Operating object analysis and extraction method and device, equipment, medium and program product

Abstract

The invention relates to an operation object analysis and extraction method and device, equipment, a medium and a program product. The method comprises the steps of obtaining a target operation log; inputting the target operation log into a first processing model, and identifying a data source type of a data source in the target operation log through the first processing model to obtain a target data source type; determining a target extraction rule corresponding to the target data source type from a preset mapping relationship between data source types and extraction rules; and extracting the operation object based on the target extraction rule. According to the mapping relation between the data source type and the extraction rule, the target extraction rule is directly obtained, and wrong extraction or missing extraction of the operation object in the operation log caused by the wrong extraction rule is avoided. And the data source type is identified by the first processing model, so that the manpower is saved, the efficiency is improved, the accuracy of data source type identification is also improved, and the accuracy of operation object extraction is further improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular to a method, device, equipment, computer storage medium and computer program product for parsing and extracting an operation object. Background Art

[0002] "Operation object" refers to the operation subject in the operation log, that is, the target involved in the operation. By identifying and extracting the operation object, it helps to understand the specific behavior and intention of the user or system, evaluate potential security risks or violations, and prevent possible security threats or data leaks.

[0003] In the prior art, technicians usually check multiple operation logs and manually set corresponding extraction rules to extract operation objects, which results in a lot of meaningless manpower consumption, and the extraction rules manually set by technicians may cause omissions or errors. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a method, apparatus, device, computer storage medium and computer program product for parsing and extracting an operation object.

[0005] The present disclosure provides a method for parsing and extracting an operation object, comprising: obtaining a target operation log; inputting the target operation log into a first processing model, identifying a data source type of a data source in the target operation log through the first processing model, and obtaining a target data source type; wherein the first processing model is obtained by training a learning model based on a historical operation log, and the historical operation log includes the data source type of the data source; determining a target extraction rule corresponding to the target data source type from a mapping relationship between a preset data source type and an extraction rule; and extracting the operation object based on the target extraction rule.

[0006] Optionally, before inputting the target operation log into the first processing model, the method includes: obtaining a historical operation log, wherein the data source type of the historical operation log is the same as that of the target operation log; inputting the historical operation log into a learning model, storing the data source type of the data source in the historical operation log through the learning model, and obtaining the first processing model.

[0007] Optionally, after obtaining the target operation log, the method also includes: obtaining a second processing model, the second processing model including complete data of the target operation log; identifying the previous and next data corresponding to the missing data in the target operation log through the second processing model; comparing the previous and next data corresponding to the missing data with the complete data to obtain a comparison result; based on the comparison result, completing the missing data through the complete data of the target operation log in the second processing model.

[0008] Optionally, obtaining the second processing model includes: obtaining complete data of historical operation logs; wherein the data source type of the historical operation logs and the target operation logs are the same; storing the complete data of the historical operation logs into a neural memory model to obtain the second processing model.

[0009] Optionally, before obtaining the target operation log, the method also includes: obtaining the number of data records stored in the initial operation log; performing a split operation on the initial operation log based on a comparison result between the number and a number threshold; and completing the split operation based on the initial operation log to obtain the target operation log.

[0010] Optionally, before obtaining the target operation log, the method further includes: obtaining interference information in the initial operation log; and deleting the interference information in the initial operation log to obtain the target operation log.

[0011] Optionally, before determining the target extraction rule corresponding to the target data source type from the mapping relationship between preset data source types and extraction rules, the method also includes: obtaining the data source type of the operation object and the extraction rule corresponding to the data source type; and establishing a mapping relationship based on the correspondence between the data source types and extraction rules of multiple different operation objects.

[0012] The present disclosure also provides an operation object parsing and extraction device, the device comprising: an acquisition module, used to acquire a target operation log; an identification module, used to input the target operation log into a first processing model, and identify the data source type of a data source in the target operation log through the first processing model to obtain the target data source type; wherein the first processing model is obtained by training a learning model based on historical operation logs, and the historical operation logs include the data source type of the data source; a determination module, used to determine a target extraction rule corresponding to the target data source type from a mapping relationship between a preset data source type and an extraction rule; and an operation object extraction module, used to extract the operation object based on the target extraction rule.

