A log management method

Abstract

The invention relates to the field of log management, and in particular to a log management method. The invention obtains feature information of created log events in real time through a log database, calculates correlation characterization parameters between log events according to content correlation features of corresponding context information between log events and timestamp differences, clusters each log event to obtain a plurality of cluster log sets, monitors access port traffic fluctuations of the log database, and calculates abnormal tendency characterization parameters of each log event in combination with access frequency for a single log event, so as to determine whether to trigger correlation response protection for the cluster log set, authorize an access terminal to access the cluster log set, restore disguised context information through a received exchange record sequence, synchronously verify the consistency between the context information obtained after restoration and the corresponding context information before cutting, and determine whether to lock the cluster log set, thereby reducing the abnormal risk of log events and improving the security of log events.

Description

Technical Field

[0001] The present invention relates to the field of log management, and in particular to a log management method. Background Art

[0002] Against the backdrop of increasing cybersecurity threats, identifying potential risks and abnormal behaviors through analyzing log data and helping to detect and respond to security incidents have become key capabilities required for log management. At the same time, log management can also monitor system performance indicators, discover performance bottlenecks through analyzing log data, and then optimize system configuration and resource allocation. In order to meet the growing time requirements, log management methods are also constantly evolving.

[0003] Chinese Patent Publication No.: CN116303253A, discloses an event log management, the system is configured to obtain one or more event logs associated with a tenant of the system, the system can be configured to determine an event rate associated with the tenant based on the one or more event logs, and thereby determine a rotation interval based on the event rate, the system can be configured to enable a data structure to be generated based on the rotation interval for storing event logs associated with the tenant obtained during a time window, the system can be configured to obtain one or more additional event logs associated with the tenant within the time window, and based on obtaining one or more additional event logs within the time window, enable one or more additional event logs to be stored in the data structure.

[0004] However, the prior art still has the following problems:

[0005] Since log events may be related and have a certain degree of dependence, it is easy for tamperers and thieves to attack related or dependent log events. In actual situations, after the relevant records of a single log event are tampered with or stolen, the risk of related log events related to or dependent on it being tampered with and stolen will be higher. In the prior art, no targeted protection measures are taken for related log events, resulting in low security of log event related records. Summary of the invention

[0006] To this end, the present invention provides a log management method to overcome the problem in the prior art that after the relevant records of a single log event are tampered with or stolen, the risk of related log events associated or dependent thereon being tampered with and stolen is high, and in the prior art, no targeted protective measures are taken for the related log events, resulting in low security of the related records of the log events.

[0007] To achieve the above object, the present invention provides a log management method, which includes:

[0008] The log database obtains the characteristic information of the created log events in real time, including the creation timestamp and the context information describing the log events;

[0009] Calculating correlation characterization parameters between log events according to content correlation features of corresponding context information between log events and timestamp differences, clustering the log events based on the correlation characterization parameters to obtain a plurality of clustered log sets;

[0010] Monitoring the access port traffic fluctuation of the log database and calculating the abnormal tendency characterization parameter of each log event in combination with the access frequency of a single log event to determine whether to trigger the associated response protection for the cluster log set, including:

[0011] The context information of each of the log events is cut at a corresponding cutting granularity, a serial number label is set for the obtained cutting fragments, the cutting fragments corresponding to each of the log events are exchanged and spliced ​​at a corresponding extraction ratio to obtain a plurality of disguised context information, and the exchange record sequence of the exchanged cutting fragments is synchronously recorded for distribution to the authorized access terminal, wherein the cutting granularity and the extraction ratio of the cutting fragments are respectively determined based on the abnormal tendency characterization parameter;

[0012] The authorized access end accesses the cluster log set, restores the disguised context information through the received exchange record sequence, synchronously verifies the consistency of the restored context information with the corresponding pre-cut context information, and determines whether to lock the cluster log set.

[0013] Furthermore, the process of determining the content association features of the corresponding context information between log events includes:

[0014] Determine the components referenced in the corresponding context information between log events and compare the number of overlapping components;

[0015] Extract repeated keywords from the corresponding context information between log events and calculate the keyword overlap.

