Method, device, electronic equipment and readable medium for analyzing web logs

Abstract

The present disclosure provides a network log analysis method, device, electronic equipment and readable medium, wherein the network log analysis method comprises: obtaining an attribute parameter of a rule matched with the network log; determining a dimension characteristic value of the rule according to the attribute parameter; determining a matching priority of the rule according to the dimension characteristic value and a preset dimension weighting; determining a target rule for analyzing the network log according to the matching priority; and analyzing the network log through the target rule. Through the embodiments of the present disclosure, the probability and timeliness of successful matching of the rule and a large number of network logs are improved, and thus the efficiency and reliability of analyzing and processing the network log are also improved, and the network security is improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and more specifically, to a method, apparatus, electronic device, and readable medium for analyzing network logs. Background Technology

[0002] Currently, organizations with IT infrastructure are vulnerable to internal security attacks, and network losses are equivalent to hacker gains: access to confidential data, misuse of retrieved information, system crashes, and so on. Extensive research indicates that most security policy violations occur within the enterprise. As a proactive measure to achieve internal security, it is essential to monitor every system activity recorded as an event log. This includes managing the collection of large amounts of event logs and the pressure of categorizing security logs for security purposes and system performance. Enterprise network security logs are of significant importance in network security analysis.

[0003] In related technologies, a random, one-to-one matching mode is adopted when matching network security logs with collection rules.

[0004] However, existing methods for matching and analyzing network security logs have at least the following shortcomings:

[0005] This pattern increases the number of useless matches, and since the size of security logs is usually quite large, it is difficult to parse them efficiently.

[0006] In the worst-case scenario, the data stream will match each rule once, only detecting an event after all rules have been matched. If the security logs are massive, matching each matchable data entry against every rule would be extremely time-consuming, thus reducing the efficiency of security log analysis.

[0007] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0008] The purpose of this disclosure is to provide a method, apparatus, electronic device, and readable medium for analyzing network logs, which at least partially overcomes the problem of low efficiency in matching network logs with rules due to limitations and defects in related technologies.

[0009] According to a first aspect of the present disclosure, a method for analyzing network logs is provided, comprising: obtaining attribute parameters of rules for matching network logs; determining dimensional feature values ​​of the rules based on the attribute parameters; determining a matching priority of the rules based on the dimensional feature values ​​and a preset dimensional weighting; determining a target rule for analyzing the network logs according to the matching priority; and analyzing the network logs using the target rule.

[0010] In one exemplary embodiment of this disclosure, determining the dimensional feature value of the rule based on the attribute parameter includes: determining the number of successful matches of the rule within a specified time period based on the attribute parameter; determining the frequency at which the rule hits the network log based on the number of successful matches, denoted as the match hit frequency; and determining the match hit frequency as the first dimensional feature value of the attribute parameter.

[0011] In an exemplary embodiment of this disclosure, determining the dimensional feature value of the rule based on the attribute parameters further includes: determining the time interval between the current time of the rule and the last successful match time based on the attribute parameters; determining the frequency at which the rule hits the network log based on the time interval and a preset time interval threshold, denoted as the matching time frequency; and determining the matching time frequency as the second dimensional feature value of the attribute parameters.

[0012] In an exemplary embodiment of this disclosure, determining the dimensional feature value of the rule based on the attribute parameters further includes: determining the character length of the rule, the number of greedily matched characters, and the number of non-greedy matched characters based on the attribute parameters; determining the complexity of the rule based on the character length, the number of greedily matched characters, and the number of non-greedy matched characters; and determining the complexity as the third dimensional feature value of the attribute parameters.

[0013] In one exemplary embodiment of this disclosure, determining the matching priority of the rule based on the dimensional feature value and a preset dimensional weight includes: determining multiple dimensional feature values ​​corresponding to the attribute parameter; determining a preset dimensional weight corresponding to each dimensional feature value; performing a weighted summation on the dimensional feature value and the preset dimensional weight; and determining the matching priority based on the result of the weighted summation.

