Computer information security monitoring system and method thereof

Abstract

The invention relates to the field of intelligent diagnosis, and particularly discloses a computer information security monitoring system and a method thereof, which adopt an artificial intelligence technology based on deep learning to excavate hidden feature information of an abnormal log network from logs, and classify and judge the hidden feature information to obtain a diagnosis result of a network anomaly type. Therefore, the accuracy and efficiency of network anomaly type diagnosis can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent diagnosis, and more specifically, to a computer information security monitoring system and method thereof. Background Art

[0002] Computer information security refers to the ability to protect computer systems and computer networks from unauthorized access, use, modification, destruction, interference or disclosure of sensitive information. It includes security management, security design, security implementation and security assessment of computer systems and networks to ensure the security, reliability, confidentiality and integrity of computer systems and networks.

[0003] Computer information monitoring refers to real-time monitoring and recording of various security events in computer systems and networks, as well as analysis and response to security events. The monitoring content includes but is not limited to login, access, operation, file modification, network traffic, abnormal behavior, etc. When monitoring computer information, abnormal logs are usually collected. Abnormal logs refer to log records that are different from normal operations, including but not limited to error logs, warning logs, abnormal event logs, etc. The collection of abnormal logs can help administrators to promptly discover abnormal situations in computer systems and networks, such as unauthorized access, attack behavior, virus infection, etc., so as to take timely measures to deal with them. However, abnormal logs may be wrong, and these erroneous abnormal logs may interfere with the administrator's judgment and decision-making, wasting the administrator's time and energy.

[0004] Therefore, an optimized computer information security monitoring solution is needed. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiment of this application provides a computer information security monitoring system and method thereof, which uses artificial intelligence technology based on deep learning to mine hidden feature information of abnormal log networks from logs, and classify and judge them to obtain the diagnosis results of network abnormality types. In this way, the accuracy and efficiency of network abnormality type diagnosis can be effectively improved.

[0006] According to one aspect of the present application, a computer information security monitoring system is provided, comprising:

[0007] Log data extraction module, used to extract abnormal logs from the log library;

[0008] A log data cleaning module, used for performing data cleaning on the abnormal log to obtain a pre-processed abnormal log;

[0009] A word segmentation processing module, used for performing word segmentation processing on the pre-processed abnormal log and then passing it through a word embedding layer to obtain a sequence of abnormal log word embedding vectors;

[0010] A context encoding module, used for passing the sequence of the abnormal log word embedding vectors through a transformer-based context encoder to obtain a plurality of contextual abnormal log word semantic understanding feature vectors;

[0011] A multi-scale feature extraction module, used for arranging the plurality of context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then passing the result through a multi-scale local association semantic understander including a first convolution layer and a second convolution layer to obtain a classification feature vector; and

[0012] The network anomaly type result generating module is used to pass the classification feature vector through a classifier to obtain a classification result, and the classification result is used to represent a network anomaly type label.

[0013] In the above-mentioned computer information security monitoring system, the word segmentation processing module includes: a word segmentation unit, which is used to perform word segmentation processing on the pre-processed exception log to convert the pre-processed exception log into a word sequence composed of multiple words; and an embedding unit, which is used to use the word embedding layer to map each word in the word sequence to a word vector to obtain a sequence of the exception log word embedding vectors.

[0014] In the above-mentioned computer information security monitoring system, the context encoding module includes: an arrangement unit, which is used to arrange the sequence of the abnormal log word embedding vectors in one dimension to obtain a global abnormal log word feature vector; a self-attention association matrix generation unit, which is used to calculate the product between the global abnormal log word feature vector and the transposed vector of each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector to obtain multiple self-attention association matrices; a standardization unit, which is used to standardize each self-attention association matrix in the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; a probability value calculation unit, which is used to pass each standardized self-attention association matrix in the multiple standardized self-attention association matrices through a Softmax classification function to obtain multiple probability values; and an attention application unit, which is used to weight each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector using each probability value in the multiple probability values ​​as a weight to obtain the multiple contextual abnormal log word semantic understanding feature vectors.

[0015] In the above-mentioned computer information security monitoring system, the multi-scale feature extraction module includes: a first scale feature extraction unit, used to input the one-dimensional feature vector into the first convolution layer of the multi-scale local association semantic understander to obtain a first scale feature vector, wherein the first convolution layer has a convolution kernel of a first scale; a second scale feature extraction unit, used to input the one-dimensional feature vector into the second convolution layer of the multi-scale local association semantic understander to obtain a second scale feature vector, wherein the second convolution layer has a convolution kernel of a second scale, and the first scale is different from the second scale; and a multi-scale feature fusion unit, used to fuse the first scale feature vector and the second scale feature vector to obtain the classification feature vector.

[0016] In the above-mentioned computer information security monitoring system, the multi-scale feature fusion unit includes: a local linear embedding matrix calculation subunit, which is used to calculate the local linear embedding matrices of the first scale feature vector and the second scale feature vector in their respective high-dimensional feature spaces to obtain a first local linear embedding matrix and a second local linear embedding matrix; a local linear embedding matrix subunit, which is used to perform singular value decomposition on the first local linear embedding matrix and the second local linear embedding matrix to obtain a left singular vector matrix, a right singular vector matrix and a singular value matrix of the first local linear embedding matrix, and a left singular vector matrix, a right singular vector matrix and a singular value matrix of the second local linear embedding matrix; a dimensional geometric correlation coefficient calculation subunit, which is used to calculate the dimensional geometric correlation coefficient of the feature manifold between the first scale feature vector and the second scale feature vector based on the left singular vector matrix, the right singular vector matrix and the singular value matrix of the first local linear embedding matrix and the second local linear embedding matrix; and a classification feature vector generation subunit, which is used to fuse the first scale feature vector and the second scale feature vector using the dimensional geometric correlation coefficient of the feature manifold between the first scale feature vector and the second scale feature vector as a weight to obtain the classification feature vector.