[0016] Furthermore, the correlation characterization parameters between log events are calculated according to formula (1):

[0017]

[0018] In formula (1), R represents the correlation characterization parameter between log events, C represents the number of overlapping components, C0 represents the preset standard threshold of the number of overlapping components, D represents the keyword overlap, D0 represents the preset standard threshold of the keyword overlap, S represents the timestamp difference, and S0 represents the preset timestamp difference standard threshold.

[0019] Furthermore, each log event is clustered, wherein the correlation representation parameters between any log events in each obtained clustered log set are all greater than a predetermined correlation representation parameter standard threshold.

[0020] Furthermore, the abnormal tendency characterization parameter of the log event is calculated according to formula (2):

[0021]

[0022] In formula (2), H represents the parameter characterizing the abnormal tendency of the log event, F represents the access frequency for the log event, F0 represents the preset access frequency standard threshold, Mi represents the access port flow at the i-th moment, ΔM represents the mean of the access port flow at each moment within a predetermined time period, and T represents the predetermined time period. Further, determining whether to trigger the associated response protection for the clustered log set includes:

[0023] If the abnormal tendency characterization parameter is greater than or equal to a preset abnormal tendency characterization parameter standard threshold, an associated response protection for the cluster log set is triggered.

[0024] Furthermore, the set serial number label includes a main label and a sub-label, the main label is the sequential serial number of the log event, and the sub-label is the sequential serial number of the cut fragments in the context information corresponding to the log event.

[0025] Furthermore, the cut fragments corresponding to each of the log events are exchanged and spliced ​​to obtain a plurality of exchange record sequences of disguised context information, the process comprising:

[0026] Selecting a number of log event groups from the clustered log set;

[0027] Exchanging and splicing the shuffled fragments in the context information corresponding to each log event of the log event group to obtain disguised context information for the log event group;

[0028] The shuffled segments are cut fragments extracted from the context information and shuffled and spliced ​​in a random order;

[0029] The exchange record sequence includes the scrambled order records of each scrambled segment and the serial number labels of the cut fragments in each scrambled segment.

[0030] Further, the cutting granularity and the extraction ratio of the cutting fragments are determined, wherein,

[0031] The determined cutting granularity is negatively correlated with the abnormal tendency characterization parameter;

[0032] The determined extraction ratio is positively correlated with the abnormal tendency characterization parameter.

[0033] Further, verifying the consistency between the context information obtained after restoration and the corresponding context information before cutting, and determining whether to lock the cluster log set includes:

[0034] Extracting the restored context information and comparing it with the corresponding pre-cut context information;

[0035] If the context information obtained after the restoration is inconsistent with the context information before the cutting, it is determined that the cluster log set needs to be locked.

[0036] Compared with the prior art, the present invention obtains feature information of created log events in real time through a log database, calculates association characterization parameters between log events according to content association features of corresponding context information between log events and timestamp differences, clusters each log event to obtain a number of clustered log sets, monitors access port traffic fluctuations of the log database, and calculates abnormal tendency characterization parameters of each log event in combination with the access frequency of a single log event to determine whether to trigger association response protection for the clustered log set, authorizes the access end to access the clustered log set, restores disguised context information through the received exchange record sequence, synchronously verifies the consistency of the context information obtained after restoration with the corresponding context information before cutting, determines whether to lock the clustered log set, and thereby reduces the abnormal risk of log events and improves the security of log events.

[0037] In particular, the present invention calculates the correlation characterization parameters between log events based on the content correlation features of the corresponding context information between each log event and the timestamp difference. In actual situations, there may be correlations between different log events. For example, the number of overlapping components in the context information, the keyword overlap, and the timestamp difference characterize the correlation and dependency between log events. In actual situations, log events that are correlated and have certain dependencies are clustered into log event sets. After the relevant records of any log event have a risk tendency of tampering or theft, the relevant risk of the log event will also increase, resulting in a decrease in the security of the relevant records of the log event. Furthermore, the present application calculates the correlation characterization parameters between log events through the content correlation features of the corresponding context information between each log event and the timestamp difference, and provides data support for the subsequent clustering of each log event to obtain a number of clustered log sets. Furthermore, the access port traffic fluctuations of the monitoring log database are combined with the access frequency of a single log event to calculate the abnormal tendency characterization parameters of each log event, and the clustered log set that triggers the associated response protection is adaptively adjusted, thereby reducing the abnormal risk of the log event and improving the security of the log event.