[0014] In one exemplary embodiment of this disclosure, the method further includes: determining timestamp information of the rule; determining an update time interval of the rule based on the timestamp information; if the update time interval is determined to exceed a preset time interval, updating the dimensional feature value of the rule; and updating the timestamp information of the rule based on the updated time.

[0015] In an exemplary embodiment of this disclosure, if it is determined that the update time interval exceeds a preset time interval, updating the dimensional feature value of the rule includes: if it is determined that the update time interval exceeds the preset time interval, determining the number of successful matches of the rule within the preset time interval; determining whether the number of successful matches is less than or equal to a preset number of successful matches; if it is determined that the number of successful matches is less than or equal to the preset number of successful matches, logically deleting the rule; if it is determined that the number of successful matches is greater than the preset number of successful matches, updating the matching priority of the rule according to the dimensional feature value and a preset dimensional weight.

[0016] According to a second aspect of the present disclosure, a network log analysis apparatus is provided, comprising: an acquisition module, configured to acquire attribute parameters of rules for matching network logs; a determination module, configured to determine dimensional feature values ​​of the rules based on the attribute parameters; the determination module is further configured to determine a matching priority of the rules based on the dimensional feature values ​​and a preset dimensional weighting; the determination module is further configured to determine a target rule for analyzing the network logs according to the matching priority; and an analysis module, configured to analyze the network logs using the target rule.

[0017] According to a third aspect of this disclosure, an electronic device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to perform the method as described in any of the preceding methods based on instructions stored in the memory.

[0018] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a program stored thereon that, when executed by a processor, implements the network log analysis method as described in any of the preceding claims.

[0019] In this embodiment, the matching priority of the rule is determined by weighting the dimensional feature value and the preset dimension, and the target rule for analyzing the network log is determined according to the matching priority. Finally, the network log is analyzed using the target rule, thereby determining the priority of the rule for matching the network log. This improves the matching efficiency of the network log, reduces the computational load of the rule engine in the matching process, and improves the application efficiency of the rule database.

[0020] Furthermore, by updating the dimensional feature values ​​of the rules, not only can the matching priority of the rules be updated in a timely manner, but rules with low matching rates can also be logically deleted. Deleted rules are not matched with network logs, reducing the probability of rule matching failure.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 A flowchart illustrating a method for analyzing network logs in an exemplary embodiment of this disclosure is shown;

[0024] Figure 2 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0025] Figure 3 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0026] Figure 4 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0027] Figure 5 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0028] Figure 6 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0029] Figure 7 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0030] Figure 8 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0031] Figure 9 A flowchart illustrating a method for analyzing network logs in another exemplary embodiment of this disclosure is shown;

[0032] Figure 10 A block diagram of a network log analysis apparatus according to an exemplary embodiment of the present disclosure is shown;

[0033] Figure 11 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown. Detailed Implementation

[0034] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0035] Furthermore, the accompanying drawings are merely illustrative of this disclosure, and the same reference numerals in the drawings denote the same or similar parts, thus repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0036] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0037] Figure 1 This is a flowchart of a method for analyzing network logs in an exemplary embodiment of this disclosure.

[0038] refer to Figure 1 Methods for analyzing network logs can include:

[0039] Step S102: Obtain the attribute parameters of the rules for matching network logs.

[0040] Step S104: Determine the dimensional feature value of the rule based on the attribute parameters.

[0041] Step S106: Determine the matching priority of the rule based on the dimensional feature value and the preset dimensional weighting.

[0042] Step S108: Determine the target rules for analyzing the network logs according to the matching priority.

[0043] Step S110: Analyze the network logs using the target rules.

[0044] In this embodiment, the matching priority of the rule is determined by weighting the dimensional feature value and the preset dimension, and the target rule for analyzing the network log is determined according to the matching priority. Finally, the network log is analyzed using the target rule, thereby determining the priority of the rule for matching the network log. This improves the matching efficiency of the network log, reduces the computational load of the rule engine in the matching process, and improves the application efficiency of the rule database.