[0013] The present disclosure also provides a parsing and extraction device for an operation object, the device comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement any of the above parsing and extraction methods for the operation object.

[0014] The present disclosure also provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the above-mentioned method for parsing and extracting any operation object is implemented.

[0015] The present disclosure also provides a computer program product, including a computer program, which implements any of the above-mentioned methods for parsing and extracting operation objects when executed by a processor.

[0016] The present disclosure provides a method, device, equipment, computer storage medium and computer program product for parsing and extracting operation objects. The present disclosure identifies the data source type of the data source in the target operation log through a first processing model, thereby determining the target data source type corresponding to the target operation log. The target extraction rule corresponding to the target data source type is found through the preset mapping relationship between the data source type and the extraction rule, and finally the operation object in the target operation log is extracted according to the target extraction rule, thereby realizing the operation of extracting the operation object from the target operation log. Among them, the first processing model is a learning model, which is a processing model obtained after learning and training all historical operation logs with the same data source type as the data source in the target operation log. Therefore, the present invention extracts the target data source type in the target operation log through the first processing model, and directly matches the target extraction rule corresponding to the target data source type according to the mapping relationship between the data source type and the extraction rule, thereby avoiding errors in the extraction of operation objects in the operation log due to errors in the artificially set extraction rules, and avoiding omissions in the extraction of operation objects in the operation log due to incomplete coverage of the artificially set extraction rules. The identification operation of the data source type is performed by the first processing model, which saves manpower and improves efficiency while also improving the accuracy of data source type identification, thereby improving the accuracy of operation object extraction. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments of the present invention are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a method for parsing and extracting an operation object provided in an embodiment of the present disclosure.

[0019] Figure 2 A schematic diagram of a preferred flow chart for preprocessing a target operation log provided in an embodiment of the present disclosure.

[0020] Figure 3 A schematic diagram of the structure of a device for parsing and extracting an operation object provided in an embodiment of the present disclosure.

[0021] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0022] The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In the detailed description below, many specific details are proposed to provide a comprehensive understanding of the present invention. However, it is obvious to those skilled in the art that the present invention can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present invention by illustrating examples of the present invention.

[0023] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The embodiments will be described in detail below in conjunction with the accompanying drawings.

[0024] Figure 1 A flowchart of a method for parsing and extracting an operation object provided by an embodiment of the present disclosure is shown in FIG. Figure 1 As shown, the method for parsing and extracting the operation object includes: S110-S140.

[0025] S110: Obtain target operation log.

[0026] Exemplarily, the target operation log is the operation log of the operation object extraction operation to be executed, and the operation log is a log recording the behavior operation of the operation object during the running process of the program. Since the operation object is the operation subject in the operation log, in the process of extracting the operation object, it is necessary to first determine the target operation log from which the operation object needs to be extracted, so it is necessary to extract the target operation log recording the user operation information from the storage unit of the file system, so as to perform the subsequent extraction operation of the operation object in the target operation log.

[0027] S120: Input the target operation log into the first processing model, identify the data source type of the data source in the target operation log through the first processing model, and obtain the target data source type.

[0028] Specifically, the first processing model is obtained by training the learning model based on the historical operation log. The learning model is a recognition model, which identifies the keywords in the historical operation log and the data source type of the data source in the historical operation log. The data source type is the type of data source corresponding to the operation object in the operation log. The learning model matches the multiple keywords obtained by identification with the data source type of the corresponding operation log, so that each keyword has a corresponding data source type, thereby obtaining the first processing model. Therefore, the first processing module can identify the data source type of the data source in the target operation log by identifying the keywords in the target operation log, and then obtain the target data source type of the target operation log.

[0029] S130: Determine a target extraction rule corresponding to the target data source type from a preset mapping relationship between the data source type and the extraction rule.

[0030] Specifically, the extraction rule is an extraction rule for extracting the operation object in the operation log. Since each data source type has a pre-set extraction rule, a mapping relationship can be established based on the correspondence between the data source type and the extraction rule to obtain the corresponding extraction rule according to the data source type to help extract the operation object in the operation log. Therefore, after obtaining the data source type of the data source in the target operation log, the target extraction rule corresponding to the target data source type can be directly obtained through the mapping relationship.