[0017] In the above-mentioned computer information security monitoring system, the network anomaly type result generating module is used to: use the classifier to process the classification feature vector with the following classification formula to generate the classification result; wherein the classification formula is:

[0018] O=softmax{(M c ,B c )|V c}

[0019] Wherein O is the classification result, V c represents the classification feature vector, M c is the weight matrix of the fully connected layer, Bc Represents the bias vector of the fully connected layer, and softmax is the normalized exponential function.

[0020] According to another aspect of the present application, a computer information security monitoring method is provided, which includes:

[0021] Extract abnormal logs from the log library;

[0022] Performing data cleaning on the exception log to obtain a pre-processed exception log;

[0023] Performing word segmentation on the preprocessed abnormal log and then passing it through a word embedding layer to obtain a sequence of abnormal log word embedding vectors;

[0024] Passing the sequence of abnormal log word embedding vectors through a transformer-based context encoder to obtain multiple contextual abnormal log word semantic understanding feature vectors;

[0025] Arranging the plurality of context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then passing the vector through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector; and

[0026] The classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to represent a network anomaly type label.

[0027] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the computer information security monitoring method as described above.

[0028] According to another aspect of the present application, a computer-readable medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the computer information security monitoring method as described above.

[0029] Compared with the prior art, the computer information security monitoring system and method provided by the present application adopts artificial intelligence technology based on deep learning to mine the hidden characteristic information of the abnormal log network from the log, and classify and judge it to obtain the diagnosis result of the network abnormality type. In this way, the accuracy and efficiency of the diagnosis of network abnormality type can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0031] Figure 1 4 is a system block diagram of a computer information security monitoring system according to an embodiment of the present application.

[0032] Figure 2 Schematic diagram of a computer information security monitoring system according to an embodiment of the present application.

[0033] Figure 3 It is a block diagram of a word segmentation processing module in a computer information security monitoring system according to an embodiment of the present application.

[0034] Figure 4 It is a block diagram of a context encoding module in a computer information security monitoring system according to an embodiment of the present application.

[0035] Figure 5 4 is a block diagram of a multi-scale feature extraction module in a computer information security monitoring system according to an embodiment of the present application.

[0036] Figure 6 4 is a block diagram of a multi-scale feature fusion unit in a computer information security monitoring system according to an embodiment of the present application.

[0037] Figure 7 Flowchart of a computer information security monitoring method according to an embodiment of the present application.

[0038] Figure 8 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0040] Application Overview

[0041] As mentioned in the above background technology, the goal of computer information security is to ensure that computer systems and networks are not affected by unauthorized access, use, modification, destruction, interference or disclosure of sensitive information. In order to achieve this goal, security management, design, implementation and evaluation are required to ensure the security, reliability, confidentiality and integrity of computer systems and networks. Computer information monitoring refers to real-time monitoring, recording, analysis and response to security events in computer systems and networks. Monitoring content includes login, access, operation, file modification, network traffic and abnormal behavior. When monitoring, abnormal logs, i.e. log records different from normal operations, including error logs, warning logs and abnormal event logs, are usually collected. The collection of abnormal logs helps administrators to promptly discover abnormal situations in computer systems and networks, such as unauthorized access, attack behavior and virus infection, and take corresponding measures to deal with them. However, there may be errors in the abnormal logs, and these erroneous abnormal logs may interfere with the administrator's judgment and decision-making, resulting in a waste of time and energy. Therefore, an optimized computer information security monitoring solution is expected.

[0042] In recent years, deep learning and neural networks have been widely used in computer vision, natural language processing, text signal processing and other fields. In addition, deep learning and neural networks have also shown a level close to or even beyond that of humans in image classification, object detection, semantic segmentation, text translation and other fields. The development of deep learning and neural networks has provided new solutions and solutions for computer information security monitoring.

[0043] Specifically, in the technical solution of the present application, first, the exception log is extracted from the log library. It should be understood that the log library is an important data source for recording the operating status of the computer system and user operations. By extracting the exception log from the log library, information related to the security incident can be obtained, including abnormal behavior, abnormal access, error logs, etc., which helps to continue to track and trace the security incident, and timely detect and respond to potential security threats. The exception log often contains records of behaviors or abnormal situations that are inconsistent with normal operations. By extracting the exception log from the log library, it can be used as input data for anomaly detection and analysis to find abnormal behaviors, abnormal patterns or potential risk factors of the system, which helps to discover potential security vulnerabilities, attack behaviors or abnormal operations, and take corresponding countermeasures.

[0044] Next, the exception log is cleaned to obtain a preprocessed exception log. It should be understood that the exception log may contain a large amount of noise and redundant information, such as irrelevant system operations, repeated error records, etc.; the exception log may come from different applications, and its format and structure may be different. Through data cleaning, these interferences can be removed and valid information related to the exception can be extracted. Preprocessing includes operations such as data format conversion, removal of invalid characters, standard text conversion, etc., for subsequent word segmentation processing and feature extraction. Through data cleaning and processing, the interference of noise on subsequent steps can be reduced, and the quality and availability of the exception log can be improved.

