method based on system log information. In addition, the present embodiment also provides a computer-readable storage medium, the computer-readable storage medium storing a computer program, and the computer program is used to be executed by a computer device to implement the steps of the aforementioned intelligent intrusion detection method based on system log information.

[0077] Embodiment 2:

[0078] This embodiment is a further improvement of the first embodiment. Based on the first embodiment, this embodiment further adds the function of incremental learning to achieve the continuous improvement of the detection accuracy of the classifier. During the operation of the system, the objects acted upon by its behavior, such as IP addresses, file directories, etc., often change over time. The object characteristic information in the training set alone is not enough to meet the needs of mining abnormal behavior characteristics. Therefore, this embodiment adopts an incremental learning method to timely learn and adjust the local object information during the training process, so as to better fit the behavior of the entire system. This embodiment adopts an incremental learning method based on playback, which permanently stores the abnormal data that has appeared, and uses the abnormal data and normal data in the recent time to continue training the model to obtain an intrusion detection model adapted to the current local object information. Specifically, this embodiment also includes calculating the detection accuracy of the classifier after step 4), and when the detection accuracy is lower than a preset threshold, the system log in step 1) is added to the training sample of the classifier, and incremental learning is performed based on the training sample using a preset incremental learning method to update the model parameters of the classifier. After the neural network model of the classifier is deployed in the actual system, the neural network model of the classifier may have problems such as decreased detection accuracy and low detection efficiency due to system updates, system running specific tasks, etc. In this embodiment, the original test / application data samples are collected again into the training data set, and the network parameters of the neural network model of the classifier are updated using an incremental learning algorithm, which can effectively and continuously improve the detection accuracy of the classifier. Among them, the preset incremental learning method can adopt various existing incremental learning algorithms as needed.

[0079] In addition, the present embodiment also provides an intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, the microprocessor being programmed or configured to execute the steps of the aforementioned intelligent intrusion detection method based on system log information. In addition, the present embodiment also provides a computer-readable storage medium, the computer-readable storage medium storing a computer program, and the computer program is used to be executed by a computer device to implement the steps of the aforementioned intelligent intrusion detection method based on system log information.

[0080] Embodiment three:

[0081] This embodiment is basically the same as the first embodiment, and the main difference is that considering that the connection between value information and position information is relatively hidden, this embodiment uses an attention mechanism network to calculate the weight of the high-dimensional position information vector relative to the high-dimensional value information vector. A high weight means that the value of the position contributes more to the representation. In this embodiment, when using an attention mechanism network to calculate the weight of the high-dimensional position information vector relative to the high-dimensional value information vector, the high-dimensional position information is used as the query vector, and the high-dimensional value information is used as the key vector and the value vector. After the dot product operation, the similarity of different vectors can be obtained, thereby obtaining the attention value with the "position information" added. This attention value symbolizes that the value information vector should be given more weight based on the position information. Then, the attention value and the high-dimensional value information vector are summed to obtain a vector with a dimension of l. max *d m The high-dimensional value information vector of the fused position information, where l max is the maximum log length, d m is the length of the representation vector of a single log.

[0082] In addition, the present embodiment also provides an intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, the microprocessor being programmed or configured to execute the steps of the aforementioned intelligent intrusion detection method based on system log information. In addition, the present embodiment also provides a computer-readable storage medium, the computer-readable storage medium storing a computer program, and the computer program is used to be executed by a computer device to implement the steps of the aforementioned intelligent intrusion detection method based on system log information.

[0083] Embodiment 4:

[0084] This embodiment is basically the same as the first embodiment, and the main difference is that: considering that the relationship between the variable information and the template constant information L is relatively hidden, this embodiment uses an attention mechanism network to calculate the high-dimensional value information vector of the fused position information relative to the template constant vector l const The weight of the position is high, which means that the value of the position contributes more to the representation. In this embodiment, the attention mechanism network is used to calculate the high-dimensional value information vector of the fused position information relative to the template constant vector l const When the weight is , the high-dimensional value information vector of the fused position information is used as the query vector and the template constant vector l const As the key vector and value vector, after the dot product operation, the similarity of different vectors can be obtained, thereby obtaining the attention value with the "position information" added. This attention value represents the template constant vector that should be given more weight based on the high-dimensional value information vector that integrates the position information. Then this attention value is combined with the template constant vector l constThe sum of the two gives a dimension of l max *d m The template sequence vector l of the fused variable information, where l max is the maximum log length, d m is the length of the representation vector of a single log.

[0085] In addition, the present embodiment also provides an intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, the microprocessor being programmed or configured to execute the steps of the aforementioned intelligent intrusion detection method based on system log information. In addition, the present embodiment also provides a computer-readable storage medium, the computer-readable storage medium storing a computer program, and the computer program is used to be executed by a computer device to implement the steps of the aforementioned intelligent intrusion detection method based on system log information.

