Holographic log monitoring method based on UEFI

Abstract

The invention relates to the technical field of data processing, and provides a UEFI (Unified Extensible Firmware Interface)-based holographic log monitoring method, which comprises the following steps of: acquiring complete track data of an operating system from starting to closing, and detecting the data by utilizing a holographic monitoring detection model to generate holographic log data. According to the method, the system control right is taken over from the EFI layer, the kernel layer, the upper layer application process and the like of the operating system are monitored in real time, the holographic log is updated in real time, and the integrity of log data is improved. Meanwhile, the UEFI digital signature is used for signing the holographic log data, so that the data is credible, in addition, the holographic log data can be analyzed in real time, an abnormal behavior mode is detected, an early warning mechanism is triggered when potential threats are detected, the safety of the system is improved, and the system performance can be optimized by deducing the holographic log data reversely or forwardly.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a holographic log monitoring method based on UEFI. Background Art

[0002] UEFI-based holographic log monitoring technology can achieve comprehensive monitoring and recording of system activities, providing strong protection for information security. With the continuous advancement of technology and the expansion of application scenarios, UEFI-based holographic log monitoring technology is expected to play an important role in more fields and provide new solutions for digital transformation and information security protection.

[0003] Existing log monitoring technology mainly diagnoses the system status by analyzing the log data generated by the system. Existing log monitoring technology has been widely used in network security, system operation and maintenance, and business analysis. Existing log monitoring technology requires frequent data backup. During the frequent data backup process, if the system fails or is attacked between two data backups, data loss will occur. Due to data loss, abnormal behavior in the system cannot be accurately identified. Summary of the invention

[0004] In view of the shortcomings of the existing technology, the present invention provides a holographic log monitoring method based on UEFI to solve the problem that the existing log monitoring technology requires frequent data backup. During the frequent data backup process, if the system fails or is attacked between two data backups, data loss will occur. Due to data loss, abnormal behavior in the system cannot be accurately identified.

[0005] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows: The present invention provides a holographic log monitoring method based on UEFI, comprising: Step S101, obtaining the operation trajectory data including the operating system, detecting the operation trajectory data including the system through the holographic monitoring detection model, obtaining the qualified holographic monitoring data, summarizing the qualified holographic monitoring data, obtaining the holographic log data, which includes the complete trajectory information of the computer system from startup to operation and then to shutdown, and is used to provide data support for subsequent log analysis; Step S102, using a preset data mining algorithm to perform data mining on the holographic log data, and reverse or forward deducing the holographic log data through the preset data mining algorithm to achieve backtracking and prediction of system monitoring data; Step S103, receiving computer startup information. When receiving the computer startup signal, the system control is taken over from the EFI layer to monitor the system. The monitoring scope includes the operating system kernel layer and the upper application process. The records include file operations, registry changes, network activities, process thread behaviors, and data running tracks in the system. Real-time monitoring data is obtained. Based on the real-time monitoring data, a holographic log is constructed. The holographic log includes all behavior records of the system from startup to the current moment. Step S104, receiving UEFI digital signature information and UEFI digital signature configuration, performing UEFI digital signature on the holographic log data according to the UEFI digital signature information, generating a pair of public key and private key, wherein the public key is used to encrypt the signature, and the private key is used to decrypt and verify the authenticity of the signature, configuring the signature environment according to the UEFI digital signature configuration, wherein the configuration of the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters, and using the generated private key and the configured signature tool to digitally sign the holographic log data. The signing process will apply the private key to the holographic log data to generate a signature value. After the signing is completed, the signature will be verified using the public key. The verification process will check whether the signature value matches the original log data, thereby verifying that the log data has not been tampered with after signing. If the verification passes, the digital signature is valid, and the holographic log data is regarded as credible data. Step S105, real-time analysis of the holographic log data is performed to detect abnormal behavior patterns, which include unauthorized file access, registry tampering, and signs of network attacks. When a potential threat is detected, an early warning mechanism is triggered to notify the system administrator and execute a preset security response strategy.

[0006] Furthermore, the UEFI-based holographic log monitoring method of the present invention, step S101, comprises: In step S101, the operation trajectory data including the system is detected by the holographic monitoring detection model. The specific steps to obtain qualified holographic monitoring data are: obtaining the complete trajectory data of the operating system from startup to operation and then to shutdown, using the holographic monitoring detection model to detect, and through the preset algorithm and data screening rules, filtering out data that meets the preset standards as qualified data, and summarizing the qualified data to generate holographic log data of the information. The holographic log data is used to provide data for subsequent log analysis.

[0007] Furthermore, in the UEFI-based holographic log monitoring method of the present invention, step S102 includes: In step S102, the holographic log data is mined using a preset data mining algorithm, and the specific steps of reverse or forward deduction are: extracting features from the holographic log data, and matching the extracted feature data in a preset algorithm knowledge base to obtain a preset data mining algorithm that matches the characteristics of the holographic log data. The preset data mining algorithm includes a decision tree, a support vector machine, or a neural network. The holographic log data is analyzed and mined using the preset data mining algorithm to obtain hidden patterns, associations, and trends in the holographic log data. User demand information is received, and reverse or forward deduction is selected based on the user demand information. Reverse deduction is to start from the result and reversely deduce the cause or influencing factor, while forward deduction is to start from known factors and predict future results or trends.

[0008] Furthermore, the UEFI-based holographic log monitoring method of the present invention, step S103, includes: In step S103, the specific steps of constructing a holographic log based on real-time monitoring data are: taking over system control from the EFI layer, starting comprehensive monitoring after the system is started, capturing and recording the activities of the operating system kernel layer and upper-layer application processes in real time. The activities of the operating system kernel layer and upper-layer application processes include file operations, registry changes, network activities, process thread behaviors, and data running trajectories within the system. The real-time monitoring data are integrated using preset data processing technology, and a holographic log including all behavior records from system startup to the current moment is constructed in chronological order and event correlation.