[0045] Then, the pre-processed abnormal log is segmented and passed through the word embedding layer to obtain a sequence of abnormal log word embedding vectors. It should be understood that the abnormal log contains a large number of words or phrases. If the original text is used directly for modeling and analysis, it will lead to a high-dimensional sparse feature space, increase the computational complexity, and may cause dimensionality disaster. Through word embedding technology, each word can be mapped to a low-dimensional continuous vector space, reduce the feature dimension, improve efficiency and computing performance. Each word or phrase in the abnormal log can be regarded as a feature. By converting it into a word embedding vector, the text data can be converted into a numerical input that can be understood and processed by the machine learning algorithm. The word embedding vector can effectively capture the semantic association and similarity between words, and provide a richer and more meaningful feature representation. Words in the abnormal log text often rely on their contextual context for accurate semantic understanding and inference. The word embedding model can learn the distribution pattern and correlation of words in the surrounding context, and encode this information into the word embedding vector. Through the sequence of word embedding vectors, the contextual relationship between words can be better utilized to improve the semantic representation ability of the abnormal log.

[0046] Next, the sequence of the abnormal log word embedding vectors is passed through a converter-based context encoder to obtain multiple contextual abnormal log word semantic understanding feature vectors. It should be understood that abnormal logs often contain a large amount of text information, in which words and phrases may carry important contextual semantic information. In order to better utilize this information, the abnormal log word embedding vectors can be context modeled through a converter-based context encoder to generate multiple contextual abnormal log word semantic understanding feature vectors. The converter-based context encoder can use the self-attention mechanism to effectively capture the contextual dependencies in the text sequence. It can interact and integrate the embedding representation of each word with its surrounding context to obtain richer contextual semantic information.

[0047] Furthermore, after the semantic understanding feature vectors of the multiple contextual abnormal log words are arranged into a one-dimensional feature vector, a classification feature vector is obtained by a multi-scale local association semantic understander including a first convolution layer and a second convolution layer. It should be understood that the feature extraction of the one-dimensional feature vector arranged by the multi-scale local association semantic understander for the multiple contextual abnormal log word semantic understanding feature vectors can capture local semantic features of different scales. The first convolution layer can extract lower-level features, such as the combination pattern of local phrases, and the second convolution layer can further extract higher-level features, such as semantic associations in a larger range. Through the multi-scale local association semantic understander, the input vector can be converted into a classification feature vector with richer semantic information, so that the subsequent classifier can classify and analyze the abnormal log, which can better capture the key features in the abnormal log and improve the accuracy of classification. Finally, the classification feature vector is passed through the classifier to obtain a classification result for representing the network abnormality type label. This can help security analysts better understand and handle abnormal situations.

[0048] Furthermore, in the technical solution of the present application, considering that the first scale feature vector and the second scale feature vector are obtained by encoding the one-dimensional feature vector formed by arranging the semantic understanding feature vectors of the multiple contextual abnormal log words at different scales, there will be a large amount of redundant information between the two. However, if the first scale feature vector and the second scale feature vector are fused by dimensionality reduction, the local structural information of each feature space will be lost, and the final classification will not be utilized. Therefore, if the local structural information of each feature space can be retained and the redundant information can be eliminated in the process of fusing the first scale feature vector and the second scale feature vector, the fusion effect can be achieved, thereby improving the accuracy of the classification judgment of the network abnormality type.

[0049] In the technical solution of the present application, in the process of fusing the first scale feature vector and the second scale feature vector to obtain the classification feature vector, the local linear embedding (LLE) matrix of the first scale feature vector and the second scale feature vector in their respective feature spaces is first calculated to capture the local structural information between the feature vectors. The local linear embedding (LLE) matrix describes the linear relationship between each feature vector and its neighboring samples, and can reflect the local geometric structure of the data. Further, the first LLE matrix and the second LLE matrix are subjected to singular value decomposition to obtain the main eigenvectors and eigenvalues ​​of the first LLE matrix and the second LLE matrix, wherein the left singular vector matrix and the right singular vector matrix contain the information of the eigenvector, and the singular value matrix contains the importance of the eigenvector (the larger the singular value, the more important the corresponding eigenvector). Further based on the left singular vector matrix, the right singular vector matrix and the singular value matrix of the first LLE matrix and the second LLE matrix, the dimensional geometric correlation coefficient of the feature manifold between the first scale feature vector and the second scale feature vector is calculated. The dimensional geometric correlation coefficient of the feature manifold refers to the geometric relationship between the eigenvectors in the manifold space. The left singular vector matrix and the right singular vector matrix obtained by singular value decomposition can be regarded as the projection of the eigenvector in the manifold space, and the singular value matrix represents the importance of the eigenvector in the manifold space. In this way, by calculating the inner product between the left singular vector matrix and the right singular vector matrix, the similarity between the eigenvectors can be obtained, and the singular value matrix can be used to adjust the weights between the eigenvectors to reflect their importance in the fusion process. Then, the dimensional geometric correlation coefficient of the characteristic manifold between the first scale eigenvector and the second scale eigenvector is used as the weight to fuse the first scale eigenvector and the second scale eigenvector to obtain the classification eigenvector, so that in the process of fusing the first scale eigenvector and the second scale eigenvector, the local structural information of each feature space can be retained, and redundant information can be eliminated, thereby improving the effect of feature fusion.

