Abnormal behavior combination identification method and system based on log records

Abstract

The present invention discloses a method and system for identifying abnormal behavior combinations based on log records. The method comprises: extracting system operation log data; taking the account of the preprocessed log data as the analysis object, generating a label sessionID of the account dimension; clustering the log data according to the label sessionID using a time series clustering algorithm to generate a label clusterID; concatenating the label sessionID and the label clusterID to obtain a cluster label label; screening out frequent item sets using a generalized sequential pattern mining algorithm and adding them to a behavior knowledge base; matching the behavior combination to be analyzed in the behavior knowledge base to identify abnormal behavior. The present invention has the advantages that the sequential pattern mining technology can be used within each cluster to discover patterns that frequently appear in a specific context, thereby avoiding misjudgment and achieving high sequence recognition accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer data security, and more specifically to a method and system for identifying combinations of abnormal behaviors based on log records. Background Technology

[0002] With the rapid development of internet technology and applications, internet behavior log data is also growing rapidly. Simultaneously, data security is becoming increasingly important. Faced with massive amounts of system log data, quickly identifying problematic behavioral combinations is one effective means of detecting data leaks. Currently, processing massive log data requires significant computing resources and time. Due to the sheer scale of log data, many methods may become inefficient on large datasets, leading to time-consuming analysis. When logs contain multi-dimensional features, the problem of dimensionality explosion may occur, meaning the number of feature combinations grows exponentially. This makes analyzing and mining anomalous behavioral combinations extremely difficult and may lead to data sparsity issues. In large-scale data, some features may appear frequently in different contexts, causing the discovered anomalous behavioral combinations to be merely common patterns in the data rather than true anomalies, potentially reducing the accuracy of the methods.

[0003] Chinese Patent Publication No. CN113901441A discloses a method, apparatus, device, and storage medium for detecting abnormal user requests. The method includes: acquiring request frequency data of different users within a preset time period; arranging the request frequency data of each user in chronological order to generate a time-series sequence; processing the time-series sequences of different users using an improved unsupervised algorithm capable of measuring the similarity between time-series data to obtain a first clustering result; and determining users with abnormal requests within the preset time period based on the number of users in each cluster of the first clustering result. This patent application cannot distinguish specific abnormal behaviors; it merely identifies users corresponding to clusters in the first clustering result with a number of users less than a preset threshold as users with abnormal requests within the preset time period, and detects the number of users with abnormal requests. Therefore, the method in this patent application cannot solve the problem of identifying abnormal behavior in massive amounts of data, and thus cannot accurately identify features that frequently appear in different contexts within large-scale data. Summary of the Invention

[0004] The technical problem to be solved by this invention is that existing abnormal behavior identification methods are prone to misjudging features of common data patterns that frequently appear in different contexts in large-scale data as abnormal behavior, resulting in inaccurate identification results.

[0005] This invention solves the above-mentioned technical problems through the following technical means: a method for identifying abnormal behavior combinations based on log records, comprising the following steps:

[0006] Step 1: Extract system operation log data and preprocess it to obtain the dataset data;

[0007] Step 2: Using the accounts in the preprocessed log data as the analysis objects, determine whether the two belong to the same category based on the time interval between adjacent logs of each account. If so, generate a label sessionID for the account dimension.

[0008] Step 3: Cluster the log data using a time-series clustering algorithm based on the session ID tag to generate new class tags. Accumulate the new class tags for each account and each session ID to generate the tag clusterID.

[0009] Step 4: Concatenate the tag fields of the tag sessionID and tag clusterID to obtain the cluster tag label;

[0010] Step 5: Analyze and merge the log data based on account, cluster label, and sequence content to obtain the processed sequence. Use the generalized sequence pattern mining algorithm to filter out frequent itemsets from the processed sequence and add the identified frequent itemsets to the behavior knowledge base.

[0011] Step Six: Match the behavioral combinations to be analyzed against the behavioral knowledge base to identify abnormal behavioral combinations.

