Network security log analysis method based on large language model

Abstract

The present invention discloses a network security log analysis method based on a large language model, relates to the technical field of network security log analysis, and solves the problem that the current network security log analysis method is difficult to fully capture abnormal behaviors. The method comprises: obtaining historical abnormal records of computer equipment, detecting the abnormal degree corresponding to the abnormal records, and classifying the abnormal records according to the abnormal degree; setting abnormal rules for the classified abnormal records, and constructing log abnormal data packets in combination with the abnormal rules; obtaining real-time network security log data of the computer equipment, and then performing abnormal detection on the real-time network security log data; obtaining real-time network behavior log data of the computer equipment, and then performing in-depth detection on the real-time network behavior log data; and executing management operations corresponding to the log data according to the detection results. The present invention realizes a comprehensive analysis of network security based on the network security log.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security log analysis, and in particular to a network security log analysis method based on a large language model. Background Art

[0002] Existing network security log analysis methods mainly use automated tools to collect, store and process large amounts of log data in order to discover potential security threats. These methods usually include technologies based on statistical analysis, behavioral analysis, machine learning, etc. Statistical analysis identifies abnormal behavior by aggregating and counting data; behavioral analysis focuses on monitoring the normal behavior of users and devices, and abnormal behavior is considered a potential threat; machine learning methods automatically identify new attack patterns by learning from historical data. By combining multiple technologies, network security log analysis can improve the detection rate of attacks, reduce false alarms, and improve the efficiency of network protection. However, in existing technologies, network security log analysis methods usually focus on analyzing a single feature or a single dimension, and it is difficult to fully capture the multi-dimensional characteristics of abnormal behavior;

[0003] To this end, the present invention proposes a network security log analysis method based on a large language model. Summary of the invention

[0004] The purpose of the present invention is to propose a network security log analysis method based on a large language model to solve the problems raised in the above background technology.

[0005] The technical problems to be solved by the present invention are:

[0006] How to achieve a comprehensive analysis of network security based on network security logs.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A network security log analysis method based on a large language model, the method comprising:

[0009] Step S1, obtaining the abnormal records of the computer device history, detecting the abnormality degree corresponding to the abnormal records, and classifying the abnormal records according to the abnormality degree;

[0010] Step S2, setting exception rules for the classified exception records, and constructing a log exception data packet in combination with the exception rules;

[0011] Step S3, obtaining real-time network security log data of the computer device, and then performing anomaly detection on the real-time network security log data;

[0012] Step S4, obtaining real-time network behavior log data of the computer device, and then performing in-depth detection on the real-time network behavior log data;

[0013] Step S5: Execute management operations corresponding to the log data according to the detection results.

[0014] Furthermore, the step S1 includes the following sub-steps:

[0015] Step S11, pre-processing the abnormal records to remove duplicate abnormal records and blank abnormal records in the abnormal records;

[0016] Step S12, obtaining the number of requests QQC sent by the target IP address when attempting to log in to the source IP address, the amount of data SJL sent between the target IP address and the source IP address, and the number of occurrences of malicious characters EYC in the abnormal record;

[0017] Step S13, calculating the abnormality index YCC of any abnormal record according to the formula YCC=w1×SJL+w2×QQC+w3×EYC; wherein w1, w2 and w3 are weight coefficients of fixed values, and w1>w2>w3;

[0018] Step S14, classifying the abnormal records according to the abnormality degree index;

[0019] Step S15, when the abnormality index of any abnormal record is in the first abnormality range, the corresponding abnormal record is recorded as the first abnormal record;

[0020] Step S16, when the abnormality index of any abnormal record is in the second abnormality range, the corresponding abnormal record is recorded as the second abnormal record;

[0021] Step S17, when the abnormality index of any abnormal record is in the third abnormality range, the corresponding abnormal record is recorded as the third abnormal record;

[0022] Among them, the endpoint value of the first abnormality degree interval is greater than the endpoint value of the second abnormality degree interval, the endpoint value of the second abnormality degree interval is greater than the endpoint value of the third abnormality degree interval, the abnormality degree of the first abnormal record is higher than the abnormality degree of the second abnormal record, and the abnormality degree of the second abnormal record is higher than the abnormality degree of the third abnormal record.