[0050] In summary, in the technical solution of the present application, in the process of fusing the first scale feature vector and the second scale feature vector, the dimensional geometric correlation of the feature manifold is used to fuse the feature vectors in different feature spaces, which can effectively retain the local structural information in each feature space, while eliminating redundant information, thereby improving the effect of feature fusion. Compared with other methods, this method does not require pre-determining the target dimension after fusion, nor does it require dimensionality reduction processing of the original data, so it can avoid information loss and increase in computational complexity.

[0051] After introducing the basic principles of the present application, various non-limiting embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0052] Exemplary Systems

[0053] Figure 1 : is a system block diagram of a computer information security monitoring system according to an embodiment of the present application. Figure 1 As shown, in the computer information security monitoring system 100, it includes: a log data extraction module 110, which is used to extract abnormal logs from the log library; a log data cleaning module 120, which is used to perform data cleaning on the abnormal logs to obtain pre-processed abnormal logs; a word segmentation processing module 130, which is used to perform word segmentation processing on the pre-processed abnormal logs and then pass them through a word embedding layer to obtain a sequence of abnormal log word embedding vectors; a context encoding module 140, which is used to pass the sequence of abnormal log word embedding vectors through a converter-based context encoder to obtain multiple context abnormal log word semantic understanding feature vectors; a multi-scale feature extraction module 150, which is used to arrange the multiple context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then pass them through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector; and a network abnormality type result generation module 160, which is used to pass the classification feature vector through a classifier to obtain a classification result, and the classification result is used to represent a network abnormality type label.

[0054] Figure 2 FIG. 1 is an architecture diagram of a computer information security monitoring system according to an embodiment of the present application. Figure 2 As shown, in this architecture, first, the exception log is extracted from the log library. Then, the exception log is cleaned to obtain the preprocessed exception log. Then, the preprocessed exception log is segmented and passed through the word embedding layer to obtain a sequence of exception log word embedding vectors. Next, the sequence of exception log word embedding vectors is passed through a converter-based context encoder to obtain multiple contextual exception log word semantic understanding feature vectors. Furthermore, the multiple contextual exception log word semantic understanding feature vectors are arranged into a one-dimensional feature vector and passed through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector. Finally, the classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to represent the network anomaly type label.

[0055] In the computer information security monitoring system 100, the log data extraction module 110 is used to extract abnormal logs from the log library. It should be understood that the log library is an important data source for recording the operating status of the computer system and user operations. By extracting abnormal logs from the log library, information related to security events can be obtained, including abnormal behavior, abnormal access, error logs, etc., which helps to continue to track and trace the security events, and timely detect and respond to potential security threats. The abnormal log often contains records of behaviors or abnormal situations that are inconsistent with normal operations. By extracting the abnormal log from the log library, it can be used as input data for abnormal detection and analysis, looking for abnormal behaviors, abnormal patterns or potential risk factors of the system, which helps to discover potential security vulnerabilities, attack behaviors or abnormal operations, and take corresponding countermeasures. The steps of abnormal log extraction include determining the definition and rules of the abnormality; filtering the logs in the log library according to the rules of the abnormal definition, screening out log events that meet the abnormal definition, and extracting the filtered log events to form an abnormal log set.

[0056] In the computer information security monitoring system 100, the log data cleaning module 120 is used to clean the exception log to obtain a pre-processed exception log. It should be understood that the exception log may contain a large amount of noise and redundant information, such as irrelevant system operations, repeated error records, etc.; the exception log may come from different applications, and its format and structure may be different. Through data cleaning, these interferences can be removed and valid information related to the exception can be extracted. Preprocessing includes operations such as data format conversion, removal of invalid characters, standard text conversion, etc., for subsequent word segmentation processing and feature extraction. Through data cleaning and processing, the interference of noise on subsequent steps can be reduced, and the quality and availability of the exception log can be improved.

[0057] In the computer information security monitoring system 100, the word segmentation processing module 130 is used to perform word segmentation processing on the pre-processed abnormal log and then pass it through the word embedding layer to obtain a sequence of abnormal log word embedding vectors. Word segmentation is the process of splitting the text into individual words or phrases. By performing word segmentation on the abnormal log, complex text data can be converted into discrete words, so that the computer can better understand and process these data. Word embedding is a technology that maps words to a low-dimensional vector space. It can convert the semantic relationship between words into a distance relationship between vectors, thereby better expressing the similarities and differences between words. By mapping the words of the abnormal log to word embedding vectors, the text data can be converted into numerical representations, which is convenient for subsequent calculations and analysis. By obtaining a sequence of abnormal log word embedding vectors, the abnormal log can be represented as a numerical sequence, and then a deep learning model is applied to perform anomaly detection tasks, which can improve the understanding and processing capabilities of the abnormal log, thereby better protecting computer information security.

[0058] Figure 3 FIG. 1 is a block diagram of a word segmentation processing module in a computer information security monitoring system according to an embodiment of the present application. Figure 3 As shown, the word segmentation processing module 130 includes: a word segmentation unit 131, which is used to perform word segmentation processing on the preprocessed exception log to convert the preprocessed exception log into a word sequence composed of multiple words; and an embedding unit 132, which is used to use the word embedding layer to map each word in the word sequence to a word vector to obtain a sequence of the exception log word embedding vectors.

