Method, device and equipment for identifying user behavior based on multi-source logs

Abstract

Embodiments of the present application provide a method, device and computer readable storage device for identifying user behavior based on multi-source logs. The method comprises sending an instruction to query kernel logs to an operating system; if query failure information fed back by the operating system is received, determining that the operating system has a shield, obtaining type and version information of the operating system; determining an opening command of the shield according to the type and version information of the operating system; based on the opening command, controlling the operating system to open the shield, in response to a message representing that the shield is removed fed back by the operating system, sending an instruction to query kernel logs of the operating system to the operating system again, and obtaining the kernel logs; obtaining change logs of the operating system, and determining operation behavior of a user based on the change logs and the kernel logs. In this way, accurate identification of user behavior is achieved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of log analysis, and in particular to a method, device, equipment and computer readable storage device for identifying user behavior based on multi-source logs. BACKGROUND

[0002] It is an important goal of information construction for government departments and enterprises to assist office work through information means, standardize computer file use, enhance the understanding of computer terminal use in the network for managers, improve the level of identifying potential security risks, and effectively prevent the occurrence of leakage events.

[0003] Currently, when constructing a security application prevention system on an office system platform, in order to standardize the file operation habits of operators, technical personnel need to check the system logs to find the corresponding operation process, that is, technical personnel find the corresponding operation process by analyzing log information.

[0004] However, the way of correcting operation habits by manually checking logs wastes a lot of human resources and is inefficient. SUMMARY

[0005] According to embodiments of the present application, a scheme for identifying user behavior based on multi-source logs is provided.

[0006] In a first aspect of the present application, a method for identifying user behavior based on multi-source logs is provided. The method comprises:

[0007] sending an instruction to query kernel logs to an operating system;

[0008] if receiving query failure information fed back by the operating system, determining that the operating system has a shield, and obtaining type and version information of the operating system;

[0009] determining an opening command of the shield according to the type and version information of the operating system;

[0010] controlling the operating system to open the shield based on the opening command, responding to a message indicating that the shield is removed fed back by the operating system, sending an instruction to query kernel logs of the operating system again, and obtaining the kernel logs;

[0011] obtaining change logs of the operating system, and determining operation behavior of a user based on the change logs and the kernel logs.

[0012] Further, the controlling the operating system to open the shield based on the opening command comprises:

[0013] The opening command is input to a corresponding local operating system address, and the operating system is controlled to open the shield.

[0014] Further, it further comprises:

[0015] The kernel log is decrypted.

[0016] The decrypted kernel log is cleaned by a tf-idf algorithm and a regular expression to obtain a clean kernel log.

[0017] Further, it further comprises:

[0018] The change log is cleaned by a tf-idf algorithm and a regular expression to obtain a clean change log.

[0019] Further, the operation behavior of the user is determined based on the change log and the kernel log, comprising:

[0020] The clean kernel log and the clean change log are merged to obtain a log set.

[0021] The log set is labeled to obtain a first log set.

[0022] The logs in the first log set are associatedly analyzed to obtain logs of the same behavior.

[0023] Based on the logs of the same behavior, a file operation log is generated.

[0024] The file operation log is analyzed to determine the operation behavior of the user.

[0025] Further, the log set is labeled to obtain a first log set, comprising:

[0026] The logs in the log set are labeled, and each operation behavior contained in each log is labeled to obtain a first log set.

[0027] Further, the operation behavior comprises file deletion, file movement, file editing, file copying and / or file renaming.

[0028] In a second aspect of the present application, a device for identifying user behavior based on multi-source logs is provided. The device comprises:

[0029] A sending module is configured to send an instruction for querying a kernel log to an operating system.

[0030] An obtaining module is configured to, if the operating system feedbacks query failure information, determine that the operating system has a shield, and obtain type and version information of the operating system.

[0031] determining module, configured to determine an opening command of the shield according to the type and version information of the operating system;

[0032] querying module, configured to control the operating system to open the shield based on the opening command, and send an instruction to query the kernel log of the operating system to the operating system again in response to a message indicating that the shield is removed, which is fed back by the operating system, to obtain the kernel log;

[0033] analyzing module, configured to obtain a change log of the operating system, and determine the operation behavior of the user based on the change log and the kernel log.

