Log data classification method and device, electronic equipment, nonvolatile storage medium and computer program product

Abstract

The invention discloses a log data classification method and device, electronic equipment, a nonvolatile storage medium and a computer program product, and is applied to the technical field of computers. The method comprises the steps that a target engine is embedded into a target computing device based on a Java local interface, and the target computing device is a running environment of the log auditing system. And compiling a log classification script by adopting a script language matched with the target engine, and dynamically calling the log classification script to process log data through a Java local interface. The problem that the log data classification speed is low in the prior art can be solved, the log data classification efficiency is effectively improved, and the data retrieval processing capacity of a log auditing system is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log data classification method, device, electronic device, non-volatile storage medium and computer program product. Background Art

[0002] The log audit system is used to comprehensively collect logs generated by common security devices, network devices, databases, servers, application systems, hosts and other devices in the enterprise business information system, and store, monitor, audit, analyze, alarm, respond and report on these log data to promptly detect various security threats and abnormal behavior events.

[0003] As the scale of enterprise business information systems continues to increase, distributed architecture is usually used to build the system, which makes log data classification more difficult. Related technologies cannot quickly classify the collected data, and the data retrieval and processing capabilities of the log audit system are reduced.

[0004] In view of this, improving the efficiency of log data classification and effectively improving the data retrieval and processing capabilities of the log audit system are technical problems that need to be solved by those skilled in the art. It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present application provides a log data classification method, device, electronic device, non-volatile storage medium and computer program product, which can improve the efficiency of log data classification and effectively enhance the data retrieval and processing capabilities of the log audit system.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] On one hand, the present application provides a log data classification method, including:

[0008] Embedding a target engine into a target computing device based on a Java local interface; the target computing device is an operating environment of a log audit system, and the target engine is a virtual machine suitable for embedded systems and resource-constrained devices and used to process Java scripts;

[0009] Using a scripting language that matches the target engine to write a log classification script;

[0010] The log classification script is dynamically called through the Java local interface to process the log data.

[0011] Exemplarily, the target engine is QuickJS, and the method of embedding the target engine into the target computing device based on the Java native interface includes:

[0012] Build QuickJS-wrapper and generate Java local interface dynamic link library;

[0013] The Java native interface dynamic link library is linked to the target computing device, and a Java file dependency is generated.

[0014] Exemplarily, the step of writing a log classification script in a scripting language matching the target engine includes:

[0015] Use Javascript language to write a log classification script, and package and compress the log classification script;

[0016] Call an asymmetric encryption algorithm to perform encryption and signature processing on the compressed log classification script.

[0017] Exemplarily, the target computing device is a Java virtual machine, and the step of embedding the target engine into the target computing device based on the Java native interface includes:

[0018] Build QuickJS-wrapper, generate a Java native interface dynamic link library, link the Java native interface dynamic link library to the Java virtual machine, and generate Java file dependencies.

[0019] Exemplarily, the generating of Java file dependencies includes:

[0020] Call the mvn clean package command to generate Java file dependencies.

[0021] Exemplarily, dynamically calling a log classification script to process log data through the Java native interface includes:

[0022] Using the Java local interface to call the log classification script, classify the log data, add a log processing identifier to the log data, and obtain a security analysis field;

[0023] An abnormal behavior event analysis is performed based on the security analysis field.

[0024] On the other hand, the present application provides a log data classification device, including:

[0025] An engine embedding module, used to embed the target engine into a target computing device based on a Java local interface; the target computing device is an operating environment of a log audit system, and the target engine is a virtual machine suitable for embedded systems and resource-constrained devices and used to process Java scripts;

[0026] A script writing module, used to write log classification scripts using a scripting language that matches the target engine;

[0027] The log classification module is used to dynamically call the log classification script to process log data through the Java local interface.

[0028] The present application also provides an electronic device, comprising a processor, wherein the processor is configured to implement the steps of the log data classification method as described in any of the preceding items when executing a computer program stored in a memory.

[0029] The present application also provides a non-volatile storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the log data classification method as described in any of the preceding items are implemented.

[0030] Finally, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the log data classification method as described in any of the preceding items.

[0031] The advantage of the technical solution provided by the present application is that a high-performance target engine is embedded in a computing device that runs a log classification task, a log classification script is written in a language that matches the target engine, and the log classification script is called using a Java native interface. It is not limited by the number of callback functions, and can quickly classify log data from massive data, thereby improving the efficiency of log data classification and effectively enhancing the data retrieval and processing capabilities of the log audit system.