[0009] Furthermore, the UEFI-based holographic log monitoring method of the present invention, step S104, includes: The specific steps of performing UEFI digital signature on the holographic log data according to the UEFI digital signature information and generating a pair of public and private keys are as follows: Use the digital signature tool provided by UEFI, which includes the RSA algorithm, and generate a pair of public and private keys according to the UEFI digital signature information, wherein the public key is used to encrypt the signature and the private key is used to decrypt and verify the authenticity of the signature; configure the signature environment according to the UEFI digital signature configuration, and configuring the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters; use the generated private key and the configured signature tool to digitally sign the holographic log data; the signing process will apply the private key to the holographic log data, and generate a signature value through the encryption algorithm, which will serve as proof of the authenticity of the holographic log data.

[0010] Furthermore, the UEFI-based holographic log monitoring method of the present invention, step S104, includes: In step S104, after the signature is completed, the signature is verified using the public key. The specific steps to improve the integrity and authenticity of the holographic log data are: use the pre-generated public key to decrypt the digital signature on the holographic log data, pair the public key with the private key, and compare the signature value obtained after decryption with the original log data. If the signature value is exactly the same as the original log data after comparison, the verification is passed and the digital signature is deemed valid. The digital signature is deemed valid, which means that the holographic log data has not been tampered with after signing and is deemed to be trusted data.

[0011] Furthermore, the UEFI-based holographic log monitoring method of the present invention, step S105, comprises: The specific steps of real-time analysis of holographic log data, detection of abnormal behavior patterns, and triggering of early warning mechanisms when potential threats are detected are as follows: holographic log data is collected through a real-time monitoring system, abnormal behavior rules are pre-built, and real-time analysis of holographic log data is performed using pre-built abnormal behavior rules. Real-time analysis includes analysis of abnormal behavior patterns of unauthorized file access, registry tampering, and signs of network attacks. When a match with these rules or patterns appears in the holographic log data, it is considered that a potential threat has been detected. When a potential threat is detected, the system triggers an early warning mechanism and notifies the system administrator via email, text message, or other instant messaging methods.

[0012] Beneficial effects of the present invention: The present invention obtains the complete trajectory data of the operating system from startup to operation and then to shutdown, and uses a holographic monitoring detection model to detect the data to generate holographic log data, thereby achieving real-time log data and avoiding the tedious steps of regular backup required in traditional methods.

[0013] Take over system control from the EFI layer, monitor the operating system kernel layer, upper application processes, etc. in real time, and update the holographic log in real time. This means that the log data is continuously updated as the system runs, rather than backed up at a specific point in time, reducing the need for backup management. Use the UEFI digital signature to sign the holographic log data, and use the public and private key verification mechanism to ensure that the log data has not been tampered with after signing. This step enhances the credibility of the log data, allowing system administrators to have greater trust in the integrity of the log data.

[0014] The holographic log data is analyzed in real time to detect abnormal behavior patterns and trigger an early warning mechanism when a potential threat is detected. The instant feedback mechanism enables system administrators to promptly discover and handle security issues, thereby avoiding the situation where log data is invalid or requires additional backups due to problems not being discovered in time. By comprehensively monitoring and analyzing system behavior in real time, the present invention can effectively detect abnormal behaviors such as unauthorized file access, registry tampering, and signs of network attacks, and promptly issue early warnings and take corresponding security response strategies, thereby improving the overall security of the system.

[0015] By reverse or forward deducing the hidden patterns, associations and trends in holographic log data, it can help system administrators better understand system behavior, optimize system performance and improve system operation efficiency. Since real-time monitoring and real-time update of log data are achieved, the frequent backup and management work required in traditional methods is avoided, thereby reducing operation and maintenance costs and improving work efficiency.

[0016] In summary, the UEFI-based holographic log monitoring method of the present invention effectively solves the problems existing in the existing log monitoring technology through technical means such as real-time construction and updating of holographic logs, digital signatures to make data credible, abnormal behavior detection and early warning, and improves the security and operation and maintenance efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on the drawings without paying any creative labor.

[0018] Figure 1 A flow chart of a UEFI-based holographic log monitoring method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0020] In order to better understand the purpose of the present invention, the present invention is described in further detail below.

[0021] The present invention provides a holographic log monitoring method based on UEFI, comprising: Step S101, obtaining the operation trajectory data including the operating system, detecting the operation trajectory data including the system through the holographic monitoring detection model, obtaining the qualified holographic monitoring data, summarizing the qualified holographic monitoring data, obtaining the holographic log data, which includes the complete trajectory information of the computer system from startup to operation and then to shutdown, and is used to provide data support for subsequent log analysis; Obtain the running track data including the operating system, test these data through the holographic monitoring detection model, select the qualified holographic monitoring data, and summarize the holographic log data, including the complete track data of the operating system from startup to operation and then to shutdown. These data cover all the running activities of the system and provide a basis for subsequent log analysis.

[0022] The acquired running trajectory data is tested using the holographic monitoring detection model. This model is based on the preset algorithm and data screening rules, and can filter out data that meets the preset standards. Through the preset algorithm and data screening rules, the data that meets the preset standards is screened out as qualified data for detection. These qualified data will be summarized to generate holographic log data.

[0023] Holographic log data includes complete track information of the computer system from startup to operation and then to shutdown. It records all key activities of the system and provides comprehensive and detailed data support for subsequent log analysis. The main purpose of holographic log data is to provide data support for subsequent log analysis. Through in-depth analysis of these data, potential problems or abnormal behaviors in system operation can be discovered, so that corresponding measures can be taken.