[0034] In a third aspect of the present application, an electronic device is provided. The electronic device includes a memory and a processor, the memory has a computer program stored thereon, and the processor implements the method described above when executing the program.

[0035] In a fourth aspect of the present application, a computer readable storage medium is provided, which has a computer program stored thereon, and the program is executed by a processor to implement the method according to the first aspect of the present application.

[0036] The method for identifying user behavior based on multi-source logs provided by the embodiments of the present application sends an instruction to query the kernel log to the operating system. If the instruction to query the kernel log is failed, it is determined that the operating system has a shield, and the type and version information of the operating system is obtained. The opening command of the shield is determined according to the type and version information of the operating system. The operating system is controlled to open the shield based on the opening command. In response to a message indicating that the shield is removed, which is fed back by the operating system, an instruction to query the kernel log of the operating system is sent to the operating system again to obtain the kernel log. The change log of the operating system is obtained, and the operation behavior of the user is determined based on the change log and the kernel log. The efficient and accurate identification of the operation behavior of the user is realized.

[0037] It should be understood that the content described in the summary section is not intended to limit the key or important features of the embodiments of the present application, nor to limit the scope of the present application. Other features of the present application will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0038] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent by describing in detail the following embodiments with reference to the attached drawings. In the drawings, the same or similar reference numerals refer to the same or similar elements, and:

[0039] Figure 1 is a flowchart of the method for identifying user behavior based on multi-source logs according to the embodiments of the present application;

[0040] Figure 2 A flow chart for generating a file operation log according to an embodiment of the present application;

[0041] Figure 3 A block diagram of an apparatus for identifying user behavior based on multi-source logs according to an embodiment of the present application;

[0042] Figure 4 A structural schematic diagram of a terminal device or a server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the objects, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

[0044] In addition, the term "and / or" in this document is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in this document generally represents an "or" relationship between the front and rear associated objects.

[0045] FIG. 1 shows a flow chart of a method for identifying user behavior based on multi-source logs according to an embodiment of the present disclosure. The method comprises:

[0046] S110, sending an instruction for querying a kernel log to an operating system.

[0047] In some embodiments, a user can send an instruction for querying an operating system kernel log to an operating system through a client.

[0048] The operating system is usually a domestic operating system developed on the basis of Linux.

[0049] Further, the kernel log in the operating system is usually a log encrypted by a national secret algorithm, for example, SM1, SM2, SM3, and SM4 algorithms.

[0050] In some embodiments, the client includes a smart phone, a tablet computer, an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, and the like.

[0051] In S120, if the query failure information is received from the operating system, it is determined that the operating system has a shield, and the type and version information of the operating system are obtained.

[0052] The shield is a system security shield, which is used to effectively prevent the occurrence of a leak event, and is an important component of the operating system used by current government departments and enterprises and institutions, i.e., an important component of a domestic operating system.

[0053] In some embodiments, if the query failure information is received from the operating system, it is determined that the operating system has a shield.

[0054] At this time, an instruction for querying the operating system information is sent to the server, and the type and version information of the operating system fed back by the server are obtained; the type of the operating system includes Android, BSD, iOs, Linux, Mac OS X, Windows, Windows Phone, and z / OS, etc.; and the version information is information for identifying the version of the corresponding operating system.

[0055] If the operating system does not include a shield, the kernel log of the operating system is directly obtained.

[0056] In S130, according to the type and version information of the operating system, an opening command of the shield is determined.

[0057] In some embodiments, according to the type and version information of the operating system, a command for opening the shield is determined.

[0058] In S140, based on the opening command, the operating system is controlled to open the shield, a message indicating that the shield is removed is fed back by the operating system in response, an instruction for querying the kernel log of the operating system is sent to the operating system again, and the kernel log is obtained.

[0059] In some embodiments, based on the opening command, the shield is opened. For example, through the type and version information of the current operating system, it is determined that the opening command is "0x7584", and the opening command is input to the localization operating system address "0x3a694" to control the opening of the operating system security shield; wherein different operating systems can have different opening commands, or the same opening command.