[0031] S140: Extracting the operation object based on the target extraction rule.

[0032] Specifically, since the extraction rules are specific extraction rules set for the operation objects of each data source type, the target extraction rules obtained correspond to the operation objects in the target operation log one by one, and only the target extraction rules can extract the operation objects in the target operation log, so that the operation objects can be extracted more accurately by designing specific extraction rules for each data source type. In addition, the formats of the operation logs corresponding to different data source types are different, and even the same data source type will have changes in the operation log format at different time nodes. Therefore, the use of flexible extraction rules can quickly adapt to the changes in the format of the operation log, thereby achieving accurate extraction of the operation object. By adopting unique extraction rules for different data source types, the flexibility and practicality of extracting the operation object can be effectively improved.

[0033] Therefore, the present disclosure extracts the target data source type in the target operation log through the first processing model, and directly matches the target extraction rule corresponding to the target data source type according to the mapping relationship between the data source type and the extraction rule, thereby avoiding errors in the extraction of operation objects in the operation log due to errors in the artificially set extraction rules, and avoiding omissions in the extraction of operation objects in the operation log due to incomplete coverage of the artificially set extraction rules. In addition, the identification operation of the data source type is performed by the first processing model, and there is no need to invest a lot of human resources and time costs to set the extraction rules for the operation objects, which not only saves manpower but also saves time and improves work efficiency, and improves the accuracy of data source type identification, thereby improving the accuracy of operation object extraction.

[0034] In some embodiments, before inputting the target operation log into the first processing model, the method may include: obtaining a historical operation log, wherein the data source type of the historical operation log is the same as that of the target operation log; inputting the historical operation log into the learning model, storing the data source type of the data source in the historical operation log through the learning model, and obtaining the first processing model.

[0035] For example, common data source types include file systems, databases, configuration files, and applications. The operation objects of a file system are files or folders, and the data source of a file system can be a local file system, a network file system, etc. The operation objects of a database can be labels, records, or fields in the database, and the data source of a database can be a relational database, a non-relational database, a data warehouse, etc.

[0036] Taking the data source type as a database as an example, a first processing model is constructed. The database includes keywords, and the keywords are presented in the form of characters. Each keyword is marked in the historical operation log, and the multiple historical operation logs after marking are used to train the learning model. The learning model matches the keyword with the data source type, thereby building the first processing model. Since the first processing model has undergone a lot of learning and training, the data source type corresponding to the keyword can be directly obtained through keyword matching. Therefore, in the process of extracting the operation object, the first processing module can extract and identify the keywords in the target operation log, and directly identify the target data source type according to the identified keywords. Therefore, the present disclosure does not need to identify the target data source type of the target operation log by manpower, but identifies the target data source type through the first processing model that has undergone a lot of learning and training. While saving manpower, it can also avoid the problem of final operation object extraction errors caused by human error in identifying the data source type, improve the accuracy of data source type identification, and then improve the accuracy of operation object extraction.

[0037] In some embodiments, after obtaining the target operation log, the method may further include: performing a preprocessing operation on the target operation log; wherein the preprocessing operation is a processing operation for performing data optimization on the target operation log.

[0038] Exemplary, operation log is usually a large amount of text data recorded in the form of a string, and each operation log contains a large amount of specific operation information about describing the user or system performed. Operation information includes, for example, the user's operation command, operation timestamp, operation object, operation result, etc. These operation logs are recorded in the form of text for subsequent analysis, audit and other processing. Interference information such as noise may be included in the operation log, such as timestamp, Internet Protocol Address (IP address), special characters, etc., which may interfere with the extraction process of the operation object. Therefore, it is necessary to perform pre-processing operations on the operation log to optimize the data of the operation log, so that the interference information existing in the operation log used in the extraction process of the operation object is reduced or even eliminated, so as to improve the accuracy of the extraction of the operation object.

[0039] The preprocessing operation also includes normalizing the text information in the target operation log, such as removing uppercase and lowercase differences, normalizing timestamps, standardizing date formats, normalizing file paths, and normalizing numbers.