[0024] In the actual implementation process, it is necessary to improve the accuracy and effectiveness of the holographic monitoring detection model. This requires continuous optimization and adjustment of the model to adapt to different system environments and operation scenarios. At the same time, the real-time and integrity of the data must be considered so that no key information is missed when obtaining the operation trajectory data, and the data can be updated and summarized in real time.

[0025] Summary: Step S101 obtains the operation trajectory data of the operating system and uses the holographic monitoring detection model to filter and summarize it, thereby generating comprehensive and detailed holographic log data. The holographic log data provides strong support for subsequent log analysis and helps to discover potential problems or abnormal behaviors in system operation.

[0026] The core of the holographic monitoring detection model lies in its preset algorithms and data screening rules. The preset algorithms and data screening rules can accurately filter out data that meets the preset standards from the original running trajectory data. The preset algorithms and data screening rules include the following technical contents.

[0027] Data preprocessing algorithm: Data cleaning: Remove duplicate data: Use hashing algorithms or data comparison techniques to identify and delete duplicate records.

[0028] Filling missing values: For missing data in time series, interpolation methods (such as linear interpolation, polynomial interpolation) or the mean / median of previous and next data are used to fill the missing data.

[0029] Outlier detection and processing: Apply statistical methods (such as the 3σ principle) or machine learning models (such as IsolationForest) to identify outliers and correct or delete them based on business logic.

[0030] Data normalization / standardization: Normalize or standardize data of different dimensions to ensure that the algorithm is not affected by the data unit or range when processing. For example, use minimum-maximum normalization or Z-score normalization methods.

[0031] Feature extraction algorithm: Time features: Extract information such as year, month, day, hour, and minute from the timestamp to analyze the time distribution and periodicity of the data, calculate the time interval between events, and identify abnormal delays or frequent activities.

[0032] Spatial characteristics: For trajectory data, calculate physical quantities such as movement speed, acceleration, and direction change to identify abnormal movement patterns. Use geographic information system (GIS) technology to map trajectory data to geographic space and analyze the rationality of spatial distribution and movement paths.

[0033] Behavioral characteristics: Apply machine learning algorithms (such as clustering algorithms and classification algorithms) to perform pattern recognition on trajectory data and extract common behavior patterns or abnormal behavior patterns.

[0034] Use sequence mining techniques, such as frequent subsequence mining, to discover repetitive patterns or abnormal sequences in trajectories.

[0035] Data filtering rules: Threshold screening: Set the threshold range for each feature, such as speed range, time interval range, etc. Only data that meets the threshold conditions will be considered qualified data.

[0036] Pattern matching: Use regular expressions or pattern matching algorithms to match specific patterns in trajectory data, such as identifying specific movement paths or behavior patterns.

[0037] Statistical screening: Perform statistical analysis on the data, such as calculating the mean, variance and other statistics of a feature, and screen the data based on the statistical results. For example, data points with too large variance can be removed as noise.

[0038] Business rule screening: Based on specific business needs, formulate a series of business rules, such as "specific behaviors are not allowed within a certain time period", to screen trajectory data.

[0039] Data aggregation and holographic log generation: Data aggregation: Aggregate the screened qualified data according to chronological order or other logic to form a structured data set.

[0040] Holographic log generation: Use data visualization technology (such as line charts, scatter plots, heat maps, etc.) to visualize the summary data and generate holographic log data.

[0041] Holographic log data should contain detailed information of the original data, records of the screening process, abnormal data identification, and visual charts to facilitate subsequent analysis and auditing.

[0042] Step S102, using a preset data mining algorithm to perform data mining on the holographic log data, and reverse or forward deducing the holographic log data through the preset data mining algorithm to achieve backtracking and prediction of system monitoring data; The holographic log data is subjected to feature extraction, and these features represent important information in the log data. The extracted feature data is matched in the preset algorithm knowledge base to find the preset data mining algorithm that best matches the characteristics of the holographic log data.

[0043] Holographic log data is analyzed and mined using preset data mining algorithms (such as decision trees, support vector machines, or neural networks). During the mining process, the algorithm attempts to discover hidden patterns, associations, and trends in the holographic log data.

[0044] Derivation selection, receiving user demand information, and performing reverse deduction or forward deduction based on the demand selection. Reverse deduction is to start from the result and reversely deduce the cause or influencing factor. Forward deduction is to start from the known factors and predict the future results or trends.

[0045] The selection of data mining algorithms, according to the characteristics of holographic log data, select the appropriate algorithm for analysis. For example, decision trees are suitable for classification and regression problems, support vector machines are suitable for high-dimensional data and small sample data, and neural networks are suitable for the recognition of complex patterns and relationships.

[0046] Importance of feature extraction,Feature extraction is a key step in data mining, which directly affects the effect of subsequent analysis.,The extracted features need to be able to fully represent the important information in the log data,so that the algorithm can accurately perform pattern recognition and trend prediction.

[0047] The choice of reverse deduction and forward deduction makes the method adaptable to different application scenarios and user needs. Reverse deduction helps to trace the root cause of the problem, while forward deduction can help predict future system behavior and provide strong support for system management and optimization.

[0048] In practical applications, data mining algorithms need to be sufficiently real-time so that they can process and analyze holographic log data in a timely manner and detect potential problems or abnormal behaviors in a timely manner.

[0049] Step S102 can effectively conduct in-depth mining and analysis of holographic log data, providing strong support for system monitoring and anomaly detection.

[0050] Step S103, receiving computer startup information. When receiving the computer startup signal, the system control is taken over from the EFI layer to monitor the system. The monitoring scope includes the operating system kernel layer and the upper application process. The records include file operations, registry changes, network activities, process thread behaviors, and data running tracks in the system. Real-time monitoring data is obtained. Based on the real-time monitoring data, a holographic log is constructed. The holographic log includes all behavior records of the system from startup to the current moment. The system will perform this step when it receives a computer startup signal. The system takes over control from the EFI layer (EFI, or Extensible Firmware Interface, is an industry standard for defining the interface between the operating system and the platform firmware) in order to start monitoring at the beginning of the system startup to prevent any potential security vulnerabilities from being exploited.