[0060] Further, when receiving the message indicating the removal of the shield from the operating system feedback, i.e., in response to the message indicating the removal of the shield from the operating system feedback, the instruction for querying the operating system kernel log is sent to the operating system again, and the kernel log is obtained.

[0061] S150, obtaining the change log of the operating system, and based on the change log and the kernel log, determining the operation behavior of the user.

[0062] In some embodiments, the change log of the operating system is obtained at the same time, before or after obtaining the kernel log of the operating system, i.e., the changed log in the operating system is obtained.

[0063] In some embodiments, the kernel log and the change log are combined to obtain a log set, and the operation behavior of the user is determined based on the log set. Figure 2 .

[0064] Specifically, the obtained kernel log is decrypted by the national secret algorithm to obtain the decrypted kernel log.

[0065] The decrypted kernel log is cleaned by tf-idf algorithm and regular expression to obtain clean kernel log. That is, by tf-idf algorithm, the main part (high frequency part) in the decrypted kernel log is extracted, and then by regular expression method, the irrelevant characters in the log are removed to obtain clean kernel log;

[0066] The change log is cleaned by tf-idf algorithm and regular expression to obtain clean change log. For cleaning the kernel log, the steps are not repeated here;

[0067] Further, the clean kernel log and the clean change log are combined to obtain a log set;

[0068] The logs in the log set are labeled, and each operation behavior contained in each log is labeled to obtain a first log set; the operation behavior includes file deletion, file movement, file editing, file copying and / or file renaming, etc.

[0069] Correlation analysis is performed on the logs in the first log set by using a deep learning model to obtain logs of the same behavior.

[0070] The deep learning model can be obtained by neural network training.

[0071] File operation logs are generated based on the logs of the same behavior.

[0072] The file operation logs are analyzed, i.e., the file operation logs are audited to determine the operation behavior of the user.

[0073] Further, the operation habits of the user are regulated according to the real behavior of the user. For example, the real operation behavior of the user is compared with a preset standard, and the comparison result is sent to the user.

[0074] According to the embodiments of the present disclosure, the following technical effects are achieved:

[0075] The real operation behavior of the user is automatically and accurately identified in a domestic operating system, which provides a basis for regulating the habits of the user in using a computer to perform file operations. This can effectively prevent the occurrence of security incidents such as leaks.

[0076] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited to the action sequence described, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0077] The above is the introduction of the method embodiment, and the scheme described in the present application will be further described through the device embodiment.

[0078] Figure 3 A block diagram of a device 300 for identifying user behavior based on multi-source logs according to an embodiment of the present application is shown in Figure 3 As shown in

[0079] The sending module 310 is configured to send an instruction for querying kernel logs to an operating system.

[0080] The obtaining module 320 is configured to, if the query failure information fed back by the operating system is received, determine that the operating system has a shield, and obtain type and version information of the operating system.

[0081] The determining module 330 is configured to determine an opening command of the shield according to the type and version information of the operating system.

[0082] The query module 340 is configured to control the operating system to open the shield based on the opening command, and to send an instruction to query the operating system kernel log to the operating system again in response to a message indicating that the shield is removed, which is fed back by the operating system, to obtain the kernel log.

[0083] The analysis module 350 is configured to obtain a change log of the operating system, and to determine the operation behavior of the user based on the change log and the kernel log.

[0084] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described modules can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0085] Figure 4 A structural schematic diagram of a terminal device or a server suitable for implementing the embodiments of the present application is shown.

[0086] As shown in Figure 4 , the terminal device or the server includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 402 or programs loaded from a storage portion 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the terminal device or the server are also stored. The CPU 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0087] The following components are connected to the I / O interface 405: an input portion 406 including a keyboard, a mouse, and the like; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage portion 408 including a hard disk, and the like; and a communication portion 409 including a network interface card such as a LAN card, a modem, and the like. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as necessary. A removable medium 411 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 410 as necessary, so that a computer program read therefrom is installed in the storage portion 408 as necessary.