[0038] In particular, the present invention calculates the abnormal tendency characterization parameters of each log event by monitoring the access port traffic fluctuations of the log database and combining them with the access frequency of a single log event. In actual situations, when a log event is subjected to abnormal access, it may cause traffic fluctuations of the access port. At the same time, the access request frequency of the log event may increase significantly. The abnormal tendency of each log event is characterized based on the above situation to determine the clustered log set with abnormal risks and take protective measures in time. Therefore, the present application calculates the abnormal tendency characterization parameters of each log event by monitoring the access port traffic fluctuations of the log database and combining them with the access frequency of a single log event, so as to provide data support for the subsequent determination of whether to trigger the associated response protection of the clustered log set, and then adaptively adjust the clustered log set that triggers the associated response protection, thereby reducing the abnormal risk of log events and improving the security of log events.

[0039] In particular, the present invention adopts associated response protection, considers cutting the context information of the log events in the clustered log set where the log events with abnormal risks are located with corresponding cutting granularity, and exchanges and splices the cut fragments after cutting with corresponding extraction ratios to hide the true content of the corresponding context information of each log event in the clustered log set, so as to realize associated response protection, wherein the cutting granularity and the extraction ratio are determined according to the abnormal tendency characterization parameter. In actual situations, due to the high abnormal tendency of the log events, the log events in the clustered log set should be cut with a smaller granularity to reduce the success rate of abnormal access to restore the cut fragments, and when the log events in the clustered log set where the log events with high abnormal tendency are divided into groups and exchanged, the larger the extraction ratio, the lower the success rate of restoration. Furthermore, the present application exchanges and splices the cut fragments corresponding to the log events cut with corresponding cutting granularity through corresponding extraction ratios to obtain a number of disguised context information, realizes associated response protection of the log events in the clustered log set, and thereby reduces the abnormal risk of the log events and improves the security of the log events. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of the steps of the log management method according to an embodiment of the invention;

[0041] Figure 2 A schematic diagram of exchanging and splicing cut fragments corresponding to log events in an embodiment of the invention.

[0042] Figure 3 A logic decision diagram for triggering a correlation response protection for a clustered log set according to an embodiment of the invention;

[0043] Figure 4 A logical decision diagram for locking an authorized access terminal for an embodiment of the invention;

[0044] In the figure, 1: shuffled fragments. DETAILED DESCRIPTION

[0045] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0046] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0047] See also Figures 1 to 4 As shown, Figure 1 A schematic diagram of the steps of the log management method of an embodiment of the invention is shown. Figure 2 This is a schematic diagram of the exchange and splicing of cut fragments corresponding to the log event of the embodiment of the invention, Figure 3 A logical decision diagram for triggering the associated response protection for the cluster log set according to an embodiment of the invention, Figure 4 To provide a logical decision diagram for locking the authorized access terminal in an embodiment of the invention, the log management method in an embodiment of the invention includes:

[0048] Step S1, the log database obtains the characteristic information of the created log event in real time, including the creation timestamp and the context information describing the log event;

[0049] Step S2, calculating the correlation representation parameters between the log events according to the content correlation features of the corresponding context information between the log events and the timestamp difference, so as to cluster the log events based on the correlation representation parameters to obtain a plurality of clustered log sets;

[0050] Step S3, monitoring the access port traffic fluctuation of the log database and calculating the abnormal tendency characterization parameter of each log event in combination with the access frequency of a single log event to determine whether to trigger the associated response protection for the cluster log set, including:

[0051] The context information of each of the log events is cut at a corresponding cutting granularity, a serial number label is set for the obtained cutting fragments, the cutting fragments corresponding to each of the log events are exchanged and spliced ​​at a corresponding extraction ratio to obtain a plurality of disguised context information, and the exchange record sequence of the exchanged cutting fragments is synchronously recorded for distribution to the authorized access terminal, wherein the cutting granularity and the extraction ratio of the cutting fragments are respectively determined based on the abnormal tendency characterization parameter;

[0052] Step S4, the authorized access end accesses the cluster log set, restores the disguised context information through the received exchange record sequence, synchronously verifies the consistency of the restored context information with the corresponding context information before cutting, and determines whether to lock the cluster log set.