[0012] Furthermore, the step 1 includes:

[0013] Extract system operation log data within a preset time period, mark each log record with a unique code, and sort the log data in ascending order according to the operation time to obtain the dataset data, where the dataset data includes the unique code, account, operation time, and operation content; extract the corresponding operation instructions based on the operation content to form the operation instruction field of the dataset data.

[0014] Furthermore, step two includes:

[0015] Based on the dataset data, select the operation time in the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, specify the time interval threshold T, if Δt is less than T, then the two adjacent log records belong to the same category, and record the corresponding tag sessionID.

[0016] Furthermore, step three includes:

[0017] Extract the time interval Δt of each tag sessionID object for each account, and form an array Δt1, Δt2, ..., Δt nThe array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals;

[0018] Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data;

[0019] Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

[0020] Furthermore, step five includes:

[0021] Sequence numbers are constructed using account and cluster label. The sequence content consists of operation instructions corresponding to the account and cluster label. Operation instructions corresponding to the same cluster label are merged in sequence to obtain the processed sequence. The processed sequence is then used to calculate the confidence and support of various sequence combinations using a generalized sequence pattern mining algorithm. Frequent itemsets are selected based on the set minimum confidence and minimum support, and the identified frequent itemsets are added to the behavior knowledge base.

[0022] Furthermore, step six includes:

[0023] As the operation progresses, the system continuously updates the behavior knowledge base using system operation log data. The behavior combinations to be analyzed are matched against the behavior knowledge base. If a match is found in the corresponding behavior knowledge base content, it is considered a normal behavior combination; otherwise, it is considered an abnormal behavior combination, and an alert is issued to the corresponding behavior account.

[0024] This invention also provides a log-based system for identifying combinations of abnormal behaviors, including:

[0025] The dataset acquisition module is used to extract system operation log data and preprocess it to obtain the dataset.

[0026] The first tag module is used to analyze accounts in the preprocessed log data, and to determine whether the two accounts belong to the same category based on the time interval between adjacent logs of each account. If so, it generates a tag sessionID at the account level.

[0027] The second tag module is used to cluster log data based on the tag sessionID using a time-series clustering algorithm, generate new class tags, and accumulate new class tags for each account and each sessionID to generate the tag clusterID;

[0028] The tag concatenation module is used to concatenate the tag fields of tag sessionID and tag clusterID to obtain the cluster tag label.

[0029] The knowledge base building module is used to analyze and merge log data based on account, cluster label, and sequence content to obtain processed sequences. The processed sequences are then filtered out using a generalized sequence pattern mining algorithm, and the identified frequent itemsets are added to the behavioral knowledge base.

[0030] The anomaly detection module is used to match the behaviors to be analyzed against the behavior knowledge base to identify anomalous behavior combinations.

[0031] Furthermore, the dataset acquisition module is also used for:

[0032] Extract system operation log data within a preset time period, mark each log record with a unique code, and sort the log data in ascending order according to the operation time to obtain the dataset data, where the dataset data includes the unique code, account, operation time, and operation content; extract the corresponding operation instructions based on the operation content to form the operation instruction field of the dataset data.

[0033] Furthermore, the first tag module is also used for:

[0034] Based on the dataset data, select the operation time in the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, specify the time interval threshold T, if Δt is less than T, then the two adjacent log records belong to the same category, and record the corresponding tag sessionID.

[0035] Furthermore, the second label module is also used for:

[0036] Extract the time interval Δt of each tag sessionID object for each account, and form an array Δt1, Δt2, ..., Δt n The array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals;

[0037] Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data;

[0038] Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

[0039] Furthermore, the knowledge base building module is also used for:

[0040] Sequence numbers are constructed using account and cluster label. The sequence content consists of operation instructions corresponding to the account and cluster label. Operation instructions corresponding to the same cluster label are merged in sequence to obtain the processed sequence. The processed sequence is then used to calculate the confidence and support of various sequence combinations using a generalized sequence pattern mining algorithm. Frequent itemsets are selected based on the set minimum confidence and minimum support, and the identified frequent itemsets are added to the behavior knowledge base.