[0040] Removing the case difference is to convert the text information in the target operation log into lowercase or uppercase uniformly, eliminating text errors caused by inconsistent uppercase and lowercase.

[0041] Normalized timestamp means that if there is timestamp information in the target operation log, timestamps of different formats will be uniformly converted into the same time format to facilitate subsequent analysis and comparison of timestamp information.

[0042] Standardized date format means that when there is text with date information in the target operation log, the date format can be standardized to unify the date format into the same format to avoid confusion caused by the existence of dates in different formats.

[0043] File path normalization is when the target operation log contains file path information, the file path can be normalized to ensure the consistency of the file path format to avoid confusion caused by inconsistent file path formats.

[0044] When the target operation log contains text with numeric information, the numbers can be normalized, such as unifying the representation of decimal points, removing thousands separators, or displaying the numbers in a unified format.

[0045] It should be noted that the operation information and interference information contained in the operation log mentioned above are examples, and the specific operation information and interference information are determined according to the actual situation and are not specifically limited here.

[0046] In some embodiments, after obtaining the target operation log, the method also includes: obtaining a second processing model, the second processing model including complete data of the target operation log; identifying the previous and next data corresponding to the missing data in the target operation log through the second processing model; comparing the previous and next data corresponding to the missing data with the complete data to obtain a comparison result; based on the comparison result, completing the missing data through the complete data of the target operation log in the second processing model.

[0047] Exemplarily, the target operation log is a text log, and the second processing model stores the complete text data in the operation log. The second processing model identifies the text data of the target operation log. If it is detected that the text data in the target operation log is missing, the second processing model can deduce the missing text data based on the context of the missing text data by comparing it with the complete data of the target operation log, and perform static completion operation on the missing data of the target operation log based on the complete text data, thereby achieving the improvement of the text data of the target operation log. In addition, since the target operation log has no missing text data at all after being processed by the second processing model, there will be no omissions in the process of extracting keywords from the target operation log, thereby making the final extraction of the target operation object more accurate.

[0048] It should be noted that the target operation log being a text log is only an example, and the target operation log may also be other types of logs, which are not specifically limited here.

[0049] In some embodiments, obtaining the second processing model includes: obtaining complete data of the historical operation log; wherein the data source type of the historical operation log is the same as that of the target operation log; storing the complete data of the historical operation log into the neural memory model to obtain the second processing model.

[0050] Exemplarily, taking the historical operation log as a text log as an example, first obtain the historical operation log of the same data source type as the target operation log. The complete data in the historical operation log contains rich operation scenarios and various contextual information. Therefore, the second processing model storing the complete data in the historical operation log can better analyze and infer the missing information in the operation log. At the same time, it is also possible to consider collecting other relevant data, such as database records, configuration files, etc., to assist in the completion of the operation log. After obtaining the historical operation log, it is also necessary to perform preprocessing operations on the historical operation log to filter out noise, invalid information and other data in the historical operation log, and convert the historical operation log into a format that can be used for data storage. The neural memory model can be a recurrent neural network (RNN), a long short-term memory network (LSTM), and a model based on a transformer architecture. The second processing model is obtained by storing the complete text data in the preprocessed historical operation log into the neural memory model, so that the second processing model can complete the target operation log with missing data. Since the second processing model includes the complete text data of the historical operation log of the same data source type as the target operation log, when the second processing model detects that the target operation log has missing text data, the second processing model can deduce the missing text data based on the context of the missing text data by comparing it with the complete data of the target operation log, and perform a static completion operation on the target operation log based on the text data, thereby completing the text data of the target operation log. Since the target operation log has no missing text data at all after being processed by the second processing model, there will be no omissions in the process of extracting keywords from the target operation log, thereby making the final extraction of the target operation object more accurate.

[0051] It should be noted that the historical operation log and the target operation log are text logs for example only, and the historical operation log and the target operation log may also be other types of logs, which are not specifically limited here.

[0052] In some embodiments, before obtaining the target operation log, the method also includes: obtaining the number of data records stored in the initial operation log; performing a split operation on the initial operation log based on a comparison result between the number and a number threshold; completing the split operation based on the initial operation log to obtain the target operation log.