[0053] Specifically, the management tool of the log database is not limited, and only software for recording information related to log events needs to be provided, for example, MySQL, Chat2DB, and relevant information of log events is recorded by creating relevant fields, data types, and tables. This is a prior art and will not be described in detail.

[0054] Specifically, the context information of the log event is a record describing the log event. The form of the record is not limited and can be in text form or a record of executed code, which will not be described in detail.

[0055] Specifically, the process of determining the content association features of the corresponding context information between log events includes:

[0056] Determine the components referenced in the corresponding context information between log events and compare the number of overlapping components;

[0057] Extract repeated keywords from the corresponding context information between log events and calculate the keyword overlap.

[0058] Specifically, keyword overlap is the ratio of the number of repeated keywords to the total number of keywords.

[0059] It can be understood that the referenced components are operating system components, database components or other middleware components referenced in the context information, which will not be described in detail.

[0060] Specifically, the correlation representation parameters between log events are calculated according to formula (1):

[0061]

[0062] In formula (1), R represents the correlation characterization parameter between log events, C represents the number of overlapping components, C0 represents the preset standard threshold of the number of overlapping components, D represents the keyword overlap, D0 represents the preset standard threshold of the keyword overlap, S represents the timestamp difference, and S0 represents the preset timestamp difference standard threshold.

[0063] Specifically, in this example, the standard threshold value C0 for the number of overlapping components and the standard threshold value D0 for the keyword overlap are obtained in advance. The data collected by the log database within a certain period are obtained, and the data related to the number of overlapping components and the keyword overlap in the context information corresponding to each log event are called to solve the mean number of overlapping components ΔC0 and the mean keyword overlap ΔD0. It is set that C0=r1×ΔC0, D0=r2×ΔD0, where r1 represents the first precision coefficient, and r2 represents the second precision coefficient, where 1.1<r1<1.15, 1.05<r2<1.1.

[0064] The present invention calculates the correlation characterization parameters between log events based on the content correlation features of the corresponding context information between each log event and the timestamp difference. In actual situations, there may be correlations between different log events. For example, the number of overlapping components in the context information, the keyword overlap, and the timestamp difference characterize the correlation and dependency between log events. In actual situations, log events with correlation and certain dependency are clustered into log event sets. After the related records of any log event have a risk tendency of tampering or theft, the related risk of the log event will also increase, resulting in a reduction in the security of the related records of the log event. Furthermore, the present application calculates the correlation characterization parameters between log events through the content correlation features of the corresponding context information between each log event and the timestamp difference, so as to provide data support for the subsequent clustering of each log event to obtain a number of clustered log sets. Furthermore, the access port traffic fluctuations of the monitoring log database are combined with the access frequency of a single log event to calculate the abnormal tendency characterization parameters of each log event, and the clustered log set that triggers the associated response protection is adaptively adjusted, thereby reducing the abnormal risk of the log event and improving the security of the log event.

[0065] Specifically, the timestamps of the log events are compared to obtain the timestamp differences between the log events, wherein the timestamp difference standard threshold is selected within the interval [1min, 5min].

[0066] Specifically, each log event is clustered, wherein the correlation representation parameters between any log events in each clustered log set are all greater than a predetermined correlation representation parameter standard threshold.

[0067] To characterize the correlation, the standard threshold of the correlation characterization parameter is selected in the interval [1.05, 1.15].

[0068] Specifically, the abnormal tendency characterization parameter of the log event is calculated according to formula (2):

[0069]

[0070] In formula (2), H represents the parameter characterizing the abnormal tendency of the log event, F represents the access frequency for the log event, F0 represents the preset access frequency standard threshold, Mi represents the access port traffic at the i-th moment, ΔM represents the mean of the access port traffic at each moment within a predetermined time period, and T represents the predetermined time period.