[0041] Furthermore, the anomaly detection module is also used for:

[0042] As the operation progresses, the system continuously updates the behavior knowledge base using system operation log data. The behavior combinations to be analyzed are matched against the behavior knowledge base. If a match is found in the corresponding behavior knowledge base content, it is considered a normal behavior combination; otherwise, it is considered an abnormal behavior combination, and an alert is issued to the corresponding behavior account.

[0043] The advantages of this invention are as follows: By using temporal clustering, similar sequences can be grouped together to form clusters. Within each cluster, sequence pattern mining techniques can be used to discover patterns that frequently occur in specific contexts, thereby providing a better understanding of the behavior within each cluster. By combining temporal clustering and sequence pattern mining algorithms, patterns in the data can be interpreted and analyzed more deeply. Temporal clustering provides contextual information about the clusters, while sequence pattern mining provides details of the patterns within each cluster, resulting in a more comprehensive understanding of the data's behavior. The combination of these two methods enables refined clustering of behavioral log records, allowing for more detailed analysis of behavioral sequence combinations and improving the efficiency and accuracy of sequence combination identification. Attached Figure Description

[0044] Figure 1 This is a flowchart of the abnormal behavior combination identification method based on log recording disclosed in the embodiments of the present invention;

[0045] Figure 2 This is a detailed algorithm analysis process diagram of the abnormal behavior combination identification method based on log recording disclosed in the embodiments of the present invention;

[0046] Figure 3 This is a schematic diagram illustrating the analysis of log data based on account, cluster label, and sequence content in the abnormal behavior combination identification method based on log records disclosed in the embodiments of the present invention.

[0047] Figure 4 This is a schematic diagram illustrating the sequential merging of operation instructions corresponding to the same cluster label in the abnormal behavior combination identification method based on log recording disclosed in the embodiments of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example 1

[0050] like Figure 1 and Figure 2 As shown, this invention provides a method for identifying combinations of abnormal behaviors based on log records, including the following steps:

[0051] S1: Extract system operation log data and preprocess it to obtain the dataset data; the specific process is as follows:

[0052] Extract system operation log data from the past month, assign a unique code to each log record, and sort the log data in ascending order by operation time to obtain a dataset, which includes the unique code, account, operation time, and operation content. Based on the operation content, extract the corresponding operation instructions to form the operation instruction field of the dataset.

[0053] S2: Using the accounts in the preprocessed log data as the analysis objects, determine whether the two belong to the same category based on the time interval between adjacent logs for each account. If so, generate a sessionID label at the account level. The specific process is as follows:

[0054] Based on the dataset data, select the operation time from the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, and specify the time interval threshold T based on business experience. If Δt is less than T, then the two adjacent log records belong to the same category, set category labels, and record the corresponding label sessionID.

[0055] S3: Cluster the log data using a time-series clustering algorithm based on the sessionID tag to generate new cluster tags. Accumulate these new cluster tags for each account and each sessionID to generate the clusterID tag. The specific process is as follows:

[0056] Based on the data obtained in step S2, extract the time interval Δt of each tag sessionID object for each account, forming an array Δt1, Δt2, ..., Δt n The array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals;

[0057] Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data;

[0058] Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

[0059] It should be noted that time series clustering algorithms are existing technologies, belonging to the Dynamic Time Warping (DTW) based clustering category. DTW-based clustering is a technique that combines DTW methods with cluster analysis to divide time series data into similar clusters. DTW clustering aims to capture the similarity in sequence data by calculating the DTW distance between sequences, and then group similar sequences together. DTW-based clustering groups similar time series into the same cluster. By calculating the DTW distance between each pair of sequences, a distance matrix can be constructed, and then clustering algorithms (such as k-means clustering) are used to group the sequences. This invention uses existing mature time series clustering algorithms for clustering without making any improvements to the algorithms themselves; therefore, the specific algorithm details are not elaborated.