[0032] In addition, the present application also provides corresponding implementation devices, electronic devices, non-volatile storage media and computer program products for the log data classification method, which further makes the method more practical, and the devices, electronic devices, non-volatile storage media and computer program products have corresponding advantages.

[0033] The technical features mentioned above, the technical features to be mentioned below, and the technical features shown separately in the drawings can be combined with each other arbitrarily, as long as the combined technical features are not contradictory. All feasible feature combinations are technical contents clearly recorded in this application. Any of the multiple sub-features contained in the same sentence can be applied independently, and does not have to be applied together with other sub-features.

[0034] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] FIG1 is a flow chart of a log data classification method provided by the present application;

[0037] FIG2 is a flow chart of another log data classification method provided by the present application;

[0038] FIG3 is a structural diagram of a specific implementation of the log data classification device provided by the present application;

[0039] FIG. 4 is a structural diagram of a specific implementation of the electronic device provided in this application. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The terms "including" and "having" and any variations thereof in the specification and the above-mentioned drawings are intended to cover non-exclusive inclusions. The term "exemplary" means "used as an example, embodiment or illustrative". Any embodiment described herein as "exemplary" is not necessarily to be interpreted as being superior or better than other embodiments.

[0041] With the development of cloud technology and big data technology, the scale of business information systems of enterprises continues to increase. Security log auditing can provide security capabilities for pre-warning and post-auditing. In order to adapt to large-scale business information systems, business architecture usually adopts distributed architecture to solve the performance bottleneck of a single machine. At this time, the difficulty of designing query processing of log data and aggregate query data warehouse will be greatly increased, and it is impossible to implement the incremental backup mechanism of data on multiple machines.

[0042] In view of this, in order to improve the above-mentioned problems existing in traditional log analysis and auditing, the present invention enables log analysis and auditing to have efficient data retrieval and processing capabilities and general data alarm analysis rules, embeds a high-performance target engine into a computing device that runs log classification tasks, writes log classification scripts in a language that matches the target engine, and calls the log classification scripts using a Java local interface, so that log data can be quickly classified, and different analysis dashboards are made based on corresponding analysis scenarios, and customized designs can be made according to customer scenarios. After introducing the technical solution of the present application, various non-limiting implementation methods of the present application are described in detail below. In order to better illustrate the present application, numerous specific details are given in the specific implementation methods below. Those skilled in the art should understand that the present application can also be implemented without these specific details. In other examples, methods, means, components and circuits well known to technicians in the relevant field are not described in detail in order to highlight the main purpose of the present application.

[0043] First, please refer to FIG. 1 , which is a flow chart of a log data classification method provided by the present application. The present application may include the following contents:

[0044] S101: Embed a target engine into a target computing device based on a Java native interface.

[0045] S102: Write a log classification script using a scripting language that matches the target engine.

[0046] S103: Dynamically call the log classification script to process the log data through the Java local interface.

[0047] In this embodiment, Javacpp supports only 10 function pointers by default, which is not conducive to fast data processing. JNI (Java Native Interface) uses Writing programs with native interfaces can ensure that the code can be easily ported on different platforms. This embodiment embeds the target engine into the target computing device through JNI (Java Native Interface), and calls the log classification script through JNI to process the log data. Among them, the target computing device runs the log audit system, that is, it provides the corresponding hardware and software environment for executing the log classification task. The target engine is a virtual machine suitable for embedded systems and resource-constrained devices, and is used to process Java scripts. Accordingly, the computer language used to write the log classification script must match the target engine, so that the target engine can process the log classification script. The log data includes various types of log data generated by various devices in the business information system, including but not limited to operation log data, alarm log data, operation log data, message log data, and status log data.

[0048] In the technical solution provided in the present application, a high-performance target engine is embedded in a computing device that runs a log classification task, a log classification script is written in a language that matches the target engine, and the log classification script is called using a Java native interface. It is not limited by the number of callback functions and can quickly classify log data from massive data. This can improve the efficiency of log data classification and effectively enhance the data retrieval and processing capabilities of the log audit system.

[0049] In the above embodiments, there is no limitation on the target engine and the target computing device. The present invention also provides an exemplary implementation, which may include the following contents:

[0050] In this embodiment, the target engine is QuickJS, and correspondingly, the scripting language matching the target engine is Javascript. The process of embedding the target engine into the target computing device based on the Java native interface includes: building a QuickJS-wrapper and generating a Java native interface dynamic link library; linking the Java native interface dynamic link library to the target computing device and generating Java file dependencies.