[0051] The monitoring scope includes the operating system kernel layer and upper application processes. This means that the system can go deep into the core level of the operating system and user-level applications for comprehensive monitoring.

[0052] The recorded content is very comprehensive, including file operations, registry changes, network activities, process thread behaviors, and data operation tracks within the system. These records provide valuable data for subsequent log analysis and security incident investigation.

[0053] Through the above monitoring range, the system is able to capture and record these activity data in real time. These data are the basis for building a holographic log.

[0054] Build a holographic log. Based on real-time monitoring data, the system builds a holographic log. The holographic log includes all behavior records from system startup to the current moment, which provides system administrators with a complete and continuous view of system behavior.

[0055] Using the preset data processing technology, the system integrates the real-time monitoring data. The integration process is carried out in chronological order and event correlation, which improves the accuracy and completeness of the holographic log. The holographic log not only provides system administrators with a detailed record of system behavior, but also provides strong support for subsequent log analysis, abnormal behavior detection, and security incident response.

[0056] In the specific implementation process, it involves interception of underlying system calls, efficient algorithms for data capture, and formulation of data storage and management strategies, etc. These details vary depending on the specific implementation, but the core goal is to improve the comprehensiveness and real-time nature of monitoring.

[0057] Step S104, receiving UEFI digital signature information and UEFI digital signature configuration, performing UEFI digital signature on the holographic log data according to the UEFI digital signature information, generating a pair of public key and private key, wherein the public key is used to encrypt the signature, and the private key is used to decrypt and verify the authenticity of the signature, configuring the signature environment according to the UEFI digital signature configuration, wherein the configuration of the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters, and using the generated private key and the configured signature tool to digitally sign the holographic log data. The signing process will apply the private key to the holographic log data to generate a signature value. After the signing is completed, the signature will be verified using the public key. The verification process will check whether the signature value matches the original log data, thereby verifying that the log data has not been tampered with after signing. If the verification passes, the digital signature is valid, and the holographic log data is regarded as credible data. Generate a key pair and use the digital signature tool provided by UEFI (such as the RSA algorithm) to generate a pair of public and private keys. The public key is used to encrypt the signature, and the private key is used to decrypt and verify the authenticity of the signature.

[0058] Configure the signing environment, set the correct signing strategy and signature format, and configure the signing tool parameters according to the UEFI digital signature configuration to ensure that the signing process meets the security requirements of UEFI.

[0059] Perform digital signature and use the generated private key and the configured signature tool to digitally sign the holographic log data. The signing process applies the private key to the holographic log data and generates a signature value through an encryption algorithm. The signature value will serve as proof of the authenticity of the holographic log data.

[0060] Verify the signature. After the signature is completed, use the pre-generated public key to decrypt the digital signature on the holographic log data. The decrypted signature value is compared with the original log data. If the signature value is exactly the same as the original log data, the verification is passed and the digital signature is considered valid.

[0061] Signature validity judgment, if the signature verification passes, the holographic log data is regarded as credible data, ensuring the integrity and authenticity of the data. If the verification fails, it means that the holographic log data has been tampered with after signing, which requires further investigation and processing.

[0062] Signature tools and algorithms. The present invention mentions that the digital signature tools provided by UEFI include the RSA algorithm, which is a widely used asymmetric encryption algorithm that can provide higher security.

[0063] Although step S104 focuses on the digital signature process, it is closely related to the collection of real-time monitoring data and the construction of holographic logs. Digital signatures enhance the credibility of holographic log data and provide a basis for subsequent log analysis and abnormal behavior detection.

[0064] Abnormal behavior detection and early warning, when the holographic log data passes the digital signature verification, the system can analyze it in real time and detect abnormal behavior patterns. When a potential threat is detected, the system will trigger the early warning mechanism, notify the system administrator and execute the preset security response strategy.

[0065] Through UEFI digital signature technology, the holographic log monitoring method of the present invention improves the security and compliance of system logs, which is of great significance for meeting industry security standards and regulatory requirements.

[0066] In summary, step S104 improves the integrity and authenticity of the holographic log data through a series of carefully designed steps and technical details, and provides a strong guarantee for system security.

[0067] Step S105, real-time analysis of the holographic log data is performed to detect abnormal behavior patterns, which include unauthorized file access, registry tampering, and signs of network attacks. When a potential threat is detected, an early warning mechanism is triggered to notify the system administrator and execute a preset security response strategy.

[0068] Step S105 is to perform real-time analysis on the holographic log data, detect abnormal behavior patterns, and trigger an early warning mechanism when a potential threat is detected.

[0069] The real-time monitoring system collects holographic log data. The system continuously collects and records holographic log data through the real-time monitoring system. These data include all behavior records from system startup to the current moment, such as file operations, registry changes, network activities, process thread behavior, etc.

[0070] Pre-constructing abnormal behavior rules: Before step S105 begins, the system has pre-constructed a set of abnormal behavior rules, which define abnormal behavior patterns such as unauthorized file access, registry tampering, and network attack signs.

[0071] Real-time analysis using abnormal behavior rules: The system uses pre-built abnormal behavior rules to perform real-time analysis on the holographic log data collected in real time. The analysis process includes comparing the log data with the abnormal behavior rules to detect whether there is a match.

[0072] Detect abnormal behavior patterns. When a match with abnormal behavior rules appears in the holographic log data, the system is considered to have detected a potential threat. These potential threats include unauthorized file access, registry tampering, network attacks, etc.