[0060] S4: Based on the label sessionID and label clusterID obtained from S2 and S3, the label fields are concatenated to obtain the final cluster label, thus realizing the cluster labeling of each log record in the dataset.

[0061] S5: Based on account, cluster label, and sequence content, log data is analyzed and merged to obtain processed sequences. The processed sequences are then used to filter out frequent itemsets using a generalized sequence pattern mining algorithm, and these frequent itemsets are added to the behavioral knowledge base. The specific process is as follows:

[0062] like Figure 3 As shown, based on the dataset `data` containing cluster labels in S4, sequence numbers are constructed using account names and cluster labels. The sequence content consists of the operation instructions corresponding to the account name and cluster label. For example... Figure 4 As shown, the operation instructions corresponding to the same cluster label are merged sequentially to obtain the processed behavior sequence. Based on the above sequence, the confidence and support of various sequence combinations are calculated using the Generalized Sequence Pattern Mining (GSP) algorithm. Frequent itemsets are then selected based on the set minimum confidence and minimum support. The identified frequent itemsets are used as the behavior knowledge base.

[0063] It should be noted that the generalized sequence pattern mining algorithm is also existing technology. This invention directly uses this algorithm to filter frequent itemsets without improving the algorithm itself; therefore, the detailed algorithm content will not be elaborated. For ease of understanding, the algorithmic approach of the existing generalized sequence pattern mining algorithm is given below:

[0064] Let sequence A = {a1, a2, ..., a...} n}, sequence B = {b1, b2, ..., b} m}, and n≤m, if there exists a sequence of numbers 1≤j1≤j2≤…≤j n ≤m satisfies Then A is called a subsequence of B, and B is called a supersequence of A. Frequent sequences are similar to frequent itemsets, that is, subsequences that appear frequently.

[0065] The GSP algorithm is similar to the Apriori algorithm, meaning that if a subsequence is infrequent, then all its supersequences are infrequent. The algorithm steps are as follows:

[0066] 1) Scan the sequence database to obtain a sequence pattern L1 of length 1, which is used as the initial seed set.

[0067] 2) Based on the seed set Li of length i, generate candidate sequence patterns Ci+1 of length i+1 through a join operation; then scan the sequence database, calculate the support of each candidate sequence pattern, generate a sequence pattern Li+1 of length i+1, and use Li+1 as the new seed set.

[0068] 3) Repeat step 2 until no new sequence patterns or new candidate sequence patterns are generated.

[0069] S6: As the operation continues, the behavior knowledge base is continuously updated using the system operation log data through steps S1 to S5, so that the behavior knowledge base includes various common patterns of data.

[0070] When anomaly identification is required, the combination of behaviors to be analyzed is matched against the behavior knowledge base. If a match can be found in the corresponding behavior knowledge base, it is considered a normal combination of behaviors; otherwise, it is considered an abnormal combination of behaviors, and an alert is issued to the corresponding behavior account.

[0071] Through the above technical solutions, this invention employs a combination of temporal clustering and sequence pattern mining algorithms to cluster massive logs based on different behavioral patterns of data objects. This divides the massive data into different clusters, and then performs data combination analysis on these clusters, improving data analysis efficiency. Temporal clustering groups similar sequences together, and sequence pattern mining can be used within each cluster to discover patterns that frequently occur in specific contexts, thus providing a better understanding of the behavior within each cluster. Combining these two methods allows for a deeper interpretation and analysis of patterns in the data. Temporal clustering provides contextual information about the clusters, while sequence pattern mining provides details of the patterns within each cluster, leading to a more comprehensive understanding of the data's behavior. Refined clustering of behavioral log records can refine behavioral sequence combinations, improving the efficiency and accuracy of sequence combination identification.

[0072] Example 2

[0073] Based on Embodiment 1, Embodiment 2 of the present invention also provides an abnormal behavior combination recognition system based on log recording, including:

[0074] The dataset acquisition module is used to extract system operation log data and preprocess it to obtain the dataset.