[0045] The following is combined Figures 2 to 9 This paper provides a detailed explanation of each step in the analysis method for network logs.

[0046] like Figure 2 As shown, determining the dimensional feature values ​​of the rule based on the attribute parameters includes:

[0047] Step S202: Determine the number of successful matches of the rule within a specified time period based on the attribute parameters.

[0048] Step S204: Determine the frequency at which the rule hits the network log based on the number of successful matches, and record it as the match hit frequency.

[0049] Step S206: The matching hit frequency is determined as the first dimension feature value of the attribute parameter.

[0050] In one exemplary embodiment of this disclosure, the preset time period can be a month, a quarter, or a year, but is not limited thereto.

[0051] In one exemplary embodiment of this disclosure, the frequency at which a rule hits the network log is the frequency at which the rule can analyze the network log.

[0052] like Figure 3 As shown, determining the dimensional feature values ​​of the rule based on the attribute parameters further includes:

[0053] Step S302: Determine the time interval between the current time of the rule and the last successful match time based on the attribute parameters.

[0054] Step S304: Determine the frequency at which the rule hits the network log based on the time interval and the preset time interval threshold, and record it as the matching time frequency.

[0055] Step S306: The matching time frequency is determined as the second dimension feature value of the attribute parameter.

[0056] In one exemplary embodiment of this disclosure, the preset time interval threshold can be a month, a quarter, or a year, but is not limited thereto.

[0057] In one exemplary embodiment of this disclosure, the matching time frequency is determined based on the ratio between the rule's time interval and the preset time interval, which also reflects the rule's hit frequency to some extent.

[0058] like Figure 4 As shown, determining the dimensional feature values ​​of the rule based on the attribute parameters further includes:

[0059] Step S402: Determine the character length of the rule, the number of greedily matched characters, and the number of non-greedy matched characters based on the attribute parameters.

[0060] In one exemplary embodiment of this disclosure, the greedy matching rule refers to the regular expression generally tending to match the longest length, and the greedy matching character is the character determined by the greedy matching rule.

[0061] In one exemplary embodiment of this disclosure, the non-greedy matching rule means that as long as a result is matched, the string should be as short as possible. The non-greedy matching character is the character matched by the non-greedy matching rule.

[0062] Step S404: Determine the complexity of the rule based on the character length, the number of greedily matched characters, and the number of non-greedy matched characters.

[0063] Step S406: The complexity is determined as the third dimension feature value of the attribute parameter.

[0064] In one exemplary embodiment of this disclosure, the complexity of the rule is determined by the character length, the number of greedily matched characters, and the number of non-greedy matched characters, thereby reflecting the complexity of the rule matching network logs from the perspective of character complexity.

[0065] like Figure 5 As shown, determining the matching priority of the rule based on the dimensional feature value and a preset dimensional weighting includes:

[0066] Step S502: Determine the multiple dimensional feature values ​​corresponding to the attribute parameters.

[0067] Step S504: Determine the preset dimension weighting corresponding to each dimension feature value.

[0068] Step S506: Perform a weighted summation of the dimensional feature values ​​and the preset dimensional weights.

[0069] Step S508: Determine the matching priority based on the result of the weighted summation.

[0070] In one exemplary embodiment of this disclosure, the matching priority is determined by weighting the dimensional feature value with the preset dimensional weight and then controlling the matching of network logs according to the matching priority from high to low.

[0071] like Figure 6 As shown, network log analysis methods also include:

[0072] Step S602: Determine the timestamp information of the rule.

[0073] Step S604: Determine the update time interval of the rule based on the timestamp information.

[0074] Step S606: If it is determined that the update time interval exceeds the preset time interval, then the dimensional feature values ​​of the rule are updated.

[0075] Step S608: Update the timestamp information of the rule according to the updated time.

[0076] In one exemplary embodiment of this disclosure, the timestamp information is updated after each rule update. The timestamp information and a preset time interval are used to determine whether the rule should be updated. If the update time interval exceeds the preset time interval, the dimensional feature values ​​of the rule are updated.