[0088] In particular, the above method flow steps can be implemented as a computer software program in accordance with the embodiments of the present application. For example, an embodiment of the present application includes a computer program product which includes a computer program tangibly embodied on a machine readable medium, the computer program containing program code for executing the methods illustrated in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 409, and / or installed from the removable media 411. When the computer program is executed by the central processing unit (CPU) 401, the above-described functions defined in the system of the present application are executed.

[0089] Note that the computer readable medium shown in the present application can be a computer readable signal medium or a computer readable storage medium or any combination thereof. The computer readable storage medium may, for example, be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any combination thereof. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. In the present application, the computer readable signal medium can include a data signal propagated in a baseband or as a carrier wave in a propagated data signal, in which the computer readable program code is embodied. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to, wireless, wire line, optical fiber cable, RF, etc., or any suitable combination thereof.

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0091] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor. The names of these units or modules do not, in certain circumstances, constitute a limitation on the unit or module itself.

[0092] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium stores one or more programs that, when used by one or more processors, execute the methods described in this application.

[0093] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing application concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions claimed in this application.

Claims

1. A method for identifying user behavior based on multi-source logs, characterized in that, The method comprises the following steps: sending an instruction to query a kernel log to an operating system; if receiving query failure information fed back by the operating system, determining that the operating system has a shield, and acquiring type and version information of the operating system; determining an opening command of the shield according to the type and version information of the operating system; inputting the opening command to a corresponding localized operating system address, controlling the operating system to open the shield, responding to a message indicating that the shield is removed fed back by the operating system, and sending an instruction to query the kernel log of the operating system to the operating system again to obtain the kernel log; acquiring a change log of the operating system, and determining an operation behavior of a user based on the change log and the kernel log; wherein the method further comprises decrypting the kernel log, and cleaning the decrypted kernel log by a tf-idf algorithm and a regular expression to obtain a clean kernel log; the method further comprises cleaning the change log by a tf-idf algorithm and a regular expression to obtain a clean change log; the determining of the operation behavior of the user based on the change log and the kernel log comprises merging the clean kernel log and the clean change log to obtain a log set, performing label processing on the log set to obtain a first log set, performing correlation analysis on logs in the first log set to obtain logs of the same behavior, generating a file operation log based on the logs of the same behavior, and analyzing the file operation log to determine the operation behavior of the user.

2. The method of claim 1, wherein, the label processing on the log set to obtain the first log set comprises: setting labels for logs in the log set, and marking operation behaviors contained in each log to obtain the first log set.

3. The method of claim 2, wherein, The operation behavior comprises file deletion, file movement, file editing, file copying and / or file renaming.

4. An apparatus for identifying user behavior based on multi-source logs, the apparatus comprising: The method comprises the following steps: sending an instruction to query a kernel log to an operating system by a sending module; if receiving query failure information fed back by the operating system, determining that the operating system has a shield, and acquiring type and version information of the operating system by an acquiring module; determining an opening command of the shield according to the type and version information of the operating system by a determining module; inputting the opening command to a corresponding localized operating system address, controlling the operating system to open the shield, responding to a message indicating that the shield is removed fed back by the operating system, and sending an instruction to query the kernel log of the operating system to the operating system again to obtain the kernel log by a querying module; acquiring a change log of the operating system, and determining an operation behavior of a user based on the change log and the kernel log by an analyzing module; the device is further used for decrypting the kernel log, cleaning the decrypted kernel log by a tf-idf algorithm and a regular expression to obtain a clean kernel log, and decrypting the kernel log, cleaning the decrypted kernel log by a tf-idf algorithm and a regular expression to obtain a clean kernel log. The analysis module is configured to determine the operation behavior of the user by: merging the clean kernel log and the clean change log to obtain a log set; performing tag processing on the log set to obtain a first log set; performing correlation analysis on logs in the first log set to obtain logs of the same behavior; generating a file operation log based on the logs of the same behavior; and analyzing the file operation log to determine the operation behavior of the user.

5. An electronic device comprising a memory and a processor, said memory having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-3.

6. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-3.

Images