[0075] The first tag module is used to analyze accounts in the preprocessed log data, and to determine whether the two accounts belong to the same category based on the time interval between adjacent logs of each account. If so, it generates a tag sessionID at the account level.

[0076] The second tag module is used to cluster log data based on the tag sessionID using a time-series clustering algorithm, generate new class tags, and accumulate new class tags for each account and each sessionID to generate the tag clusterID;

[0077] The tag concatenation module is used to concatenate the tag fields of tag sessionID and tag clusterID to obtain the cluster tag label.

[0078] The knowledge base building module is used to analyze and merge log data based on account, cluster label, and sequence content to obtain processed sequences. The processed sequences are then filtered out using a generalized sequence pattern mining algorithm, and the identified frequent itemsets are added to the behavioral knowledge base.

[0079] The anomaly detection module is used to match the behaviors to be analyzed against the behavior knowledge base to identify anomalous behavior combinations.

[0080] Specifically, the dataset acquisition module is also used for:

[0081] Extract system operation log data within a preset time period, mark each log record with a unique code, and sort the log data in ascending order according to the operation time to obtain the dataset data, where the dataset data includes the unique code, account, operation time, and operation content; extract the corresponding operation instructions based on the operation content to form the operation instruction field of the dataset data.

[0082] Specifically, the first tag module is also used for:

[0083] Based on the dataset data, select the operation time in the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, specify the time interval threshold T, if Δt is less than T, then the two adjacent log records belong to the same category, and record the corresponding tag sessionID.

[0084] Specifically, the second tag module is also used for:

[0085] Extract the time interval Δt of each tag sessionID object for each account, and form an array Δt1, Δt2, ..., Δt n The array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals;

[0086] Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data;

[0087] Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

[0088] Specifically, the knowledge base building module is also used for:

[0089] Sequence numbers are constructed using account and cluster label. The sequence content consists of operation instructions corresponding to the account and cluster label. Operation instructions corresponding to the same cluster label are merged in sequence to obtain the processed sequence. The processed sequence is then used to calculate the confidence and support of various sequence combinations using a generalized sequence pattern mining algorithm. Frequent itemsets are selected based on the set minimum confidence and minimum support, and the identified frequent itemsets are added to the behavior knowledge base.

[0090] Specifically, the anomaly detection module is also used for:

[0091] As the operation progresses, the system continuously updates the behavior knowledge base using system operation log data. The behavior combinations to be analyzed are matched against the behavior knowledge base. If a match is found in the corresponding behavior knowledge base content, it is considered a normal behavior combination; otherwise, it is considered an abnormal behavior combination, and an alert is issued to the corresponding behavior account.

[0092] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for identifying combinations of abnormal behaviors based on log recordings, characterized in that, Includes the following steps: Step 1: Extract system operation log data and preprocess it to obtain the dataset data; Step 2: Using the accounts in the preprocessed log data as the analysis objects, determine whether the two belong to the same category based on the time interval between adjacent logs of each account. If so, generate a label sessionID for the account dimension. Step 3: Cluster the log data using a time-series clustering algorithm based on the session ID tag to generate new class tags. Accumulate the new class tags for each account and each session ID to generate the tag clusterID. Step 4: Concatenate the tag fields of the tag sessionID and tag clusterID to obtain the cluster tag label; Step 5: Analyze and merge the log data based on account, cluster label, and sequence content to obtain the processed sequence. Use the generalized sequence pattern mining algorithm to filter out frequent itemsets from the processed sequence and add the identified frequent itemsets to the behavior knowledge base. Step Six: Match the behavioral combinations to be analyzed against the behavioral knowledge base to identify abnormal behavioral combinations.

2. The method for identifying abnormal behavior combinations based on log recording according to claim 1, characterized in that, Step one includes: Extract system operation log data within a preset time period, mark each log record with a unique code, and sort the log data in ascending order according to the operation time to obtain the dataset data, where the dataset data includes the unique code, account, operation time, and operation content; extract the corresponding operation instructions based on the operation content to form the operation instruction field of the dataset data.