[0051] Among them, QuickJS is a lightweight and efficient engine, which is suitable for embedded systems and resource-constrained devices. The log audit system of the present invention is usually deployed on the edge devices of IoT (Internet of Things), so QuickJS is used as a virtual machine to process JavaScript scripts. The log classification script is written in Javascript, and the dynamic capabilities of JS are used to adjust the rules in real time when running. Some frequently modified online businesses are written in JS to gain flexibility. At the same time, it is easy to manage the corresponding business logic written in JS to improve the performance of the business, unify the rule editing technology / grammar, and enhance the flexibility of rule modification.

[0052] Furthermore, in order to ensure script security and improve product security, after writing the log classification script in Javascript language, the log classification script can also be packaged and compressed, and any type of asymmetric encryption algorithm can be called to encrypt and sign the compressed log classification script.

[0053] Furthermore, JVM (Java Virtual Machine, Virtual machines) have perfect Architecture, such as processor, , etc., and also has a corresponding instruction system, which shields the information related to the specific operating system platform, so that the Java program only needs to generate a program that runs on the Java virtual machine. ( ), it can run on multiple platforms without modification. Based on this, the target computing device of the present invention can be a Java virtual machine. The process of embedding the target engine into the target computing device based on the Java native interface may include: building a QuickJS-wrapper, generating a Java native interface dynamic link library, and linking the Java native interface dynamic link library to the Java virtual machine to generate Java file dependencies.

[0054] Among them, wrapper is used as an encapsulation method to wrap the Java native interface in a higher level of abstraction. The use of C++ Wrapper JNI (Java Native Interface) technology can improve the problem of additional call limits caused by the javacpp method used in related technologies, and can adjust the number of callbacks. Use JNI to embed QuickJS into the JVM engine and generate the corresponding executable QuickJS dynamic link library. The core focus of the business should be on using JS to improve the flexibility of log analysis business. JAR (Java Archive) file is a software package file format that can be used to aggregate a large number of java class files, related metadata and resource (such as text, pictures, etc.) files into one file to develop Java platform application software or libraries. Exemplarily, Java file dependencies can be generated by calling the mvn clean package command.

[0055] Furthermore, when designing a java program to process log text, and dynamically calling jni methods to optimize the core logic of dynamically processing log data, the monitoring, auditing, analysis, alarm, response and reporting functions can be realized. The parsing results can be obtained according to the processing results of the log classification script. The parsing results are the security analysis fields required for subsequent security analysis. Through the comprehensive collection, parsing and in-depth correlation analysis of log data, various security threats and abnormal behavior events can be discovered in time. That is, the log classification script is called using the Java local interface to classify and process the log data, and the log processing identifier is added to the log data to obtain the security analysis field; abnormal behavior event analysis is performed based on the security analysis field.

[0056] As can be seen from the above, this embodiment embeds the QuickJS engine into the JVM and uses the Javascript language to write the log classification script, which can quickly classify log data from massive data, and is conducive to timely discovering various security threats and abnormal behavior events.

[0057] Finally, in order to make those skilled in the art more clearly understand the technical solution of the present invention, the present invention also provides an exemplary embodiment, which improves the existing log audit system based on the QuickJS script running environment, builds a real-time log analysis data warehouse for the enterprise, and ingests, indexes, and performs rule queries on business logs in heterogeneous data sources, which may include the following contents:

[0058] S201: Build QuickJS-wrapper and generate a Java local interface dynamic link library.

[0059] S202: Linking the Java native interface dynamic link library to the Java virtual machine.

[0060] S203: Call the mvn clean package command to generate Java file dependencies.

[0061] S204: Use Javascript language to write a log classification script, and package and compress the log classification script.

[0062] S205: Call an asymmetric encryption algorithm to perform encryption and signature processing on the compressed log classification script.

[0063] S206: Dynamically call the log classification script to process the log data through the Java local interface, add a log processing identifier to the log data, and obtain a security analysis field.

[0064] S207: Analyze abnormal behavior events based on the security analysis field.

[0065] As can be seen from the above, this embodiment embeds the QuickJS engine into the JVM, uses the Javascript language to write a log classification script, quickly classifies the log from the massive data, and then marks the corresponding log processing identifier to facilitate the subsequent business process to identify the log.