[0059] In the computer information security monitoring system 100, the context encoding module 140 is used to pass the sequence of the abnormal log word embedding vector through a converter-based context encoder to obtain multiple context abnormal log word semantic understanding feature vectors. It should be understood that abnormal logs often contain a large amount of text information, in which words and phrases may carry important contextual semantic information. In order to better utilize this information, the abnormal log word embedding vector can be context modeled through a converter-based context encoder to generate multiple context abnormal log word semantic understanding feature vectors. The converter-based context encoder can use the self-attention mechanism to effectively capture the context dependencies in the text sequence. It can interact and integrate the embedded representation of each word with its surrounding context to obtain richer contextual semantic information.

[0060] Figure 4 FIG. 1 is a block diagram of a context encoding module in a computer information security monitoring system according to an embodiment of the present application. Figure 4 As shown, the context encoding module 140 includes: an arrangement unit 141, which is used to arrange the sequence of the abnormal log word embedding vectors in one dimension to obtain a global abnormal log word feature vector; a self-attention association matrix generation unit 142, which is used to calculate the product between the global abnormal log word feature vector and the transposed vector of each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector to obtain multiple self-attention association matrices; a standardization unit 143, which is used to standardize each self-attention association matrix in the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; a probability value calculation unit 144, which is used to pass each standardized self-attention association matrix in the multiple standardized self-attention association matrices through a Softmax classification function to obtain multiple probability values; and an attention application unit 145, which is used to weight each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector using each probability value in the multiple probability values ​​as a weight to obtain the multiple contextual abnormal log word semantic understanding feature vectors.

[0061] In the computer information security monitoring system 100, the multi-scale feature extraction module 150 is used to arrange the multiple context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then pass it through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector. It should be understood that the feature extraction of the one-dimensional feature vector arranged by the multi-scale local association semantic understander for the multiple context abnormal log word semantic understanding feature vectors can capture local semantic features of different scales. The first convolution layer can extract lower-level features, such as the combination pattern of local phrases, and the second convolution layer can further extract higher-level features, such as a larger range of semantic associations. Through the multi-scale local association semantic understander, the input vector can be converted into a classification feature vector with richer semantic information, so that the subsequent classifier can classify and analyze the abnormal log, which can better capture the key features in the abnormal log and improve the accuracy of classification.

[0062] Figure 5 FIG. 1 is a block diagram of a multi-scale feature extraction module in a computer information security monitoring system according to an embodiment of the present application. Figure 5 As shown, the multi-scale feature extraction module 150 includes: a first-scale feature extraction unit 151, used to input the one-dimensional feature vector into the first convolution layer of the multi-scale local association semantic understander to obtain a first-scale feature vector, wherein the first convolution layer has a convolution kernel of a first scale; a second-scale feature extraction unit 152, used to input the one-dimensional feature vector into the second convolution layer of the multi-scale local association semantic understander to obtain a second-scale feature vector, wherein the second convolution layer has a convolution kernel of a second scale, and the first scale is different from the second scale; and a multi-scale feature fusion unit 153, used to fuse the first-scale feature vector and the second-scale feature vector to obtain the classification feature vector.

[0063] Furthermore, in the technical solution of the present application, considering that the first scale feature vector and the second scale feature vector are obtained by encoding the one-dimensional feature vector formed by arranging the semantic understanding feature vectors of the multiple contextual abnormal log words at different scales, there will be a large amount of redundant information between the two. However, if the first scale feature vector and the second scale feature vector are fused by dimensionality reduction, the local structural information of each feature space will be lost, and the final classification will not be utilized. Therefore, if the local structural information of each feature space can be retained and the redundant information can be eliminated in the process of fusing the first scale feature vector and the second scale feature vector, the fusion effect can be achieved, thereby improving the accuracy of the classification judgment of the network abnormality type.

[0064] Figure 6FIG. 1 is a block diagram of a multi-scale feature fusion unit in a computer information security monitoring system according to an embodiment of the present application. Figure 6 As shown, the multi-scale feature fusion unit 153 includes: a local linear embedding matrix calculation subunit 1531, which is used to calculate the local linear embedding matrices of the first scale feature vector and the second scale feature vector in their respective high-dimensional feature spaces to obtain a first local linear embedding matrix and a second local linear embedding matrix; a local linear embedding matrix subunit 1532, which is used to perform singular value decomposition on the first local linear embedding matrix and the second local linear embedding matrix to obtain a left singular vector matrix, a right singular vector matrix and a singular value matrix of the first local linear embedding matrix, and a left singular vector matrix, a right singular vector matrix and a singular value matrix of the second local linear embedding matrix. a singular vector matrix and a singular value matrix; a dimensional geometric correlation coefficient calculation subunit 1533, used to calculate the dimensional geometric correlation coefficient of the characteristic manifold between the first-scale feature vector and the second-scale feature vector based on the left singular vector matrix, the right singular vector matrix and the singular value matrix of the first local linear embedding matrix and the second local linear embedding matrix; and a classification feature vector generation subunit 1534, used to fuse the first-scale feature vector and the second-scale feature vector using the dimensional geometric correlation coefficient of the characteristic manifold between the first-scale feature vector and the second-scale feature vector as a weight to obtain the classification feature vector.