[0023] Furthermore, the exception record includes the source IP address, target IP address, and the number of requests sent by the target IP address when attempting to log in to the source IP address, the amount of data sent between the target IP address and the source IP address, and the number of occurrences of malicious characters in the request content sent between the target IP address and the source IP address.

[0024] Furthermore, the abnormal rules include abnormal IP address rules and abnormal data rules corresponding to abnormal records.

[0025] Furthermore, the step S2 includes the following sub-steps:

[0026] Step S21, constructing abnormal IP address rules according to the target IP address in the abnormal record, as follows:

[0027] Compare the target IP address of the target device with any blacklisted historical target IP address corresponding to the saved target device;

[0028] If the target IP address is the same as any blacklist historical target IP address, the target IP address is determined to be an abnormal IP address and is included in the abnormal IP set. The abnormal IP set is the abnormal IP address rule;

[0029] If the target IP address is different from any blacklisted historical target IP address, proceed to the next step;

[0030] Step S22, searching the first abnormal record to obtain the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address and the minimum number of occurrences of malicious characters;

[0031] Step S23, obtaining the data volume in the first abnormal record, and then calculating the standard deviation and mean of the data volume in the first abnormal record, and obtaining the first data volume interval corresponding to the first abnormal record according to the standard deviation and mean of the data volume, the first data volume interval being [mean-standard deviation, mean+standard deviation];

[0032] Step S24, combining the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address, the minimum number of occurrences of malicious characters, and the first data volume interval corresponding to the first abnormal record as the abnormal data rule of the first abnormal record;

[0033] Step S25, the second abnormal record and the third abnormal record are obtained according to steps S22 to S24 to obtain abnormal data rules of the second abnormal record and the third abnormal record;

[0034] Step S26, constructing a log exception data packet according to the exception IP address rule and the exception data rule of the exception record, and setting the comparison order of the exception records in the log exception data packet;

[0035] The comparison order of the first abnormal record is earlier than the comparison order of the second abnormal record, and the comparison order of the second abnormal record is earlier than the comparison order of the third abnormal record.

[0036] Furthermore, the real-time network security log data includes the source IP address of the computer device, the real-time target IP address, the number of real-time requests sent when the real-time target IP address attempts to log in to the source IP address, the real-time data volume sent between the real-time target IP address and the source IP address, and the real-time number of occurrences of malicious characters in the request content sent between the real-time target IP address and the source IP address.

[0037] Furthermore, the step S3 includes the following sub-steps:

[0038] Step S31, searching the real-time network security log data, and then removing the retrieved duplicate real-time network security log data and blank real-time network security log data;

[0039] Step S32, constructing a real-time network security log data table according to the pre-processed real-time network security log data, and then inputting the real-time network security log data table into the log exception data packet;

[0040] Step S33, the log abnormal data packet detects the real-time network security log data table;

[0041] Step S34, detecting the target IP address in the real-time network security log data table, if the real-time target IP address is the same as any IP address in the abnormal IP address rule, then the real-time target IP address is determined to be an abnormal IP address, and the real-time network security log data is abnormal network security log data;

[0042] If the real-time target IP address is different from all IP addresses in the abnormal IP address rule, proceed to the next step;

[0043] Step S35, searching the real-time request times sent when the real-time target IP address attempts to log in to the source IP address, the real-time data volume sent between the real-time target IP address and the source IP address, and the real-time occurrence times of malicious characters in the request contents sent between the real-time target IP address and the source IP address in the real-time network security log data, and then matching them with the abnormal data rules corresponding to the ordered and abnormal records;

[0044] Step S36: if the real-time network security log data matches the abnormal data rule corresponding to the abnormal record, the real-time network security log data is marked as abnormal network security log data, as follows:

[0045] When the number of requests sent by the real-time target IP address in the real-time network security log data to attempt to log in to the source IP address is greater than or equal to the minimum number of requests corresponding to the first abnormal data rule, and the number of occurrences of malicious characters in the real-time network security log data is greater than or equal to the minimum number of occurrences of malicious characters corresponding to the first abnormal data rule, and the amount of data sent between the target IP address and the source IP address in the real-time network security log data is in the first data amount interval corresponding to the first abnormal record, the real-time network security log data is determined to be abnormal real-time network security log data, and the abnormality degree of the real-time network security log data is marked as the first abnormality degree, and the real-time network security log data is abnormal network security log data;

[0046] Step S37: if the real-time network security log data does not match the abnormal data rules corresponding to the abnormal record, the real-time network security log data is marked as normal network security log data.