[0066] It should be noted that there is no strict order of execution between the steps in the present application. As long as they conform to the logical order, these steps can be executed simultaneously or in a preset order. Figures 1 and 2 are only a schematic diagram and do not mean that this is the only execution order.

[0067] The present application also provides a corresponding device for the log data classification method, which further makes the method more practical. Among them, the device can be described from the perspective of functional modules and hardware. The log data classification device provided by the present application is introduced below. The device is used to implement the log data classification method provided by the present application. In this embodiment, the log data classification device may include or be divided into one or more program modules, and the one or more program modules are stored in a storage medium and executed by one or more processors to complete the log data classification method disclosed in Example 1. The program module referred to in this application refers to a series of computer program instruction segments that can perform specific functions, which is more suitable for describing the execution process of the log data classification device in the storage medium than the program itself. The following description will specifically introduce the functions of each program module of this embodiment. The log data classification device described below and the log data classification method described above can be referenced to each other.

[0068] From the perspective of functional modules, see FIG3 , which is a structural diagram of a log data classification device provided by the present application in a specific implementation manner. The device may include:

[0069] The engine embedding module 301 is used to embed the target engine into the target computing device based on the Java local interface; the target computing device is the operating environment of the log audit system, and the target engine is a virtual machine suitable for embedded systems and resource-constrained devices and used to process Java scripts;

[0070] A script writing module 302, used to write a log classification script using a scripting language that matches the target engine;

[0071] The log classification module 303 is used to dynamically call the log classification script to process log data through the Java local interface.

[0072] Optionally, in some implementations of this embodiment, the engine embedding module 301 may also be used for:

[0073] The target engine is QuickJS, build QuickJS-wrapper, generate a Java native interface dynamic link library, link the Java native interface dynamic link library to the target computing device, and generate Java file dependencies.

[0074] Optionally, in some other implementations of this embodiment, the script writing module 302 may also be used to:

[0075] Use Javascript to write log classification scripts, and package and compress the log classification scripts;

[0076] Call an asymmetric encryption algorithm to perform encryption and signature processing on the compressed log classification script.

[0077] Optionally, in some other implementations of this embodiment, the engine embedding module 301 may also be used for:

[0078] The target computing device is a Java virtual machine. QuickJS-wrapper is built to generate a Java native interface dynamic link library. The Java native interface dynamic link library is linked to the Java virtual machine to generate Java file dependencies.

[0079] As an exemplary implementation of the above embodiment, the engine embedding module 301 may be further used to: call the mvn clean package command to generate Java file dependencies.

[0080] Optionally, in some other implementations of this embodiment, the log classification module 303 may also be used to:

[0081] Use the Java local interface to call the log classification script to classify the log data, add log processing identifiers to the log data, and obtain security analysis fields;

[0082] Analyze abnormal behavior events based on security analysis fields.

[0083] The functions of the functional modules of the log data classification device described in the present application can be specifically implemented according to the method in the above method embodiment. The specific implementation process can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0084] It can be seen from the above that this embodiment effectively improves the efficiency of log data classification and effectively enhances the data retrieval and processing capabilities of the log audit system.

[0085] The log data classification device mentioned above is described from the perspective of functional modules. Furthermore, the present application also provides an electronic device, which is described from the perspective of hardware. Figure 4 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application under one implementation. As shown in Figure 4, the electronic device includes a memory 40 for storing a computer program; a processor 41 for implementing the steps of the log data classification method mentioned in any of the above embodiments when executing the computer program.

[0086] Among them, the processor 41 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the processor 41 may also be a controller, a microcontroller, a microprocessor or other data processing chip. The processor 41 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 41 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 41 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 41 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0087] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices and flash memory storage devices. In some embodiments, the memory 40 may be an internal storage unit of an electronic device, such as a hard disk of a server. In other embodiments, the memory 40 may also be an external storage device of an electronic device, such as a plug-in hard disk equipped on a server, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. Further, the memory 40 may also include both an internal storage unit of an electronic device and an external storage device. The memory 40 may not only be used to store application software and various types of data installed in the electronic device, such as: the code of the program in the process of executing the log data classification method, but also be used to temporarily store data that has been output or is to be output. In this embodiment, the memory 40 is at least used to store the following computer program 401, wherein, after the computer program is loaded and executed by the processor 41, the relevant steps of the log data classification method disclosed in any of the aforementioned embodiments can be implemented. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, and the storage method may be temporary storage or permanent storage. The operating system 402 may include Windows, Unix, Linux, etc. The data 403 may include but is not limited to data corresponding to the log data classification result.