[0077] In one exemplary embodiment of this disclosure, the preset time interval is one day, one week, one month, one quarter, and one year, etc., but is not limited thereto.

[0078] like Figure 7 As shown, if it is determined that the update time interval exceeds a preset time interval, then updating the dimensional feature values ​​of the rule includes:

[0079] Step S702: If it is determined that the update time interval exceeds the preset time interval, then determine the number of successful matches of the rule within the preset time interval. If yes, then proceed to step S706; otherwise, proceed to step S708.

[0080] Step S704: Determine whether the number of successful matches is less than or equal to the preset number of successful matches.

[0081] Step S706: If the number of successful matches is determined to be less than or equal to the preset number of successful matches, then the rule is logically deleted.

[0082] Step S708: If it is determined that the number of successful matches is greater than the preset number of successful matches, then the matching priority of the rule is updated according to the dimension feature value and the preset dimension weighting.

[0083] In one exemplary embodiment of this disclosure, if it is determined that the number of successful matches is less than or equal to the preset number of successful matches, the rule is logically deleted. The logically deleted rule is not matched with the network log, thereby reducing the probability of matching failure.

[0084] In one exemplary embodiment of this disclosure, if it is determined that the number of successful matches is greater than the preset number of successful matches, the matching priority of the rule is updated according to the dimension feature value and the preset dimension weighting, thereby updating the matching priority of the rule in a timely and flexible manner.

[0085] like Figure 8 As shown, network log analysis methods also include:

[0086] Step S802: Obtain the attribute parameters of the rule from the rule database.

[0087] In one exemplary embodiment of this disclosure, the number of matching times, time interval, rule character length, number of greedy characters and number of non-greedy characters of a rule are extracted from the rule database, but are not limited thereto.

[0088] Step S804: Calculate feature values. The attribute parameters include the number of matches, the matching interval, and the matching complexity.

[0089] In one exemplary embodiment of this disclosure, calculating the feature value includes the following steps:

[0090] a. Calculate the hit frequency: Calculate the probability P1 of the rule hitting a match in this dimension by using the number of successful matches C1 in the most recent period (one year).

[0091] b. Calculate the time interval of a successful match: Each rule records the time interval C2 of the most recent successful match, and calculates the probability P2 of that rule in this dimension.

[0092] c. Calculate rule complexity: Each rule describes the complexity of the rule. Taking regular expression rules as an example, the complexity includes character length s1, number of greedy matching characters s2, and number of non-greedy matching characters s3. The complexity C3 is determined based on character length s1, number of greedy matching characters s2, and number of non-greedy matching characters s3.

[0093] d. The expression for calculating the weighted sum F of any rule across all dimensions includes: F = a1 × P1 + a2 × P2 + a3 × C3. F determines the priority score of the rule. a1, a2, and a3 are preset weights for the dimensions. When matching rules with web logs, rules with higher priority scores are matched first, thereby improving the efficiency of rule matching.

[0094] Step S806: Match the network logs according to the matching priority of the rules, and analyze them after a successful match.

[0095] Step S808: Regularly maintain the rules.

[0096] In one exemplary embodiment of this disclosure, rules are cleaned up periodically. Based on the timestamp information carried by the rules, rule data that has exceeded a certain time is retrieved from the rule database, expired rules are initialized, relevant indicators are cleared, and rules with a total number of matches of 0 are logically deleted.

[0097] like Figure 9 As shown, network log analysis methods also include:

[0098] Step S902: Rule information preprocessing.

[0099] Step S904: Adjust the matching order based on priority.

[0100] Step S906: The complexity is determined as the third dimension feature value of the attribute parameter. The matching priority of rule 1 is priority 1, the matching priority of rule 2 is priority 2, ..., the matching priority of rule n is priority n, and the network logs are matched according to the priority.

[0101] Corresponding to the above method embodiments, this disclosure also provides a network log analysis apparatus, which can be used to execute the above method embodiments.

[0102] Figure 10 This is a block diagram of a network log analysis apparatus according to an exemplary embodiment of the present disclosure.