[0073] Trigger the early warning mechanism. When a potential threat is detected, the system immediately triggers the early warning mechanism. The early warning mechanism can notify the system administrator or other relevant personnel via email, SMS or other instant messaging methods.

[0074] Execute preset security response strategies. When the early warning mechanism is triggered, the system will also execute preset security response strategies. These strategies include blocking abnormal behaviors, isolating infected system components, recording and reporting abnormal events, etc.

[0075] Through the real-time analysis and early warning mechanism of step S105, the system can promptly detect and respond to potential threats, thereby improving the security and stability of the system.

[0076] Step S105 collects holographic log data through a real-time monitoring system, uses pre-built abnormal behavior rules to perform real-time analysis, detects abnormal behavior patterns, and triggers an early warning mechanism and executes a preset security response strategy when a potential threat is detected.

[0077] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S101, includes: In step S101, the operation trajectory data including the system is detected by the holographic monitoring detection model. The specific steps to obtain qualified holographic monitoring data are: obtaining the complete trajectory data of the operating system from startup to operation and then to shutdown, using the holographic monitoring detection model to detect, and through the preset algorithm and data screening rules, filtering out data that meets the preset standards as qualified data, and summarizing the qualified data to generate holographic log data of the information. The holographic log data is used to provide data for subsequent log analysis.

[0078] Obtain complete trace data of the operating system from startup to operation and then to shutdown. These data comprehensively record the operation process of the system and provide a basis for subsequent analysis and detection.

[0079] The holographic monitoring detection model is used to detect the acquired running trajectory data. This model is a key component that conducts in-depth analysis and detection of running trajectory data through preset algorithms and data screening rules.

[0080] Through the preset algorithms and data screening rules, the data that meets the preset standards is screened out as qualified data for detection. The screening rules are designed to eliminate invalid or noisy data and retain valuable information to improve the accuracy and reliability of log data.

[0081] The qualified data are collected and the holographic log data is generated. The holographic log data includes the complete track information of the computer system from startup to operation and then to shutdown, providing comprehensive data support for subsequent log analysis.

[0082] Holographic log data is mainly used for subsequent log analysis. By analyzing these data, we can gain an in-depth understanding of the system's operating status, detect potential security threats, and take corresponding countermeasures in a timely manner.

[0083] The holographic monitoring detection model is the core of step S101. It can not only perform in-depth analysis and detection of running trajectory data through algorithms and data screening rules, but also make the screened data meet the preset standards with high accuracy and reliability.

[0084] Data integrity is an important guarantee for step S101. By obtaining complete track data from system startup to shutdown, the comprehensiveness and integrity of log data can be improved, providing a solid foundation for subsequent analysis and detection.

[0085] In summary, step S101 obtains the complete trajectory data of the operating system from startup to operation and then to shutdown, uses the holographic monitoring detection model to detect and screen, and finally generates comprehensive, accurate and reliable holographic log data. The holographic log data provides a solid foundation for subsequent system monitoring and analysis.

[0086] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S102 includes: In step S102, the holographic log data is mined using a preset data mining algorithm, and the specific steps of reverse or forward deduction are: extracting features from the holographic log data, and matching the extracted feature data in a preset algorithm knowledge base to obtain a preset data mining algorithm that matches the characteristics of the holographic log data. The preset data mining algorithm includes a decision tree, a support vector machine, or a neural network. The holographic log data is analyzed and mined using the preset data mining algorithm to obtain hidden patterns, associations, and trends in the holographic log data. User demand information is received, and reverse or forward deduction is selected based on the user demand information. Reverse deduction is to start from the result and reversely deduce the cause or influencing factor, while forward deduction is to start from known factors and predict future results or trends.

[0087] The holographic log data is subjected to feature extraction, and these feature data are the basis for the subsequent data mining process. Features can be numerical, categorical, or textual, depending on the nature of the data and the goal of mining.

[0088] The extracted feature data is matched in the preset algorithm knowledge base, with the goal of finding the preset data mining algorithm that best matches the characteristics of the holographic log data. These algorithms include decision trees, support vector machines, or neural networks, and each algorithm has its applicable scenarios and advantages.

[0089] The holographic log data is analyzed and mined using the matching preset data mining algorithm. The purpose of this step is to discover the hidden patterns, associations and trends in the holographic log data, and provide strong support for subsequent system monitoring and anomaly detection.

[0090] Receive user demand information and choose to perform reverse or forward deduction based on user needs. Reverse deduction is to start from the results and reversely deduce the causes or influencing factors, which helps to understand the root cause of system behavior; forward deduction is to start from known factors and predict future results or trends, which is of great significance for system monitoring and performance optimization.

[0091] Feature extraction is the first step in data mining, and its accuracy directly affects the results of subsequent mining. Therefore, it is necessary to select a suitable feature extraction method so that the extracted features can fully and accurately reflect the characteristics of holographic log data.

[0092] Algorithm selection is a key step in the data mining process. Through feature matching, the most appropriate algorithm can be selected to improve the efficiency and accuracy of data mining. Different algorithms are suitable for different types of data and problems, so they need to be selected according to the actual situation.

[0093] Reverse / forward deduction is one of the important applications of data mining. Reverse deduction can help users understand the root cause of system behavior and find out the key factors that cause abnormalities or problems; forward deduction can help users predict the future behavior of the system and provide support for decision-making.

[0094] In summary, step S102 achieves in-depth analysis and understanding of holographic log data through steps such as feature extraction, algorithm matching, data mining, and derivation selection. This process helps to discover potential problems and abnormal behaviors, and provides strong support for system security and performance optimization.