[0088] In some embodiments, the electronic device may further include a display screen 42, an input / output interface 43, a communication interface 44 or a network interface, a power supply 45 and a communication bus 46. Among them, the display screen 42 and the input / output interface 43, such as a keyboard, belong to the user interface, and the optional user interface may also include a standard wired interface, a wireless interface, etc. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device, etc. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface. The communication interface 44 may optionally include a wired interface and / or a wireless interface, such as a WI-FI interface, a Bluetooth interface, etc., which is generally used to establish a communication connection between the electronic device and other electronic devices. The communication bus 46 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG4 shows only one thick line, but this does not mean that there is only one bus or one type of bus.

[0089] Those skilled in the art will appreciate that the structure shown in FIG. 4 does not limit the electronic device and may include more or fewer components than shown in the figure, for example, may also include a sensor 47 for implementing various functions.

[0090] It is understandable that if the log data classification method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes but is not limited to: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), electrically erasable programmable ROM, register, hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, removable disk, CD-ROM, magnetic disk or optical disk, etc. Various media that can store program codes. Based on this, the present invention also provides a non-volatile storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of log data classification recorded in any of the above embodiments are performed.

[0091] It is understandable that if the log data classification method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, the computer software product does not need to be stored in a physical storage medium. For example, it can be directly transmitted to a computer or other device with information processing capabilities through a wired network or a wireless network to perform all or part of the steps of the methods of each embodiment of the present invention. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product. Based on this, the present invention also provides a computer program product that stores a computer program. When the computer program is executed by a processor, the steps of log data classification recorded in any of the above embodiments are performed.

[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the hardware disclosed in the embodiments, including devices and electronic devices, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0093] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0094] The above is a detailed introduction to a log data classification method, device, electronic device, non-volatile storage medium and computer program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that based on the embodiments in the present application, for ordinary technicians in this technical field, all other embodiments obtained without creative work are within the scope of protection of the present application. Without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A log data classification method, characterized in that: include: Embed the target engine into the target computing device based on the Java native interface; The target computing device is the operating environment of the log audit system, and the target engine is a virtual machine suitable for embedded systems and resource-constrained devices and used to process Java scripts; Using a scripting language that matches the target engine to write a log classification script; The log classification script is dynamically called through the Java local interface to process the log data.

2. The log data classification method according to claim 1, characterized in that: The target engine is QuickJS, and the method of embedding the target engine into the target computing device based on the Java local interface includes: Build QuickJS-wrapper and generate Java local interface dynamic link library; The Java native interface dynamic link library is linked to the target computing device, and a Java file dependency is generated.

3. The log data classification method according to claim 1, characterized in that: The log classification script is written in a scripting language matching the target engine, including: Use Javascript language to write a log classification script, and package and compress the log classification script; Call an asymmetric encryption algorithm to perform encryption and signature processing on the compressed log classification script.

4. The log data classification method according to claim 1, characterized in that: The target computing device is a Java virtual machine, and the method of embedding the target engine into the target computing device based on the Java native interface includes: Build QuickJS-wrapper, generate a Java native interface dynamic link library, link the Java native interface dynamic link library to the Java virtual machine, and generate Java file dependencies.

5. The log data classification method according to claim 4, characterized in that: The generated Java file dependencies include: Call the mvn clean package command to generate Java file dependencies.

6. The log data classification method according to any one of claims 1 to 5, characterized in that: The method of dynamically calling the log classification script to process the log data through the Java local interface includes: Using the Java local interface to call the log classification script, classify the log data, add a log processing identifier to the log data, and obtain a security analysis field; An abnormal behavior event analysis is performed based on the security analysis field.

7. A log data classification device, characterized in that: include: An engine embedding module, used for embedding a target engine into a target computing device based on a Java native interface; The target computing device is the operating environment of the log audit system, and the target engine is a virtual machine suitable for embedded systems and resource-constrained devices and used to process Java scripts; A script writing module, used to write log classification scripts using a scripting language that matches the target engine; The log classification module is used to dynamically call the log classification script to process log data through the Java local interface.

8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the processor is used to implement the steps of the log data classification method according to any one of claims 1 to 6 when executing a computer program stored in the memory.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the log data classification method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the log data classification method according to any one of claims 1 to 6 are implemented.

Images