[0065] In the technical solution of the present application, the local linear embedding (LLE) matrix of each scale eigenvector in its own feature space is calculated to capture the local structural information between the eigenvectors. The local linear embedding (LLE) matrix describes the linear relationship between each eigenvector and its neighboring samples, which can reflect the local geometric structure of the data. The left singular vector matrix and the right singular vector matrix of the local linear embedding matrix contain the information of the eigenvector, and the singular value matrix contains the importance of the eigenvector (the larger the singular value, the more important the corresponding eigenvector). The dimensional geometric correlation coefficient of the feature manifold refers to the geometric relationship between the eigenvectors in the manifold space. The left singular vector matrix and the right singular vector matrix obtained by singular value decomposition can be regarded as the projection of the eigenvector in the manifold space, and the singular value matrix represents the importance of the eigenvector in the manifold space. In this way, by calculating the inner product between the left singular vector matrix and the right singular vector matrix, the similarity between the eigenvectors can be obtained, and the singular value matrix can be used to adjust the weights between the eigenvectors to reflect their importance in the fusion process. Using the dimensional geometric correlation coefficient of the feature manifold as a weight to fuse feature vectors of different scales can preserve the local structural information of each feature space, eliminate redundant information, and improve the effect of feature fusion. Compared with other methods, this method does not require pre-determining the target dimension after fusion, nor does it require dimensionality reduction processing of the original data, thus avoiding information loss and increased computational complexity.

[0066] In the computer information security monitoring system 100, the network anomaly type result generating module 160 is used to pass the classification feature vector through the classifier to obtain a classification result, and the classification result is used to represent the network anomaly type label. The advantage of using the classification result to represent the network anomaly label is that the anomaly log can be marked and classified, so as to better understand and analyze the abnormal event. By classifying the anomaly log, different types of network anomalies can be better understood, providing guidance for subsequent security measures and response strategies.

[0067] Specifically, in the computer information security monitoring system 100, the network anomaly type result generating module 160 includes: using the classifier to process the classification feature vector with the following classification formula to generate the classification result; wherein the classification formula is:

[0068] O=softmax{(M c ,B c )|V c}

[0069] Wherein O is the classification result, V c represents the classification feature vector, M c is the weight matrix of the fully connected layer, Bc Represents the bias vector of the fully connected layer, and softmax is the normalized exponential function.

[0070] In summary, the computer information security monitoring system 100 according to the embodiment of the present application is described, which uses artificial intelligence technology based on deep learning to mine hidden feature information of abnormal log networks from logs, and classifies and judges them to obtain the diagnosis results of network abnormality types. In this way, the accuracy and efficiency of network abnormality type diagnosis can be effectively improved.

[0071] As described above, the computer information security monitoring system 100 according to the embodiment of the present application can be implemented in various terminal devices, such as a server for computer information security monitoring. In one example, the computer information security monitoring system 100 according to the embodiment of the present application can be integrated into the terminal device as a software module and / or a hardware module. For example, the computer information security monitoring system 100 can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the computer information security monitoring system 100 can also be one of the many hardware modules of the terminal device.

[0072] Alternatively, in another example, the computer information security monitoring system 100 and the terminal device may also be separate devices, and the computer information security monitoring system 100 may be connected to the terminal device via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0073] Exemplary Methods

[0074] Figure 7 Flowchart of a computer information security monitoring method according to an embodiment of the present application. Figure 7 As shown, in the computer information security monitoring method, it includes: S110, extracting abnormal logs from the log library; S120, performing data cleaning on the abnormal logs to obtain pre-processed abnormal logs; S130, performing word segmentation on the pre-processed abnormal logs and passing them through a word embedding layer to obtain a sequence of abnormal log word embedding vectors; S140, passing the sequence of abnormal log word embedding vectors through a converter-based context encoder to obtain multiple context abnormal log word semantic understanding feature vectors; S150, arranging the multiple context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and passing them through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector; and, S160, passing the classification feature vector through a classifier to obtain a classification result, and the classification result is used to represent a network abnormality type label.

[0075] In one example, in the above-mentioned computer information security monitoring method, the pre-processed exception log is subjected to word segmentation processing and then passed through a word embedding layer to obtain a sequence of exception log word embedding vectors, including: performing word segmentation processing on the pre-processed exception log to convert the pre-processed exception log into a word sequence composed of multiple words; and using the word embedding layer to map each word in the word sequence to a word vector to obtain a sequence of exception log word embedding vectors.

[0076] In one example, in the above-mentioned computer information security monitoring method, the sequence of the abnormal log word embedding vectors is passed through a converter-based context encoder to obtain multiple contextual abnormal log word semantic understanding feature vectors, including: one-dimensionally arranging the sequence of the abnormal log word embedding vectors to obtain a global abnormal log word feature vector; calculating the product between the global abnormal log word feature vector and the transposed vector of each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector to obtain multiple self-attention association matrices; respectively normalizing each of the multiple self-attention association matrices to obtain multiple standardized self-attention association matrices; passing each of the multiple standardized self-attention association matrices through a Softmax classification function to obtain multiple probability values; and, respectively using each of the multiple probability values ​​as a weight to weight each of the abnormal log word embedding vectors in the sequence of the abnormal log word embedding vectors to obtain the multiple contextual abnormal log word semantic understanding feature vectors.

[0077] In one example, in the above-mentioned computer information security monitoring method, the multiple context abnormal log word semantic understanding feature vectors are arranged into a one-dimensional feature vector and then passed through a multi-scale local association semantic understander including a first convolution layer and a second convolution layer to obtain a classification feature vector, including: inputting the one-dimensional feature vector into the first convolution layer of the multi-scale local association semantic understander to obtain a first-scale feature vector, wherein the first convolution layer has a convolution kernel of a first scale; inputting the one-dimensional feature vector into the second convolution layer of the multi-scale local association semantic understander to obtain a second-scale feature vector, wherein the second convolution layer has a convolution kernel of a second scale, and the first scale is different from the second scale; and, fusing the first-scale feature vector and the second-scale feature vector to obtain the classification feature vector.