[0095] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S103, includes: In step S103, the specific steps of constructing a holographic log based on real-time monitoring data are: taking over system control from the EFI layer, starting comprehensive monitoring after the system is started, capturing and recording the activities of the operating system kernel layer and upper-layer application processes in real time. The activities of the operating system kernel layer and upper-layer application processes include file operations, registry changes, network activities, process thread behaviors, and data running trajectories within the system. The real-time monitoring data are integrated using preset data processing technology, and a holographic log including all behavior records from system startup to the current moment is constructed in chronological order and event correlation.

[0096] When the system receives the computer startup signal, step S103 begins to execute, which is the starting point for constructing a holographic log, so that comprehensive monitoring can be performed from the start of system startup.

[0097] The monitoring scope is wide, including all activities of the operating system kernel layer and upper-layer application processes. This means that not only the core behavior of the operating system is monitored, but also the activities of upper-layer applications, thus providing a comprehensive view of system behavior.

[0098] The recorded content is detailed, including file operations, registry changes, network activities, process thread behaviors, and data operation tracks within the system. This information is crucial for understanding system behavior and detecting potential threats.

[0099] Through real-time monitoring, all the behavior records of the system from startup to the current moment are obtained. These records are the basis for building a holographic log, providing a continuous timeline of system behavior.

[0100] Real-time monitoring enables instant capture of system behavior and provides accurate data for subsequent analysis and detection.

[0101] Using preset data processing technology, the real-time monitoring data is integrated. This step is the key to building a holographic log, which improves the accuracy, completeness and availability of the data.

[0102] The data is organized according to chronological order and event relevance, which helps to quickly locate and understand events and their context in subsequent analysis.

[0103] Based on the integrated real-time monitoring data, a holographic log containing all the system behavior records from startup to the current moment is constructed. The holographic log is the core output of the method of the present invention, providing detailed data support for subsequent log analysis and anomaly detection.

[0104] The construction of the holographic log takes into account the integrity, accuracy and chronological order of the data, improving the reliability and practicality of the log.

[0105] Holographic logs include detailed information such as file operations, registry changes, network activities, process thread behaviors, and data operation trajectories within the system. This information provides system administrators with a deeper understanding of system behavior.

[0106] By analyzing holographic logs, system administrators can promptly detect abnormal behaviors, potential threats, and system performance issues, and take appropriate countermeasures.

[0107] In summary, step S103 achieves comprehensive recording and monitoring of system behavior by taking over system control from the EFI layer, comprehensively monitoring system behavior, real-time monitoring data, integrating data using data processing technology, and building a holographic log.

[0108] The preset data processing technology includes the following technical contents: In step S103, in the process of constructing a holographic log based on real-time monitoring data, the preset data processing technology is used to improve the log integrity and accuracy.

[0109] Data preprocessing: Deduplication: For the records captured in real time, deduplication is first performed to ensure that each record is unique and avoid log redundancy caused by duplicate records. Use efficient data structures (such as hash tables) to quickly detect and delete duplicates.

[0110] Timestamp calibration: Calibrate the timestamps of all records to ensure that they are based on a unified time source to eliminate timing confusion caused by system time asynchrony. Use a time synchronization protocol (such as NTP) to regularly synchronize system time with a trusted time source.

[0111] Data format standardization: Convert the captured data into a unified format for subsequent processing and analysis. Define a clear data structure, including field name, data type, and length, to ensure data consistency and readability.

[0112] Data association integration: Event correlation analysis: Analyze the captured activity records and identify the correlation between them, such as the causal relationship between file operations and network activities. Use graph theory algorithms (such as the shortest path algorithm and association rule mining) to discover potential connections between events.

[0113] Time series construction: Arrange all records in chronological order according to timestamps to construct a time series from system startup to the current moment. Use a time series database or index structure (such as a time series tree) to efficiently store and query time series data.

[0114] Multi-level data integration: Integrate multi-level data such as the operating system kernel layer, the activities of upper-level application processes, and the data running tracks within the system to form a comprehensive view of system behavior. Use data fusion technology (such as data warehouse, data cube) to integrate data from different sources and types.

[0115] Data storage: Choose appropriate storage media and file systems to ensure fast writing and reading of log data. Use compression algorithms (such as LZ4 and Snappy) to compress log data to reduce storage space usage.

[0116] Index and retrieval optimization: Create indexes for log data to improve data retrieval efficiency. Use full-text search engines (such as Elasticsearch) or database indexes (such as B-trees and hash indexes) to speed up query operations.

[0117] Data security backup: Implement data encryption and access control policies to ensure the security of log data. Regularly back up log data to remote storage or cloud storage to prevent data loss or damage.

[0118] Log generation strategy: Define the frequency and format of log generation based on business needs and regulatory requirements. Provide flexible log configuration options, allowing users to customize log levels, output formats, storage locations, etc.

[0119] Data visualization: Use data visualization tools (such as Grafana and Tableau) to convert log data into charts, dashboards, etc., so that users can intuitively understand system behavior. Provide interactive query functions to allow users to filter and view log data according to specific conditions.

[0120] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S104, includes: The specific steps of performing UEFI digital signature on the holographic log data according to the UEFI digital signature information and generating a pair of public and private keys are as follows: Use the digital signature tool provided by UEFI, which includes the RSA algorithm, and generate a pair of public and private keys according to the UEFI digital signature information, wherein the public key is used to encrypt the signature and the private key is used to decrypt and verify the authenticity of the signature; configure the signature environment according to the UEFI digital signature configuration, and configuring the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters; use the generated private key and the configured signature tool to digitally sign the holographic log data; the signing process will apply the private key to the holographic log data, and generate a signature value through the encryption algorithm, which will serve as proof of the authenticity of the holographic log data.

[0121] The core task of this step is to perform UEFI digital signature on the holographic log data to improve the integrity and authenticity of the data. This includes receiving UEFI digital signature information and UEFI digital signature configuration.