[0071] Specifically, in this example, the preset access frequency standard threshold F0 is pre-set, where:

[0072] The access frequency mean ΔF for each log event is obtained in advance, and F0 is set to be ΔF×α, where α represents the offset coefficient, and 1.5<α<1.7.

[0073] The present invention calculates the abnormal tendency characterization parameters of each log event by monitoring the access port traffic fluctuations of the log database and combining the access frequency for a single log event. In actual situations, when a log event is subjected to abnormal access, it may cause a sudden increase and fluctuation in the traffic of the access port. At the same time, the access request frequency of the log event may increase significantly. The abnormal tendency of each log event is characterized according to the above situation to determine the clustered log set with abnormal risks and take protective measures in time. Therefore, the present application calculates the abnormal tendency characterization parameters of each log event by monitoring the access port traffic fluctuations of the log database and combining the access frequency for a single log event, so as to provide data support for the subsequent determination of whether to trigger the associated response protection of the clustered log set, and then adaptively adjust the clustered log set that triggers the associated response protection, thereby reducing the abnormal risk of log events and improving the security of log events.

[0074] Specifically, determining whether to trigger the associated response protection for the cluster log set includes:

[0075] If the abnormal tendency characterization parameter is greater than or equal to a preset abnormal tendency characterization parameter standard threshold, an associated response protection for the cluster log set is triggered.

[0076] The standard threshold value of the abnormal tendency characterization parameter, H0, is selected in the interval [0.3, 0.5].

[0077] Specifically, the set serial number label includes a main label and a sub-label, the main label is the sequential serial number of the log event, and the sub-label is the sequential serial number of the cut fragments in the context information corresponding to the log event.

[0078] Taking the case where there are three log events in the clustered log set, and the context information corresponding to each log event is cut into three cut fragments, in the initial arrangement state, for the first cut fragment obtained by cutting the first log event, the sequence number of the log event is 1, and the sequence number of the cut fragment is 1, then its sequence number label is 1, 1, and for the second cut fragment obtained by cutting the first log event, its sequence number label is 1, 2.

[0079] For more details, please refer to Figure 2 As shown, the cut fragments corresponding to each of the log events are exchanged and spliced ​​to obtain a plurality of exchange record sequences of disguised context information, the process includes:

[0080] Selecting a number of log event groups from the clustered log set;

[0081] The scrambled fragments 1 in the context information corresponding to each log event of the log event group are exchanged and spliced ​​to obtain disguised context information for the log event group;

[0082] The shuffled segments are cut fragments extracted from the context information and shuffled and spliced ​​in a random order;

[0083] The exchange record sequence includes the scrambled order records of each scrambled segment and the serial number labels of the cut fragments in each scrambled segment 1.

[0084] Specifically, taking the log events in the log event group as the first log event and the second log event in the clustered log set, and the context information of each log event corresponding to 10 cut fragments as an example,

[0085] The sequence numbers of the 10 cut fragments corresponding to the first log event context information are,1,1:1,2:1,3:1,4; 1,5:1,6; 1,7:1,8; 1,9:1,10;

[0086] The sequence numbers of the 10 cut fragments corresponding to the context information of the second log event are,2,1:2,2:2,3:2,4; 2,5:2,6; 2,7:2,8; 2,9:2,10;

[0087] For the context information of the first log event, take extracting 30% of the cut fragments, the serial number labels of the extracted cut fragments are 1, 3; 1, 4; 1, 5; as an example, after shuffling and splicing, the serial number labels of each cut fragment in the shuffled segment are 1, 4; 1, 5; 1, 3;

[0088] For the context information of the second log event, 30% of the cut fragments are extracted, and the serial number labels of the extracted cut fragments are 2, 2; 2, 3; 2, 4; after shuffling and splicing, the serial number labels of each cut fragment in the shuffled segment are 2, 4; 2, 2; 2, 3;