[0078] In one example, in the above-mentioned computer information security monitoring method, the fusing the first-scale feature vector and the second-scale feature vector to obtain the classification feature vector includes: calculating the local linear embedding matrices of the first-scale feature vector and the second-scale feature vector in their respective high-dimensional feature spaces to obtain a first local linear embedding matrix and a second local linear embedding matrix; performing singular value decomposition on the first local linear embedding matrix and the second local linear embedding matrix to obtain a left singular vector matrix, a right singular vector matrix and a singular value matrix of the first local linear embedding matrix, and a left singular vector matrix, a right singular vector matrix and a singular value matrix of the second local linear embedding matrix; based on the left singular vector matrix, the right singular vector matrix and the singular value matrix of the first local linear embedding matrix and the second local linear embedding matrix, calculating the dimensional geometric correlation coefficient of the feature manifold between the first-scale feature vector and the second-scale feature vector; and, using the dimensional geometric correlation coefficient of the feature manifold between the first-scale feature vector and the second-scale feature vector as a weight to fuse the first-scale feature vector and the second-scale feature vector to obtain the classification feature vector.

[0079] In one example, in the above-mentioned computer information security monitoring method, the classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to represent a network anomaly type label, including: using the classifier to process the classification feature vector with the following classification formula to generate the classification result; wherein the classification formula is:

[0080] O=softmax{(M c ,B c )|V c}

[0081] Wherein O is the classification result, V c represents the classification feature vector, M c is the weight matrix of the fully connected layer, B c Represents the bias vector of the fully connected layer, and softmax is the normalized exponential function.

[0082] In summary, the computer information security monitoring method based on the embodiment of the present application is explained, which uses artificial intelligence technology based on deep learning to mine the hidden characteristic information of the abnormal log network from the log, and classifies and judges it to obtain the diagnosis result of the network abnormality type. In this way, the accuracy and efficiency of the diagnosis of network abnormality type can be effectively improved.

[0083] Exemplary Electronic Devices

[0084] Below, reference Figure 8To describe an electronic device according to an embodiment of the present application.

[0085] Figure 8 is a block diagram of an electronic device according to an embodiment of the present application.

[0086] like Figure 8 As shown, the electronic device 10 includes one or more processors 11 and a memory 12 .

[0087] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0088] The memory 12 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the computer information security monitoring method of each embodiment of the present application described above and / or other desired functions. Various contents such as exception logs may also be stored in the computer-readable storage medium.

[0089] In one example, the electronic device 10 may further include: an input device 13 and an output device 14, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0090] The input device 13 may include, for example, a keyboard, a mouse, etc.

[0091] The output device 14 can output various information to the outside, including network anomaly labels, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0092] Of course, to simplify, Figure 8 Only some of the components related to the present application in the electronic device 10 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 10 may also include any other appropriate components.

[0093] Exemplary computer program products and computer-readable storage media

[0094] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the computer information security monitoring method according to various embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

[0095] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0096] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the computer information security monitoring method according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0097] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0098] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present application. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, not for limitation, and the above details do not limit the present application to being implemented by adopting the above specific details.

[0099] The block diagrams of the devices, apparatuses, equipment, and systems involved in this application are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The words "such as" used here refer to the phrase "such as but not limited to", and can be used interchangeably with them.

[0100] It should also be noted that in the apparatus, device and method of the present application, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present application.

[0101] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present application. Therefore, the present application is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0102] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A computer information security monitoring system, characterized in that: include: Log data extraction module, used to extract abnormal logs from the log library; A log data cleaning module, used for performing data cleaning on the abnormal log to obtain a pre-processed abnormal log; A word segmentation processing module, used for performing word segmentation processing on the pre-processed abnormal log and then passing it through a word embedding layer to obtain a sequence of abnormal log word embedding vectors; A context encoding module, used for passing the sequence of the abnormal log word embedding vectors through a transformer-based context encoder to obtain a plurality of contextual abnormal log word semantic understanding feature vectors; A multi-scale feature extraction module, used for arranging the plurality of context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then passing the result through a multi-scale local association semantic understander including a first convolution layer and a second convolution layer to obtain a classification feature vector; as well as The network anomaly type result generating module is used to pass the classification feature vector through a classifier to obtain a classification result, and the classification result is used to represent a network anomaly type label.

2. The computer information security monitoring system according to claim 1, characterized in that: The word segmentation processing module includes: A word segmentation unit, configured to perform word segmentation processing on the preprocessed exception log to convert the preprocessed exception log into a word sequence consisting of a plurality of words; and An embedding unit is used to use the word embedding layer to map each word in the word sequence to a word vector to obtain a sequence of the abnormal log word embedding vectors.

3. The computer information security monitoring system according to claim 2, characterized in that: The context encoding module comprises: an arrangement unit, configured to perform one-dimensional arrangement on the sequence of the abnormal log word embedding vectors to obtain a global abnormal log word feature vector; A self-attention association matrix generating unit, used for calculating the product between the global abnormal log word feature vector and the transposed vector of each abnormal log word embedding vector in the sequence of the abnormal log word embedding vector to obtain a plurality of self-attention association matrices; A normalization unit, configured to normalize each of the plurality of self-attention association matrices to obtain a plurality of normalized self-attention association matrices; a probability value calculation unit, configured to obtain a plurality of probability values ​​by applying a Softmax classification function to each of the plurality of standardized self-attention association matrices; and An attention applying unit is used to weight each abnormal log word embedding vector in the sequence of the abnormal log word embedding vectors by using each probability value in the multiple probability values ​​as a weight to obtain the multiple contextual abnormal log word semantic understanding feature vectors.

