Abnormality detection method, device and equipment of log and computer readable storage medium

By generating a log sample set and calculating the neighborhood distance, hyperplane distance, and data point density, abnormal operation behaviors are identified, solving the problem of low efficiency in log anomaly detection and achieving efficient log anomaly detection.

CN115344465BActive Publication Date: 2026-06-09CHINA MOBILE COMM GRP CO LTD
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
CHINA MOBILE COMM GRP CO LTD
Filing Date
2021-05-12
Publication Date
2026-06-09

AI Technical Summary

Technical Problem

In existing technologies, log anomaly detection is inefficient and cannot effectively support daily information security checks, especially when faced with a large number of diverse and inconsistently formatted operation logs, where manual analysis is inefficient.

Method used

By acquiring log data of user operation behavior, a log sample set is generated, and the neighborhood distance, hyperplane distance and data point density of each sample set are calculated. Abnormal operation behavior is identified based on the abnormal score, and the identification efficiency is improved by using a weighted average method.

Benefits of technology

It improves the efficiency of identifying abnormal operational behaviors, enhances the ability to detect log anomalies in information security, and improves the automation and accuracy of log analysis.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN115344465B_ABST
    Figure CN115344465B_ABST
Patent Text Reader

Abstract

The application discloses an abnormality detection method, device and equipment of a log and a computer readable storage medium. The method comprises the following steps: acquiring log data of each operation behavior of a user; generating a log sample set of each operation behavior according to the log data; determining an abnormality score corresponding to each log sample set respectively; and determining an abnormal operation behavior in each operation behavior according to the abnormality score. The application improves the identification efficiency of the abnormal operation behavior.
Need to check novelty before this filing date? Find Prior Art