[0047] Furthermore, the process of obtaining real-time network behavior log data is as follows:

[0048] A database without protective measures and a database with protective measures are deployed in computer equipment. Both groups of databases have the same number of data tables. The number of rewrites of data tables in the database without protective measures and the number of rewrites of data tables in the database with protective measures at the same time node when the real-time network behavior log data is generated are counted. At the same time, the number of abnormal characters added to any data table in the database without protective measures and the number of abnormal characters added to any data table in the database with protective measures at the same time node when the real-time network behavior log data is generated are also counted, and then the numbers are merged into the real-time network behavior log data.

[0049] Furthermore, the step S4 includes the following sub-steps:

[0050] Step S41, obtaining the rewrite number WJZ of the data table in the database without protection measures and the rewrite number YJZ of the data table in the database with protection measures at the same time node when the real-time network behavior log data is generated, and calculating the risk rewrite rate FXG of the database when the real-time network behavior log data is generated by the formula FXG=|WJZ-YJZ| / (YJZ+1);

[0051] Step S42, when the same time node of real-time network behavior log data generation is obtained, the number of abnormal characters added WCZi of any data table in the database without protective measures and the number of abnormal characters added YCZi of the same data table in the database with protective measures, i is the number of the data table, and the abnormal character appearance rate CXLi of any data table in the database is calculated by the formula CXLi=|WCZi-YCZi| / (YCZi+1), and the maximum value is taken after traversing and comparing the abnormal character appearance rates as the abnormal character appearance rate CXL of the database when the real-time network behavior log data is generated;

[0052] Step S43, calculating the abnormal risk rate YCF of the database when the real-time network behavior log data is generated by the formula YCF=k1×FXG+k2×CXL; wherein k1 and k2 are weight coefficients of fixed values, and k1>k2;

[0053] Step S44, when the abnormal risk rate is greater than the abnormal risk rate threshold, determining that the real-time network behavior log data is abnormal network behavior log data;

[0054] When the abnormal risk rate is less than or equal to the abnormal risk rate threshold, the real-time network behavior log data is determined to be normal network behavior log data.

[0055] Furthermore, the step S5 includes the following sub-steps:

[0056] Step S51: If the network security log data and the network behavior log data are normal, no operation is performed;

[0057] Step S52: If any one of abnormal network security log data or abnormal network behavior log data exists, the corresponding log data is isolated.

[0058] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0059] The present invention first obtains historical abnormal records of computer equipment, detects the abnormality degree corresponding to the abnormal record, classifies the abnormal record according to the abnormality degree, sets abnormal rules for the classified abnormal records, and constructs a log abnormality data packet in combination with the abnormal rules. On the one hand, the real-time network security log data of the computer equipment is obtained, and the real-time network security log data is subjected to abnormality detection through the log abnormality data packet. On the other hand, the real-time network behavior log data of the computer equipment is obtained, and then the real-time network behavior log data is subjected to in-depth detection through the log abnormality data packet. The management operation corresponding to the log data is executed according to the detection result. The present invention realizes a comprehensive analysis of network security based on the network security log. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0061] Figure 1 is a flow chart of the method of the present invention;

[0062] Figure 2 is a method flow chart of the sub-steps corresponding to step S4 in the present invention;

[0063] Figure 3 It is a schematic diagram of the structure of the computing device in the present invention. DETAILED DESCRIPTION

[0064] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] Example 1: Please refer to Figure 1-Figure 2 As shown, the technical solution provided by the present invention is: a network security log analysis method based on a large language model. This method is mainly used to analyze the network security log of a computer device. The method is specifically as follows:

[0066] Step S1, obtaining the abnormal records of the computer device history, detecting the abnormality degree corresponding to the abnormal records, and classifying the abnormal records according to the abnormality degree;