4. The computer information security monitoring system according to claim 3, characterized in that: The multi-scale feature extraction module comprises: A first scale feature extraction unit, configured to input the one-dimensional feature vector into a first convolutional layer of the multi-scale local association semantic understander to obtain a first scale feature vector, wherein the first convolutional layer has a convolution kernel of a first scale; a second scale feature extraction unit, configured to input the one-dimensional feature vector into a second convolutional layer of the multi-scale local association semantic understander to obtain a second scale feature vector, wherein the second convolutional layer has a convolution kernel of a second scale, and the first scale is different from the second scale; and A multi-scale feature fusion unit is used to fuse the first-scale feature vector and the second-scale feature vector to obtain the classification feature vector.

5. The computer information security monitoring system according to claim 4, characterized in that: The multi-scale feature fusion unit comprises: A local linear embedding matrix calculation subunit, used to calculate the local linear embedding matrices of the first scaled feature vector and the second scaled feature vector in their respective high-dimensional feature spaces to obtain a first local linear embedding matrix and a second local linear embedding matrix; a local linear embedding matrix subunit, configured to perform singular value decomposition on the first local linear embedding matrix and the second local linear embedding matrix to obtain a left singular vector matrix, a right singular vector matrix and a singular value matrix of the first local linear embedding matrix, and a left singular vector matrix, a right singular vector matrix and a singular value matrix of the second local linear embedding matrix; a dimensional geometric correlation coefficient calculation subunit, configured to calculate a dimensional geometric correlation coefficient of a characteristic manifold between the first scale eigenvector and the second scale eigenvector based on a left singular vector matrix, a right singular vector matrix and a singular value matrix of the first local linear embedding matrix and the second local linear embedding matrix; and The classification feature vector generating subunit is used to fuse the first-scale feature vector and the second-scale feature vector by using the dimensional geometric correlation coefficient of the feature manifold between the first-scale feature vector and the second-scale feature vector as a weight to obtain the classification feature vector.

6. The computer information security monitoring system according to claim 5, characterized in that: The network anomaly type result generating module is used to: use the classifier to process the classification feature vector with the following classification formula to generate the classification result; Among them, the classification formula is: O=softmax{(M c ,B c )|V c } Wherein O is the classification result, V c represents the classification feature vector, M c is the weight matrix of the fully connected layer, B c Represents the bias vector of the fully connected layer, and softmax is the normalized exponential function.

7. A computer information security monitoring method, characterized in that: include: Extract abnormal logs from the log library; Performing data cleaning on the exception log to obtain a pre-processed exception log; Performing word segmentation on the preprocessed abnormal log and then passing it through a word embedding layer to obtain a sequence of abnormal log word embedding vectors; Passing the sequence of abnormal log word embedding vectors through a transformer-based context encoder to obtain multiple contextual abnormal log word semantic understanding feature vectors; Arranging the plurality of context abnormal log word semantic understanding feature vectors into a one-dimensional feature vector and then passing the vector through a multi-scale local association semantic understander including a first convolutional layer and a second convolutional layer to obtain a classification feature vector; and The classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to represent a network anomaly type label.

8. The computer information security monitoring method according to claim 7, characterized in that: The pre-processed abnormal log is segmented and then passed through a word embedding layer to obtain a sequence of abnormal log word embedding vectors, including: Performing word segmentation processing on the preprocessed exception log to convert the preprocessed exception log into a word sequence consisting of a plurality of words; and The word embedding layer is used to map each word in the word sequence to a word vector to obtain a sequence of the abnormal log word embedding vectors.

9. The computer information security monitoring method according to claim 8, characterized in that: The sequence of the abnormal log word embedding vectors is passed through a transformer-based context encoder to obtain multiple contextual abnormal log word semantic understanding feature vectors, including: Arrange the sequence of the abnormal log word embedding vectors in one dimension to obtain a global abnormal log word feature vector; Calculating the product between the global abnormal log word feature vector and the transposed vector of each abnormal log word embedding vector in the sequence of the abnormal log word embedding vectors to obtain multiple self-attention association matrices; Normalizing each of the plurality of self-attention association matrices to obtain a plurality of standardized self-attention association matrices; Passing each of the plurality of standardized self-attention association matrices through a Softmax classification function to obtain a plurality of probability values; as well as Each of the multiple probability values ​​is used as a weight to weight each of the abnormal log word embedding vectors in the sequence of the abnormal log word embedding vectors to obtain the multiple contextual abnormal log word semantic understanding feature vectors.

10. The computer information security monitoring method according to claim 9, characterized in that: Passing the classification feature vector through a classifier to obtain a classification result, wherein the classification result is used to represent a network anomaly type label, includes: using the classifier to process the classification feature vector using the following classification formula to generate the classification result; Among them, the classification formula is: O=softmax{(M c ,B c )|V c } Wherein O is the classification result, V c represents the classification feature vector, M c is the weight matrix of the fully connected layer, B c Represents the bias vector of the fully connected layer, and softmax is the normalized exponential function.

Images