[0103] refer to Figure 10 The network log analysis device 1000 may include:

[0104] The acquisition module 1002 is used to obtain the attribute parameters of the rules for matching network logs.

[0105] The determination module 1004 is used to determine the dimensional feature value of the rule based on the attribute parameters.

[0106] The determining module 1004 is further configured to determine the matching priority of the rule based on the dimensional feature value and a preset dimensional weighting.

[0107] The determining module 1004 is further configured to determine the target rules for analyzing the network logs according to the matching priority.

[0108] Analysis module 1006 is used to analyze the network logs according to the target rules.

[0109] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: determine the number of successful matches of the rule within a specified time period based on the attribute parameter; determine the frequency at which the rule hits the network log based on the number of successful matches, denoted as the match hit frequency; and determine the match hit frequency as the first dimension feature value of the attribute parameter.

[0110] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: determine the time interval between the current time of the rule and the last successful match time according to the attribute parameter; determine the frequency at which the rule hits the network log according to the time interval and a preset time interval threshold, and denot it as the matching time frequency; and determine the matching time frequency as the second dimension feature value of the attribute parameter.

[0111] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: determine the character length of the rule, the number of greedily matched characters, and the number of non-greedy matched characters according to the attribute parameters; determine the complexity of the rule according to the character length, the number of greedily matched characters, and the number of non-greedy matched characters; and determine the complexity as a third-dimensional feature value of the attribute parameters.

[0112] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: determine multiple dimensional feature values ​​corresponding to the attribute parameter; determine a preset dimensional weighting corresponding to each dimensional feature value; perform a weighted summation on the dimensional feature value and the preset dimensional weighting; and determine the matching priority based on the result of the weighted summation.

[0113] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: determine the timestamp information of the rule; determine the update time interval of the rule based on the timestamp information; if the update time interval is determined to exceed a preset time interval, update the dimensional feature value of the rule; and update the timestamp information of the rule based on the updated time.

[0114] In an exemplary embodiment of this disclosure, the determining module 1004 is further configured to: if it is determined that the update time interval exceeds a preset time interval, determine the number of successful matches of the rule within the preset time interval; determine whether the number of successful matches is less than or equal to a preset number of successful matches; if it is determined that the number of successful matches is less than or equal to the preset number of successful matches, logically delete the rule; if it is determined that the number of successful matches is greater than the preset number of successful matches, update the matching priority of the rule according to the dimension feature value and a preset dimension weighting.

[0115] Since the functions of the device 1000 have been described in detail in their corresponding method embodiments, they will not be repeated here.

[0116] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0117] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0118] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0119] The following reference Figure 11 To describe an electronic device 1100 according to this embodiment of the present invention. Figure 11 The electronic device 1100 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0120] like Figure 11 As shown, the electronic device 1100 is manifested in the form of a general-purpose computing device. The components of the electronic device 1100 may include, but are not limited to: at least one processing unit 1110, at least one storage unit 1120, and a bus 1130 connecting different system components (including storage unit 1120 and processing unit 1110).

[0121] The storage unit stores program code that can be executed by the processing unit 1110, causing the processing unit 1110 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 1110 can perform the method shown in the embodiments of this disclosure.

[0122] Storage unit 1120 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 11201 and / or cache memory 11202, and may further include a read-only memory (ROM) 11203.

[0123] Storage unit 1120 may also include a program / utility 11204 having a set (at least one) of program modules 11205, such program modules 11205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0124] Bus 1130 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0125] Electronic device 1100 can also communicate with one or more external devices 1140 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 1100, and / or with any device that enables electronic device 1100 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1150. Furthermore, electronic device 1100 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1160. As shown, network adapter 1160 communicates with other modules of electronic device 1100 via bus 1130. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0126] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0127] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0128] The program product for implementing the above-described method according to embodiments of the present invention may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0129] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0130] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0131] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0132] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0133] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0134] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and concept of this disclosure are indicated by the claims.