[0089] The shuffled fragments in the context information corresponding to the log event are exchanged and spliced, then the corresponding sequence number labels of the cut fragments contained in the context information of the first log event should be,

[0090] 1,1:1,2:2,4;2,2;2,3:1,6;1,7:1,8;1,9:1,10;

[0091] The corresponding serial number label of the cut fragment contained in the context information of the second log event should be,

[0092] 2,1:1,4; 1,5; 1,3; 2,5:2,6; 2,7:2,8; 2,9:2,10;

[0093] For the shuffle sequence record, it is only necessary to record the serial number labels of the cut fragments in the shuffled segment before the shuffle and the serial number labels of the cut fragments in the shuffled segment after the shuffle.

[0094] Specifically, the cutting granularity and the extraction ratio of the cutting fragments are determined, wherein,

[0095] The determined cutting granularity is negatively correlated with the abnormal tendency characterization parameter;

[0096] The determined extraction ratio is positively correlated with the abnormal tendency characterization parameter.

[0097] In this embodiment, optionally,

[0098] The abnormal tendency characterization parameter H is compared with the first abnormal tendency characterization parameter H1 and the second abnormal tendency characterization parameter H2.

[0099] If H>H2, the cutting granularity is determined to be the first cutting granularity f1, and f1=1.5f0;

[0100] If H1≤H≤H2, the cutting granularity is determined to be the second cutting granularity f2, and f2=2.5f0 is set;

[0101] If H

[0102] Wherein, f0 represents the reference cutting particle size, 5%<f0<20%, ​​H1=1.2H0, H2=1.5H0.

[0103] Specifically, the cutting granularity is the ratio of the amount of data contained in a single cutting fragment to the total amount of data of the context information of the log event.

[0104] The abnormal tendency characterization parameter H is compared with the first abnormal tendency characterization parameter H1 and the second abnormal tendency characterization parameter H2.

[0105] If H>H2, the extraction ratio is determined to be the first extraction ratio k1, and k1=1.5k0;

[0106] If H1≤H≤H2, the extraction ratio is determined to be the second extraction ratio k2, and k2=1.3k0 is set;

[0107] If H

[0108] Here, k0 represents the reference extraction ratio, 0.3<k0<0.5, H1=1.2H0, H2=1.5H0.

[0109] The extraction ratio is the ratio of the number of cut fragments to be extracted to the total number of cuts in the context information corresponding to the log event.

[0110] H0 represents the standard threshold of the parameter characterizing abnormal tendency, and H0 is selected in the interval [0.3, 0.5].​​

[0111] Specifically, verifying the consistency between the context information obtained after restoration and the corresponding context information before cutting, and determining whether to lock the cluster log set includes:

[0112] Extracting the restored context information and comparing it with the corresponding pre-cut context information;

[0113] If the context information obtained after the restoration is inconsistent with the context information before the cutting, it is determined that the cluster log set needs to be locked.

[0114] Specifically, locking the cluster log set may be to prohibit the access segment from accessing the log events in the cluster log set.

[0115] The present invention adopts associated response protection, considers cutting the context information of the log events in the clustered log set where the log events with abnormal risks are located with corresponding cutting granularity, and exchanges and splices the cut fragments after cutting with corresponding extraction ratios to hide the real content of the corresponding context information of each log event in the clustered log set, so as to realize associated response protection, wherein the cutting granularity and the extraction ratio are determined according to the abnormal tendency characterization parameter. In actual situations, due to the high abnormal tendency of the log events, the log events in the clustered log set should be cut with a smaller granularity to reduce the success rate of abnormal access to restore the cut fragments, and when the log events in the clustered log set where the log events with high abnormal tendency are divided into groups and exchanged, the larger the extraction ratio, the lower the success rate of restoration. Then, the present application exchanges and splices the cut fragments corresponding to the log events cut with corresponding cutting granularity through corresponding extraction ratios to obtain a number of disguised context information, realizes associated response protection of the log events in the clustered log set, and then reduces the abnormal risk of the log events and improves the security of the log events.