[0122] Use the digital signature tool provided by UEFI, especially the RSA algorithm, to generate a pair of public and private keys based on the UEFI digital signature information.

[0123] The public key is used to encrypt signatures, while the private key is used to decrypt and verify the authenticity of signatures.

[0124] According to the UEFI digital signature configuration, you need to set the correct signature strategy, signature format, and configure the relevant parameters of the signature tool. This step is the key to improving the signature process to comply with UEFI specifications and security requirements.

[0125] Use the generated private key and the configured signing tool to digitally sign the holographic log data.

[0126] During the signing process, the private key is applied to the holographic log data and a signature value is generated through an encryption algorithm.

[0127] This signature value will serve as proof of the authenticity of the holographic log data and is the key to subsequent verification of data integrity and authenticity.

[0128] After signing, the signature is verified using the public key. The verification process checks whether the signature value matches the original log data, thereby confirming whether the log data maintains integrity and authenticity after signing.

[0129] If the verification is successful, the digital signature is valid and the holographic log data is considered credible.

[0130] During the signing process, the application of the private key and the specific implementation of the encryption algorithm will depend on the UEFI specification and the selected signature algorithm (such as RSA).

[0131] The verification process is to decrypt the signature value through the public key and compare it with the original log data to improve the consistency and integrity of the data.

[0132] In summary, step S104 improves the integrity and authenticity of the log data by generating public keys and private keys, configuring the signature environment, digitally signing the holographic log data, and performing subsequent signature verification.

[0133] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S104, includes: In step S104, after the signature is completed, the signature is verified using the public key. The specific steps to improve the integrity and authenticity of the holographic log data are: use the pre-generated public key to decrypt the digital signature on the holographic log data, pair the public key with the private key, and compare the signature value obtained after decryption with the original log data. If the signature value is exactly the same as the original log data after comparison, the verification is passed and the digital signature is deemed valid. The digital signature is deemed valid, which means that the holographic log data has not been tampered with after signing and is deemed to be trusted data.

[0134] Decrypt the signature using the public key: Use the pre-generated public key to decrypt the digital signature on the holographic log data. The public key and the private key are paired with each other, and only the correct public key can decrypt the signature generated by the corresponding private key.

[0135] Compare the signature value with the original log data: The decrypted signature value is compared with the original log data. This step is the core of the verification process and is used to confirm whether the signature value matches the original log data.

[0136] Verification passed, if after comparison, the signature value is exactly the same as the original log data, then the verification is passed. This indicates that the holographic log data has not been tampered with after signing, and is therefore considered to be credible data.

[0137] Specifically, the UEFI-based holographic log monitoring method of the present invention, step S105, includes: The specific steps of real-time analysis of holographic log data, detection of abnormal behavior patterns, and triggering of early warning mechanisms when potential threats are detected are as follows: holographic log data is collected through a real-time monitoring system, abnormal behavior rules are pre-built, and real-time analysis of holographic log data is performed using pre-built abnormal behavior rules. Real-time analysis includes analysis of abnormal behavior patterns of unauthorized file access, registry tampering, and signs of network attacks. When a match with these rules or patterns appears in the holographic log data, it is considered that a potential threat has been detected. When a potential threat is detected, the system triggers an early warning mechanism and notifies the system administrator via email, text message, or other instant messaging methods.

[0138] Real-time analysis of holographic log data is performed to detect abnormal behavior patterns and trigger early warning mechanisms when potential threats are detected. Through the real-time monitoring system, holographic log data is continuously collected to improve the real-time and integrity of the data.

[0139] A series of abnormal behavior rules are pre-built. These rules are used to identify potential threat behaviors and are key in the detection process. Using pre-built abnormal behavior rules, holographic log data is analyzed in real time to quickly and accurately identify potential threats.

[0140] Abnormal behavior pattern detection, real-time analysis covers the detection of abnormal behavior patterns such as unauthorized file access, registry tampering, and signs of network attacks, which are important indicators for identifying potential threats.

[0141] Rule matching: When a match with a predefined abnormal behavior rule or pattern appears in the holographic log data, the system is considered to have detected a potential threat, which is the prerequisite for triggering the early warning mechanism.

[0142] Early warning mechanism: When a potential threat is detected, the system immediately triggers the early warning mechanism and notifies the system administrator via email, SMS or other instant messaging methods, allowing the administrator to respond quickly.

[0143] Security response strategy: When an early warning is triggered, the system will also execute the preset security response strategy to effectively respond to potential threats and further improve the security of the system.

[0144] By analyzing holographic log data in real time, potential system threats can be discovered and responded to in a timely manner, improving the security and stability of the system, reducing the occurrence of security incidents, and ensuring the normal operation of the system and the security of data.

[0145] The present invention solves the problem that the existing log monitoring technology needs to perform frequent data backup. During the frequent data backup, if the system fails or is attacked between two data backups, data loss will occur. Due to data loss, the abnormal behavior in the system cannot be accurately identified: The present invention obtains the complete trajectory data of the operating system from startup to operation and then to shutdown, and uses a holographic monitoring detection model to detect these data, and then generates holographic log data after screening out qualified data, thereby improving the real-time and integrity of the log data and avoiding the tedious steps of regular backup required in traditional methods.

[0146] The present invention takes over the system control from the EFI layer, monitors the operating system kernel layer, upper application processes, etc. in real time, and updates the holographic log in real time. This means that the log data is continuously updated as the system runs, rather than backed up at a specific time point, thereby reducing the need for backup management.

[0147] The present invention uses UEFI digital signature to sign the holographic log data, and uses the public key and private key verification mechanism to ensure that the log data has not been tampered with after signing. This step enhances the credibility of the log data, allowing system administrators to have greater trust in the integrity of the log data, and further reduces the need for frequent backups due to incomplete or tampered data.