[0067] It should be specifically stated that when the computer device detects abnormal behavior at any time point, the abnormal behavior is recorded, and the abnormal record of the computer device is obtained;

[0068] In this embodiment, step S1 includes the following sub-steps:

[0069] Step S11, pre-processing the abnormal records to remove duplicate abnormal records and blank abnormal records in the abnormal records;

[0070] It should be specifically stated that the abnormal record includes the source IP address, the target IP address, and the number of requests sent by the target IP address when attempting to log in to the source IP address, the amount of data sent between the target IP address and the source IP address, and the number of occurrences of malicious characters in the content of the requests sent between the target IP address and the source IP address, where the source IP address is the unique IP address corresponding to the computer device.

[0071] Among them, abnormal data and malicious characters can be detected by using a large language model. A large language model refers to a deep learning model trained with a large amount of text data, which can generate natural language text or understand the meaning of language text. These models can provide in-depth knowledge and language production on various topics by training on huge data sets.

[0072] For example, when the request content is "username='OR 1=1 --", the malicious characters are "'", "OR", "1=1", and "--"; when the request content is "search= <script>alert('XSS')< / script> ", the malicious characters are "<", ">", "script", and "alert";

[0073] Step S12, obtaining the number of requests QQC sent by the target IP address when attempting to log in to the source IP address, the amount of data SJL sent between the target IP address and the source IP address, and the number of occurrences of malicious characters EYC in the abnormal record;

[0074] Step S13, calculate the abnormality index YCC of any abnormal record according to the formula, the specific formula is as follows:

[0075] YCC=w1×SJL+w2×QQC+w3×EYC, where w1, w2 and w3 are weight coefficients with fixed values, and w1>w2>w3;

[0076] Step S14, classifying the abnormal records according to the abnormality degree index;

[0077] Step S15, when the abnormality index of any abnormal record is in the first abnormality range, the corresponding abnormal record is recorded as the first abnormal record;

[0078] Step S16, when the abnormality index of any abnormal record is in the second abnormality range, the corresponding abnormal record is recorded as the second abnormal record;

[0079] Step S17, when the abnormality index of any abnormal record is in the third abnormality range, the corresponding abnormal record is recorded as the third abnormal record;

[0080] Among them, the endpoint value of the first abnormality degree interval is greater than the endpoint value of the second abnormality degree interval, the endpoint value of the second abnormality degree interval is greater than the endpoint value of the third abnormality degree interval, the abnormality degree of the first abnormal record is higher than the abnormality degree of the second abnormal record, and the abnormality degree of the second abnormal record is higher than the abnormality degree of the third abnormal record.

[0081] Step S2, setting exception rules for the classified exception records, and constructing a log exception data packet in combination with the exception rules;

[0082] It should be specifically noted that the abnormal rules include abnormal IP address rules and abnormal data rules corresponding to abnormal records;

[0083] In this embodiment, step S2 includes the following sub-steps:

[0084] Step S21, constructing abnormal IP address rules according to the target IP address in the abnormal record, as follows:

[0085] Compare the target IP address of the target device with any blacklisted historical target IP address corresponding to the saved target device;

[0086] If the target IP address is the same as any blacklist historical target IP address, the target IP address is determined to be an abnormal IP address and is included in the abnormal IP set. The abnormal IP set is the abnormal IP address rule;

[0087] If the target IP address is different from any blacklisted historical target IP address, proceed to the next step;

[0088] Step S22, searching the first abnormal record to obtain the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address and the minimum number of occurrences of malicious characters;

[0089] Step S23, obtaining the data volume in the first abnormal record, and then calculating the standard deviation and mean of the data volume in the first abnormal record, and obtaining the first data volume interval [mean-standard deviation, mean+standard deviation] corresponding to the first abnormal record according to the standard deviation and mean of the data volume;

[0090] Step S24, combining the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address, the minimum number of occurrences of malicious characters, and the first data volume interval corresponding to the first abnormal record as the abnormal data rule of the first abnormal record;

[0091] Step S25, the second abnormal record and the third abnormal record are obtained according to steps S22 to S24 to obtain abnormal data rules of the second abnormal record and the third abnormal record;

[0092] Step S26, constructing a log exception data packet according to the exception IP address rule and the exception data rule of the exception record, and setting the comparison order of the exception records in the log exception data packet;

[0093] The higher the abnormality degree, the higher the priority of the corresponding abnormal record in comparison. Therefore, the comparison order of the first abnormal record is earlier than the comparison order of the second abnormal record, and the comparison order of the second abnormal record is earlier than the comparison order of the third abnormal record.