[0053] Specifically, the number of data records in the initial operation log is collected, and the collected number is compared with the number threshold. If the comparison result is that the number is less than the number threshold, the initial operation log is considered to be a log file with less data, and the initial operation log can be directly used as the target operation log to identify keywords and extract the operation object. If the comparison result is that the number is greater than or equal to the number threshold, it is considered that the data storage in the initial operation log is too large. Since the first processing model has a faster processing speed for the operation log with a smaller data storage in the operation process of identifying the target operation log, it is easier to identify and analyze the keywords in the operation log. Therefore, it is necessary to perform a segmentation operation on the initial operation log, so that the initial operation log becomes a plurality of log files with a smaller data storage, and the initial operation log after the segmentation operation is completed is used as the target operation log, thereby improving the processing efficiency of the operation log with a larger data storage. Dividing the operation log into several log files with a smaller data storage helps to quickly locate the specific information of a certain event without having to search in a large amount of messy information. Through the segmentation operation of the operation log, the data can be easier to manage, analyze and utilize, and the efficiency and accuracy of data processing can be improved.

[0054] In some embodiments, before obtaining the target operation log, the method further includes: obtaining interference information in the initial operation log; and deleting the interference information in the initial operation log to obtain the target operation log.

[0055] Exemplarily, the initial operation log can be, for example, a text log. By detecting the text information in the initial operation log, when it is detected that there is special character information in the text information, such as punctuation marks or other symbols that interfere with text processing, it can be regarded as interference information in the initial operation log, so it is necessary to delete the special character information, thereby obtaining the target operation log, so as to implement the deletion operation of the interference information in the operation log, so that the content of the text is clean and regular, and avoid special characters from interfering with the first processing model in the process of character string extraction. When it is detected that there is repeated text information in the text information, the repeated text information can also be regarded as interference information, and the repeated text information can be deleted, reducing the redundancy of the entire target operation log, so that the first processing model can extract keywords from a more concise text log, improving the accuracy of extracting the data source type, and thus improving the accuracy of extracting the operation object.

[0056] It should be noted that the initial operation log being a text log is only an example, and the initial operation log may also be other types of logs, which are not specifically limited here.

[0057] Figure 2 A schematic diagram of a preferred process for preprocessing a target operation log provided by an embodiment of the present disclosure is as follows: Figure 2 As shown, the pre-processing operation of the operation log includes: S210-S250.

[0058] S210: Collect historical operation logs, delete interference information in the historical operation logs, and store complete data of the historical operation logs after the interference information is deleted into a second processing model.

[0059] Exemplarily, the historical operation log may be, for example, a text log, and interference information present in the collected historical operation log is detected and deleted. By detecting the text information of the historical operation log, when it is detected that the text information contains, for example, special characters or repeated text information, the special symbols and repeated text information are deleted. This makes the complete data of the historical operation log stored in the second processing model more concise, so that the second processing model will not be affected by the interference information during the subsequent process of completing the missing text data of the target operation log, thereby improving the efficiency of completing the missing text data.

[0060] S220. Complete the missing data of the target operation log through the second processing model.

[0061] Specifically, the second processing model includes complete text data of historical operation logs of the same data source type as the target operation log, so the second processing model can detect the text data in the target operation log. When missing text data is detected, the context of the missing text data can be analyzed to deduce the missing text data, and the target operation log can be statically completed based on the text data, thereby completing the text data of the target operation log. Since the target operation log does not have missing data in the text data after being processed by the second processing model, there will be no omissions in the process of extracting keywords from the target operation log, thereby making the final extraction of the target operation object more accurate.

[0062] S230: Delete the interference information in the target operation log.

[0063] Exemplarily, the target operation log may be, for example, a text log. By detecting the text information of the target operation log, when it is detected that there is interference information such as special characters or repeated text information in the text information, the special symbols and repeated text information are deleted to delete the interference information in the target operation log, thereby making the text of the target operation log more concise, improving the accuracy of extracting the data source type, and further improving the accuracy of extracting the operation object.

[0064] S240: Compare the number of data records stored in the target operation log with a number threshold, and perform segmentation and normalization operations on the target operation log based on the comparison result.