Claims

1. A method for analyzing network logs, characterized in that, include: Retrieve the attribute parameters of the rules that match network logs; Determining the dimensional feature values ​​of the rule based on the attribute parameters includes: The number of successful matches of the rule within a specified time period is determined based on the attribute parameters. The frequency at which the rule hits the network log is determined based on the number of successful matches, and is denoted as the match hit frequency. The matching hit frequency is determined as the first dimension feature value of the attribute parameter; Alternatively, the time interval between the current time of the rule and the last successful match can be determined based on the attribute parameters; The frequency at which the rule hits the network log is determined based on the time interval and the preset time interval threshold, and is denoted as the matching time frequency. The matching time frequency is determined as the second dimension feature value of the attribute parameter; The character length, the number of greedily matched characters, and the number of non-greedy matched characters of the rule are determined based on the attribute parameters. The complexity of the rule is determined based on the character length, the number of greedily matched characters, and the number of non-greedy matched characters. The complexity is determined as the third dimension feature value of the attribute parameter; The matching priority of the rule is determined based on the dimensional feature value and a preset dimensional weighting. The target rules for analyzing the network logs are determined according to the matching priority. The network logs are analyzed using the target rules.

2. The network log analysis method as described in claim 1, characterized in that, Determining the matching priority of the rule based on the dimensional feature values ​​and a preset dimensional weighting includes: Determine the multiple dimensional feature values ​​corresponding to the attribute parameters; Determine the preset dimensional weighting corresponding to each of the dimensional feature values; The dimensional feature values ​​are weighted and summed with the preset dimensional weights. The matching priority is determined based on the result of the weighted summation.

3. The network log analysis method as described in claim 1, characterized in that, Also includes: Determine the timestamp information of the rule; The update time interval of the rule is determined based on the timestamp information; If it is determined that the update time interval exceeds the preset time interval, then the dimensional feature values ​​of the rule are updated; The timestamp information of the rule is updated according to the updated time.

4. The network log analysis method as described in claim 3, characterized in that, If it is determined that the update time interval exceeds a preset time interval, then updating the dimensional feature values ​​of the rule includes: If it is determined that the update time interval exceeds a preset time interval, then the number of successful matches of the rule within the preset time interval is determined; Determine whether the number of successful matches is less than or equal to the preset number of successful matches; If the number of successful matches is determined to be less than or equal to the preset number of successful matches, then the rule is logically deleted. If the number of successful matches is determined to be greater than the preset number of successful matches, the matching priority of the rule is updated according to the dimensional feature value and the preset dimensional weighting.

5. A device for analyzing network logs, characterized in that, include: The acquisition module is used to obtain the attribute parameters of the rules for matching network logs; The determining module is used to determine the dimensional feature values ​​of the rule based on the attribute parameters, including: The number of successful matches of the rule within a specified time period is determined based on the attribute parameters. The frequency at which the rule hits the network log is determined based on the number of successful matches, and is denoted as the match hit frequency. The matching hit frequency is determined as the first dimension feature value of the attribute parameter; Alternatively, the time interval between the current time of the rule and the last successful match can be determined based on the attribute parameters; The frequency at which the rule hits the network log is determined based on the time interval and the preset time interval threshold, and is denoted as the matching time frequency. The matching time frequency is determined as the second dimension feature value of the attribute parameter; The character length, the number of greedily matched characters, and the number of non-greedy matched characters of the rule are determined based on the attribute parameters. The complexity of the rule is determined based on the character length, the number of greedily matched characters, and the number of non-greedy matched characters. The complexity is determined as the third dimension feature value of the attribute parameter; The determining module is further configured to determine the matching priority of the rule based on the dimensional feature value and a preset dimensional weighting. The determining module is further configured to determine the target rules for analyzing the network logs according to the matching priority. The analysis module is used to analyze the network logs according to the target rules.

6. An electronic device, characterized in that, include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the network log analysis method as described in any one of claims 1-4 based on instructions stored in the memory.

7. A computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the method for analyzing network logs as described in any one of claims 1-4.

Images