[0086] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0087] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. An intelligent intrusion detection method based on system log information, characterized in that: include: 1) Extract template constant information of each system log L , and the value information of mutable variables V and location information P ; 2) Template constant information L Use the preset pre-trained language model to get the template constant vector l const , the value information V After vectorization and truncation and completion, the value information vector is obtained v , the location information P After vectorization and truncation and completion, the position information vector is obtained p ; 3) Convert template constant vector l const , value information vector v And the position information vector p Extract features and perform feature fusion to obtain multi-angle log sequence vectors; 4) Classifying the multi-angle log sequence vector using a preset classifier to obtain a sequence classification result; Step 3) includes: 3.1) Transform the position information vector p Generate a high-dimensional position information vector; 3.2) Based on the attention mechanism, the features of the high-dimensional position information vector are learned and combined with the value information vector v The high-dimensional value information vector of the fused position information is obtained by fusion; 3.3) Based on the attention mechanism, learning is used to extract the features of the high-dimensional value information vector of the fused position information, and compare it with the template constant vector l const Fusion obtains a template sequence vector that incorporates variable information l ; 3.4) Template sequence vector for fusion variable information l Extract features and obtain multi-angle log sequence vectors; In step 3.1), the position information vector p Generating a high-dimensional position information vector means: transforming the position information vector p The dimension generated by the preset fully connected network is l max * d m A high-dimensional position information vector, where l max is the maximum log length, d m is the length of the representation vector of a single log; The high-dimensional value information vector of the fused position information obtained in step 3.2) includes: firstly, calculating the attention value of the high-dimensional position information vector relative to the high-dimensional value information vector through a preset attention mechanism network Attention 1( Q , K , V ), the formula is as follows: ， In the above formula, the query vector Q Using high-dimensional position information vector, key vector K Sum value vector V Using high-dimensional value information, softmax represents the softmax activation function, d k Represents the key vector K The dimension of Attention 1( Q , K , V ) and the high-dimensional value information vector are summed to obtain the dimension l max * d m The high-dimensional value information vector of the fused position information, l max is the maximum log length, d m is the length of the representation vector of a single log; Step 3.3) is used to obtain the template sequence vector of variable information l include: First, the high-dimensional value information vector of the fused position information is calculated relative to the template constant vector through the preset attention mechanism network l const The attention value Attention 2( Q , K , V ), the formula is as follows: ， In the above formula, the query vector Q A high-dimensional value information vector fused with position information is used, and a key vector K Sum value vector V Using template constant vector l const , softmax represents the softmax activation function, d k Represents the key vector K The dimension of Attention 2( Q , K , V ) and template constant vector l const The sum of the two gives the dimension l max * d m Template sequence vector of fused variable information l ,in l max is the maximum log length, d m is the length of the representation vector of a single log; Step 3.4) in the template sequence vector of the fused variable information l Extracting features refers to using a multi-head attention mechanism to integrate variable information into the template sequence vector l Extract features and get dimensions l max * d m The multi-angle log sequence vector.

2. The intelligent intrusion detection method based on system log information according to claim 1 is characterized in that: Step 1) includes: for each log of the system log, the text part containing only letters obtained after deleting all numbers is used as a template constant, and the regular expression is used to extract the numeric part in the system log as a single variable, and the content of the extracted numeric part is used as the value of the variable 、 The position of the extracted digital part is used as the position of the variable, thereby obtaining the template constant information composed of the template constants of all logs. L、 The value of a variable is composed of the value information of the variable V And the position information of the variable variables composed of positions P .

3. The intelligent intrusion detection method based on system log information according to claim 1 is characterized in that: The vectorization processing and truncation completion in step 2) include: first, the value information to be processed V or location information P Convert the numerical vector to a numeric vector; then correct the numerical vector to the same length, wherein the correction to the same length includes using a truncation operation to use the specified length of the front part as the content after correction to the same length when the numerical vector exceeds the specified length, and using a zero-filling operation to fill the numerical vector to the specified length when the numerical vector is less than the specified length, and the value information vector v and position information vector p The dimensions are l max * d v ,in l max is the maximum log length, d v The length of the longest variable contained in a single log.

4. The intelligent intrusion detection method based on system log information according to claim 1 is characterized in that: Step 4) also includes calculating the detection accuracy of the classifier, and when the detection accuracy is lower than a preset threshold, adding the system log in step 1) to the training sample of the classifier, and performing incremental learning based on the training sample using a preset incremental learning method to update the model parameters of the classifier.

5. An intelligent intrusion detection system based on system log information, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the steps of the intelligent intrusion detection method based on system log information as described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to be executed by a computer device to implement the steps of the intelligent intrusion detection method based on system log information as described in any one of claims 1 to 4.

Images