[0065] Specifically, the number of data records in the target operation log is collected, and the collected number is compared with the number threshold. If the comparison result is that the number is greater than or equal to the number threshold, it is considered that the data storage in the target operation log is too large. Since the first processing model is used to identify the target operation log, the processing speed is faster for the operation log with a smaller data storage, and it is easier to identify and analyze the keywords in the operation log. Therefore, it is necessary to split the target operation log so that the target operation log becomes a plurality of log files with a smaller data storage, thereby improving the processing efficiency of the target operation log with a larger data storage. Splitting the target operation log into several log files with a smaller data storage helps to quickly locate the specific information of a certain event without searching in a large amount of messy information. The format of each information in the operation log can be unified by normalizing the operation log to avoid confusion caused by inconsistent formats. The embodiment of the present disclosure can make data easier to manage, analyze and utilize by segmenting and normalizing the operation log, thereby improving the efficiency and accuracy of data processing.

[0066] S250: Perform vocabulary processing on the target operation log.

[0067] Exemplarily, vocabulary processing may be an operation of removing uppercase and lowercase differences, for example, by converting text information in the operation log into lowercase or uppercase forms to eliminate text errors caused by inconsistent uppercase and lowercase letters.

[0068] Exemplarily, the operation log is usually a large amount of text data recorded in the form of a string, and each operation log contains a large amount of information about the specific operation performed by the user or system. The operation information includes, for example, the user's operation command, operation timestamp, operation object, operation result, etc. These operation logs are recorded in the form of text for subsequent analysis, auditing and other processing. The operation log may contain interference information such as noise, such as timestamp, IP address, special characters, etc., which may interfere with the extraction process of the operation object. Therefore, it is necessary to perform preprocessing operations on the operation log to optimize the data of the operation log. The target operation log is statically completed by the second processing model, so that the text data in the processed target operation log is completely free of missing data, so there will be no omissions in the process of extracting keywords in the target operation log. The cleaning operation performed on the target operation log makes the content of the text in the target operation log clean and regular, so that the first processing model can extract keywords from a more concise text log, thereby improving the accuracy of the extraction of the data source type. By segmenting and normalizing the target operation log, the target operation log is segmented into several log files with smaller data storage, which helps to quickly locate the specific information of a certain event without searching in a large amount of messy information. By segmenting the operation log, the data can be easier to manage, analyze and use, and the efficiency and accuracy of data processing can be improved. By performing vocabulary processing on the target operation log, the text content in the target operation log is segmented, sub-worded, and stop words are removed, which helps the first processing model to extract keywords from the target operation log. Therefore, the present disclosure optimizes the data information of the target operation log through preprocessing operations, which facilitates the first processing model to extract keywords from the target operation log, increases the accuracy of data source type extraction, and thereby improves the accuracy of operation object extraction.

[0069] In some embodiments, before determining the target extraction rule corresponding to the target data source type from the mapping relationship between preset data source types and extraction rules, the method also includes: obtaining the data source type of the operation object and the extraction rule corresponding to the data source type; and establishing a mapping relationship based on the correspondence between the data source types and extraction rules of multiple different operation objects.

[0070] Exemplarily, the extraction rule is a regular expression, and the data source type in the target operation log is identified by the first processing model to obtain the target data source type, and then the regular expression corresponding to the target data source type is obtained by matching the mapping relationship. Data analysis can be performed for different data source types. By observing and analyzing the data, common operation object patterns, features, and context information are determined, and interception rules for each operation object are formulated based on keywords, grammar, and context, and then regular expressions corresponding to each data source type are written to extract the operation object.

[0071] Taking the database operation object as an example, the interception rule is to intercept the first word after the character from the keywords starting with alter table, create database, create table, create view, create or replace view, from, drop table, insert into, truncate table, update, etc., and output the standard field operate_name_standard. Only the first word is retained after multiple interceptions. For the database operation object, the regular expression can be formulated as:

[0072] (alter table|create database|create table|create view|create orreplace view|delete from|drop table|insert into|truncate table|update|desc|show partitions|select.*from)\s+(\w\.|)(?<operate_value1> \S+).*.

[0073] Taking the file operation object as an example, the interception rule is: intercept the full path of the file with suffixes such as csv, txt, json, zip, rar, etc., and intercept multiple files and keep the first one.