[0116] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A log management method, characterized in that: include: The log database obtains the characteristic information of the created log events in real time, including the creation timestamp and the context information describing the log events; Calculating correlation characterization parameters between log events according to content correlation features of corresponding context information between log events and timestamp differences, clustering the log events based on the correlation characterization parameters to obtain a plurality of clustered log sets; Monitoring the access port traffic fluctuation of the log database and calculating the abnormal tendency characterization parameter of each log event in combination with the access frequency of a single log event to determine whether to trigger the associated response protection for the cluster log set, including: The context information of each of the log events is cut at a corresponding cutting granularity, a serial number label is set for the obtained cutting fragments, the cutting fragments corresponding to each of the log events are exchanged and spliced ​​at a corresponding extraction ratio to obtain a plurality of disguised context information, and the exchange record sequence of the exchanged cutting fragments is synchronously recorded for distribution to the authorized access terminal, wherein the cutting granularity and the extraction ratio of the cutting fragments are respectively determined based on the abnormal tendency characterization parameter; The authorized access end accesses the cluster log set, restores the disguised context information through the received exchange record sequence, and simultaneously verifies the consistency between the restored context information and the corresponding pre-cut context information, and determines whether to lock the cluster log set; Determining whether to trigger the associated response protection for the cluster log set includes: If the abnormal tendency characterization parameter is greater than or equal to the preset abnormal tendency characterization parameter standard threshold, then triggering the associated response protection for the cluster log set; Verifying the consistency between the context information obtained after restoration and the corresponding context information before cutting, and determining whether to lock the cluster log set includes: Extracting the restored context information and comparing it with the corresponding pre-cut context information; If the context information obtained after the restoration is inconsistent with the context information before the cutting, it is determined that the cluster log set needs to be locked.

2. The log management method according to claim 1, characterized in that: The process of determining the content correlation features of the corresponding context information between log events includes: Determine the components referenced in the corresponding context information between log events and compare the number of overlapping components; Extract repeated keywords from the corresponding context information between log events and calculate the keyword overlap degree.

3. The log management method according to claim 1, characterized in that: According to formula (1), the correlation representation parameters between log events are calculated: （1） In formula (1), R represents the correlation representation parameter between log events, C represents the number of overlapping components, C0 represents the preset standard threshold of the number of overlapping components, D represents the keyword overlap, D0 represents the preset standard threshold of the keyword overlap, S represents the timestamp difference, and S0 represents the preset standard threshold of the timestamp difference.

4. The log management method according to claim 1, characterized in that: The log events are clustered, wherein the correlation representation parameters between any log events in each clustered log set are all greater than a predetermined correlation representation parameter standard threshold.

5. The log management method according to claim 1, characterized in that: According to formula (2), the abnormal tendency characterization parameter of the log event is calculated: （2） In formula (2), H represents the parameter characterizing the abnormal tendency of the log event, F represents the access frequency for the log event, F0 represents the preset access frequency standard threshold, Mi represents the access port traffic at the i-th moment, ΔM represents the mean of the access port traffic at each moment in the predetermined time period, and T represents the predetermined time period.

6. The log management method according to claim 1, characterized in that: The set serial number label includes a main label and a sub-label, the main label is the sequential serial number of the log event, and the sub-label is the sequential serial number of the cut fragments in the context information corresponding to the log event.

7. The log management method according to claim 1, characterized in that: The cut fragments corresponding to each of the log events are exchanged and spliced ​​to obtain a plurality of exchange record sequences of disguised context information, the process comprising: Selecting a number of log event groups from the clustered log set; Exchanging and splicing the shuffled fragments in the context information corresponding to each log event of the log event group to obtain disguised context information for the log event group; The shuffled segments are cut fragments extracted from the context information and shuffled and spliced ​​in a random order; The exchange record sequence includes the scrambled order records of each scrambled segment and the serial number labels of the cut fragments in each scrambled segment.

8. The log management method according to claim 1, characterized in that: Determine the cutting size and the extraction ratio of the cutting fragments, where The determined cutting granularity is negatively correlated with the abnormal tendency characterization parameter; The determined extraction ratio is positively correlated with the abnormal tendency characterization parameter.

Images