[0148] The present invention analyzes holographic log data in real time, detects abnormal behavior patterns, and triggers an early warning mechanism when a potential threat is detected. This instant feedback mechanism enables system administrators to discover and deal with security issues in a timely manner, thereby avoiding the situation where log data becomes invalid or requires additional backup due to problems not being discovered in time.

[0149] Through the above technical solution, the present invention effectively solves the problem that the existing log monitoring technology needs to be frequently backed up, and improves the efficiency of log monitoring.

Claims

1. A holographic log monitoring method based on UEFI, characterized in that: include: Step S101, obtaining the operation trajectory data including the operating system, detecting the operation trajectory data including the system through the holographic monitoring detection model, obtaining the qualified holographic monitoring data, summarizing the qualified holographic monitoring data, obtaining the holographic log data, and the holographic log data includes the complete trajectory information of the computer system from startup to operation and then to shutdown; Step S102, using a preset data mining algorithm to perform data mining on the holographic log data, and reverse or forward deducing the holographic log data through the preset data mining algorithm; Step S103, receiving computer startup information. When receiving the computer startup signal, the system control is taken over from the EFI layer to monitor the system. The monitoring scope includes the operating system kernel layer and the upper application process. The records include file operations, registry changes, network activities, process thread behaviors, and data running tracks in the system. Real-time monitoring data is obtained. Based on the real-time monitoring data, a holographic log is constructed. The holographic log includes the behavior records of the system from startup to the current moment. Step S104, receiving UEFI digital signature information and UEFI digital signature configuration, performing UEFI digital signature on the holographic log data according to the UEFI digital signature information, generating a pair of public key and private key, wherein the public key is used to encrypt the signature, and the private key is used to decrypt and verify the authenticity of the signature, configuring the signature environment according to the UEFI digital signature configuration, wherein the configuration of the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters, and using the generated private key and the configured signature tool to digitally sign the holographic log data. The signing process applies the private key to the holographic log data to generate a signature value. After the signing is completed, the signature is verified using the public key. The verification process checks whether the signature value matches the original log data, thereby verifying that the log data has not been tampered with after signing. If the verification passes, the digital signature is valid, and the holographic log data is regarded as credible data. Step S105, real-time analysis of the holographic log data is performed to detect abnormal behavior patterns, which include unauthorized file access, registry tampering, and signs of network attacks. When a potential threat is detected, an early warning mechanism is triggered to notify the system administrator and execute a preset security response strategy.

2. The UEFI-based holographic log monitoring method according to claim 1, characterized in that: The step S101 includes: The complete trajectory data of the operating system from startup to operation and then to shutdown is obtained, and the holographic monitoring detection model is used for detection. Through the preset algorithm and data screening rules, the data that meets the preset standards is screened out as qualified data for detection, and the qualified data is summarized to generate holographic log data of the information. The holographic log data is used to provide data for subsequent log analysis.

3. The UEFI-based holographic log monitoring method according to claim 1, characterized in that: The step S102 includes: Perform feature extraction on the holographic log data, and match the extracted feature data in a preset algorithm knowledge base to obtain a preset data mining algorithm that matches the characteristics of the holographic log data. The preset data mining algorithm includes a decision tree, a support vector machine, or a neural network. The holographic log data is analyzed and mined using the preset data mining algorithm to obtain hidden patterns in the holographic log data, associations of the holographic log data, and trends of the holographic log data. Receive user demand information, and choose to perform reverse deduction or forward deduction based on the user demand information.

4. The UEFI-based holographic log monitoring method according to claim 1, characterized in that: The step S103 includes: After the system is started, comprehensive monitoring begins, capturing and recording the activities of the operating system kernel layer and upper-level application processes in real time. The activities of the operating system kernel layer and upper-level application processes include file operations, registry changes, network activities, process thread behaviors, and data operation trajectories within the system. The real-time monitoring data is integrated using preset data processing technology, and a holographic log is constructed based on chronological order and event correlation, including system behavior records from startup to the current moment.

5. The UEFI-based holographic log monitoring method according to claim 1, characterized in that: The step S104 includes: Use the digital signature tool provided by UEFI, which includes the RSA algorithm. Generate a pair of public and private keys based on the UEFI digital signature information, where the public key is used to encrypt the signature and the private key is used to decrypt and verify the authenticity of the signature. Configure the signature environment according to the UEFI digital signature configuration. Configuring the signature environment includes setting the correct signature strategy, signature format, and configuring the signature tool parameters. Use the generated private key and the configured signature tool to digitally sign the holographic log data. The signing process will apply the private key to the holographic log data and generate a signature value through the encryption algorithm. The signature value will serve as proof of the authenticity of the holographic log data.

6. The UEFI-based holographic log monitoring method according to claim 5, characterized in that: The step S104 includes: The digital signature on the holographic log data is decrypted using the pre-generated public key. The public key and private key are paired with each other, and the signature value obtained after decryption is compared with the original log data. If the signature value is exactly the same as the original log data after comparison, the verification is passed and the digital signature is considered valid. The digital signature is considered valid, which means that the holographic log data has not been tampered with after signing and is considered trusted data.

7. The UEFI-based holographic log monitoring method according to claim 1, characterized in that: The step S105 includes: Holographic log data is collected through a real-time monitoring system, abnormal behavior rules are pre-built, and the pre-built abnormal behavior rules are used to perform real-time analysis on the holographic log data. The real-time analysis includes analyzing abnormal behavior patterns of unauthorized file access, registry tampering, and signs of network attacks. When a match with these rules or patterns appears in the holographic log data, it is considered that a potential threat has been detected. When a potential threat is detected, the system triggers an early warning mechanism and notifies the system administrator via email, text message or other instant messaging methods.

Images