[0074] For file-type operation objects, you can formulate a regular expression as follows:

[0075] (?<operate_value2> [\w-]+\.(?:csv|txt|json|zip|tar\.gz|rar)).

[0076] Figure 3 A schematic diagram of a structure of a parsing and extracting device for an operation object provided by an embodiment of the present disclosure, such as Figure 3As shown, the device includes: an acquisition module 310, a recognition module 320, a determination module 330 and an operation object extraction module 340.

[0077] The acquisition module 310 is used to acquire the target operation log.

[0078] The identification module 320 is used to input the target operation log into the first processing model, and identify the data source type of the data source in the target operation log through the first processing model to obtain the target data source type; wherein the first processing model is obtained by training the learning model based on the historical operation log, and the historical operation log includes the data source type of the data source.

[0079] The determination module 330 is used to determine the target extraction rule corresponding to the target data source type from the preset mapping relationship between the data source type and the extraction rule.

[0080] The operation object extraction module 340 is used to extract the operation object based on the target extraction rule.

[0081] In some embodiments, the device also includes a learning model training module.

[0082] The acquisition module is also used to acquire historical operation logs, wherein the historical operation logs are of the same type as the target operation logs.

[0083] A construction module is used to input historical operation logs into a learning model, match the data source type of a data source in the historical operation logs with a preset data source type through the learning model, and train the learning model.

[0084] In some embodiments, the apparatus further comprises an execution module.

[0085] The execution module is used to perform a preprocessing operation on the target operation log; wherein the preprocessing operation is a processing operation for performing data optimization on the target operation log.

[0086] In some embodiments, the device also includes a data completion module.

[0087] The acquisition module is also used to acquire a second processing model, where the second processing model includes complete data of the operation log.

[0088] The identification module is also used to identify the data before and after the missing data of the target operation log through the second processing model.

[0089] The data completion module is used to complete the missing data through the second processing model based on the comparison of the previous and next data of the missing data with the complete data.

[0090] In some embodiments, the device further comprises a data storage module.

[0091] The acquisition module is also used to acquire complete data of the historical operation log; wherein the historical operation log is of the same type as the target operation log.

[0092] The data storage module is used to store the complete data of the historical operation log into the neural processing model to obtain the second processing model.

[0093] In some embodiments, the device also includes a target operation log input module.

[0094] The acquisition module is also used to obtain the number of data records stored in the target operation log.

[0095] The execution module is also used to perform a split operation on the target operation log based on a comparison result between the quantity and the quantity threshold.

[0096] The target operation log input module is used to complete the segmentation operation based on the target operation log and input the target operation log into the first processing model.

[0097] In some embodiments, the device further includes an interference information acquisition module.

[0098] The interference information acquisition module is used to obtain interference information in the target operation log.

[0099] The target operation log input module is further used to delete interference information in the target operation log, and input the target operation log with the interference information deleted into the first processing model.

[0100] In some embodiments, the apparatus further comprises an establishing module.

[0101] The acquisition module is also used to acquire the data source type of the operation object and the extraction rules corresponding to the data source type.

[0102] The establishment module is used to establish a mapping relationship based on the corresponding relationship between the data source types of multiple different operation objects and the extraction rules.

[0103] It can be understood that the device for parsing and extracting operation objects provided in the embodiment of the present disclosure has similar beneficial effects as the method for parsing and extracting operation objects provided in the above-mentioned implementation manner, which will not be elaborated here.

[0104] Based on the parsing and extraction method of the operation object provided in the above embodiment, the embodiment of the present application also provides a specific implementation of the electronic device. Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure.

[0105] The electronic device 400 may include a processor 410 and a memory 420 storing computer program instructions.

[0106] Specifically, the processor 410 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0107] The memory 420 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 420 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 420 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 420 may be inside or outside the electronic device 400. In a particular embodiment, the memory 420 is a non-volatile solid-state memory.

[0108] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of the present application.

[0109] The processor 410 implements any one of the methods for parsing and extracting operation objects in the above embodiments by reading and executing computer program instructions stored in the memory 420 .

[0110] In one example, the electronic device 400 may further include a communication interface 430 and a bus 440. Figure 4 As shown, the processor 410, the memory 420, and the communication interface 430 are connected via a bus 440 and communicate with each other.