3. The method for identifying abnormal behavior combinations based on log recording according to claim 1, characterized in that, Step two includes: Based on the dataset data, select the operation time in the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, specify the time interval threshold T, if Δt is less than T, then the two adjacent log records belong to the same category, and record the corresponding tag sessionID.

4. The method for identifying abnormal behavior combinations based on log recording according to claim 1, characterized in that, Step three includes: Extract the time interval Δt of each tag sessionID object for each account, and form an array Δt1, Δt2, ..., Δt n The array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals; Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data; Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

5. The method for identifying abnormal behavior combinations based on log recording according to claim 1, characterized in that, Step five includes: Sequence numbers are constructed using account and cluster label. The sequence content consists of operation instructions corresponding to the account and cluster label. Operation instructions corresponding to the same cluster label are merged in sequence to obtain the processed sequence. The processed sequence is then used to calculate the confidence and support of various sequence combinations using a generalized sequence pattern mining algorithm. Frequent itemsets are selected based on the set minimum confidence and minimum support, and the identified frequent itemsets are added to the behavior knowledge base.

6. The method for identifying abnormal behavior combinations based on log recording according to claim 1, characterized in that, Step six includes: As the operation progresses, the system continuously updates the behavior knowledge base using system operation log data. The behavior combinations to be analyzed are matched against the behavior knowledge base. If a match is found in the corresponding behavior knowledge base content, it is considered a normal behavior combination; otherwise, it is considered an abnormal behavior combination, and an alert is issued to the corresponding behavior account.

7. An abnormal behavior combination recognition system based on log recording, characterized in that, include: The dataset acquisition module is used to extract system operation log data and preprocess it to obtain the dataset. The first tag module is used to analyze accounts in the preprocessed log data, and to determine whether the two accounts belong to the same category based on the time interval between adjacent logs of each account. If so, it generates a tag sessionID at the account level. The second tag module is used to cluster log data based on the tag sessionID using a time-series clustering algorithm, generate new class tags, and accumulate new class tags for each account and each sessionID to generate the tag clusterID; The tag concatenation module is used to concatenate the tag fields of tag sessionID and tag clusterID to obtain the cluster tag label. The knowledge base building module is used to analyze and merge log data based on account, cluster label, and sequence content to obtain processed sequences. The processed sequences are then filtered out using a generalized sequence pattern mining algorithm, and the identified frequent itemsets are added to the behavioral knowledge base. The anomaly detection module is used to match the behaviors to be analyzed against the behavior knowledge base to identify anomalous behavior combinations.

8. The abnormal behavior combination recognition system based on log recording according to claim 7, characterized in that, The dataset acquisition module is also used for: Extract system operation log data within a preset time period, mark each log record with a unique code, and sort the log data in ascending order according to the operation time to obtain the dataset data, where the dataset data includes the unique code, account, operation time, and operation content; Based on the operation content, extract the corresponding operation instructions to form the operation instruction field of the dataset.

9. The abnormal behavior combination recognition system based on log recording according to claim 7, characterized in that, The first tag module is also used for: Based on the dataset data, select the operation time in the system operation log data, take the account as the analysis object, calculate the time interval Δt between two adjacent log records for each account, specify the time interval threshold T, if Δt is less than T, then the two adjacent log records belong to the same category, and record the corresponding tag sessionID.

10. The abnormal behavior combination recognition system based on log recording according to claim 7, characterized in that, The second tag module is also used for: Extract the time interval Δt of each tag sessionID object for each account, and form an array Δt1, Δt2, ..., Δt n The array is clustered using a time-series clustering algorithm, with three clustering categories to obtain class labels for different record time intervals; Based on the class labels, calculate the mean time interval for each class, sort them in ascending order according to the mean, and assign 0, 1, 2 to the values ​​from smallest to largest to form new class labels for the dataset data; Based on the new category tags, the new category tags are accumulated according to the sessionID of each tag for each account, and a tag clusterID is generated.

Images