[0111] The communication interface 430 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0112] Bus 440 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 440 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0113] Exemplarily, the electronic device 400 may be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA).

[0114] The electronic device can execute the parsing and extraction method of the operation object in the embodiment of the present application, thereby realizing the combination Figure 1 and Figure 2 Describes the parsing extraction methods of the operation object.

[0115] In addition, in combination with the method for parsing and extracting the operation object in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the methods for parsing and extracting the operation object in the above embodiment is implemented.

[0116] An embodiment of the present application also provides a computer program product, including a computer program, which implements any one of the operation object parsing and extraction methods in the above embodiments when the computer program is executed by a processor.

[0117] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0118] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0119] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0120] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0121] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for parsing and extracting an operation object, characterized in that: include: Get the target operation log; Input the target operation log into a first processing model, and identify the data source type of the data source in the target operation log through the first processing model to obtain the target data source type; wherein the first processing model is obtained by training a learning model based on historical operation logs, and the historical operation logs include the data source type of the data source; Determine the target extraction rule corresponding to the target data source type from the preset mapping relationship between the data source type and the extraction rule; Based on the target extraction rule, the operation object is extracted.

2. The method for analyzing and extracting an operation object according to claim 1, characterized in that: Before inputting the target operation log into the first processing model, the method includes: Acquire a historical operation log, wherein the historical operation log and the target operation log have the same data source type; The historical operation log is input into a learning model, and the data source type of the data source in the historical operation log is stored through the learning model to obtain the first processing model.

3. The method for analyzing and extracting an operation object according to claim 1, characterized in that: After obtaining the target operation log, the method further includes: Acquire a second processing model, wherein the second processing model includes complete data of the target operation log; Identifying the previous and next data corresponding to the missing data in the target operation log by using the second processing model; Comparing the previous and next data corresponding to the missing data with the complete data to obtain a comparison result; Based on the comparison result, the missing data is completed using the complete data of the target operation log in the second processing model.

4. The method for analyzing and extracting an operation object according to claim 3, characterized in that: The obtaining of the second processing model comprises: Acquire complete data of a historical operation log; wherein the data source type of the historical operation log is the same as that of the target operation log; The complete data of the historical operation log is stored in the neural memory model to obtain the second processing model.

5. The method for analyzing and extracting an operation object according to claim 1, characterized in that: Before obtaining the target operation log, the method further includes: Get the number of data records stored in the initial operation log; Based on the comparison result between the quantity and the quantity threshold, performing a split operation on the initial operation log; A split operation is completed based on the initial operation log to obtain the target operation log.

6. The method for analyzing and extracting an operation object according to claim 1, characterized in that: Before obtaining the target operation log, the method further includes: Obtain interference information from the initial operation log; The interference information in the initial operation log is deleted to obtain the target operation log.

7. The method for analyzing and extracting an operation object according to claim 1, characterized in that: Before determining the target extraction rule corresponding to the target data source type from the mapping relationship between the preset data source type and the extraction rule, the method further includes: Obtaining the data source type of the operation object and the extraction rule corresponding to the data source type; The mapping relationship is established based on the corresponding relationship between the data source types of multiple different operation objects and the extraction rules.

8. A device for analyzing and extracting an operation object, characterized in that: The device comprises: The acquisition module is used to obtain the target operation log; an identification module, configured to input the target operation log into a first processing model, and identify the data source type of the data source in the target operation log through the first processing model to obtain the target data source type; wherein the first processing model is obtained by training a learning model based on historical operation logs, and the historical operation logs include the data source type of the data source; A determination module, used to determine a target extraction rule corresponding to the target data source type from a preset mapping relationship between the data source type and the extraction rule; The operation object extraction module is used to extract the operation object based on the target extraction rule.

9. A device for parsing and extracting an operation object, characterized in that: The device comprises: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the method for parsing and extracting the operation object according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer storage medium stores computer program instructions, which, when executed by a processor, implement the method for parsing and extracting an operation object as described in any one of claims 1 to 7.

11. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the method for parsing and extracting the operation object according to any one of claims 1 to 7.

Images