[0094] Step S3, obtaining real-time network security log data of the computer device, and then performing anomaly detection on the real-time network security log data;

[0095] It should be specifically stated that the real-time network security log data includes the source IP address of the computer device, the real-time target IP address, the number of real-time requests sent by the real-time target IP address when attempting to log in to the source IP address, the real-time data volume sent between the real-time target IP address and the source IP address, and the real-time number of malicious characters in the request content sent between the real-time target IP address and the source IP address;

[0096] In this embodiment, step S3 includes the following sub-steps:

[0097] Step S31, searching the real-time network security log data, and then removing the retrieved duplicate real-time network security log data and blank real-time network security log data;

[0098] Step S32, constructing a real-time network security log data table according to the pre-processed real-time network security log data, and then inputting the real-time network security log data table into the log exception data packet;

[0099] Exemplarily, the real-time network security log data table is shown in Table 1;

[0100] Table 1: Real-time network security log data table

[0101]

[0102] In the table, the source IP address "192.168.1.1", the real-time target IP addresses "10.0.0.1" and "10.0.0.2" are example IP addresses;

[0103] Step S33, the log abnormal data packet detects the real-time network security log data table;

[0104] Step S34, detecting the target IP address in the real-time network security log data table, if the real-time target IP address is the same as any IP address in the abnormal IP address rule, then the real-time target IP address is determined to be an abnormal IP address, and the real-time network security log data is abnormal network security log data;

[0105] If the real-time target IP address is different from all IP addresses in the abnormal IP address rule, proceed to the next step;

[0106] Step S35, searching the real-time request times sent when the real-time target IP address attempts to log in to the source IP address, the real-time data volume sent between the real-time target IP address and the source IP address, and the real-time occurrence times of malicious characters in the request contents sent between the real-time target IP address and the source IP address in the real-time network security log data, and then matching them with the abnormal data rules corresponding to the ordered and abnormal records;

[0107] Step S36: if the real-time network security log data matches the abnormal data rule corresponding to the abnormal record, the real-time network security log data is marked as abnormal network security log data. Specifically:

[0108] When the number of requests sent by the real-time target IP address in the real-time network security log data to attempt to log in to the source IP address is greater than or equal to the minimum number of requests corresponding to the first abnormal data rule, and the number of occurrences of malicious characters in the real-time network security log data is greater than or equal to the minimum number of occurrences of malicious characters corresponding to the first abnormal data rule, and the amount of data sent between the target IP address and the source IP address in the real-time network security log data is in the first data amount interval corresponding to the first abnormal record, the real-time network security log data is determined to be abnormal real-time network security log data, and the abnormality degree of the real-time network security log data is marked as the first abnormality degree, and the real-time network security log data is abnormal network security log data;

[0109] Step S37: if the real-time network security log data does not match the abnormal data rules corresponding to the abnormal record, the real-time network security log data is marked as normal network security log data.

[0110] Step S4, obtaining real-time network behavior log data of the computer device, and then performing in-depth detection on the real-time network behavior log data;

[0111] Specifically, the process of obtaining the real-time network behavior log data is as follows: deploying a database without protective measures and a database with protective measures in a computer device, with the same number of data tables in both sets of databases, counting the number of rewrites of the data tables in the database without protective measures and the number of rewrites of the data tables in the database with protective measures at the same time node when the real-time network behavior log data is generated, and at the same time, counting the number of abnormal characters added to any data table in the database without protective measures and the number of abnormal characters added to any data table in the database with protective measures at the same time node when the real-time network behavior log data is generated, and then merging them into the real-time network behavior log data; wherein, data tables with operations such as deletion and addition are all included in the rewrite category, and at the same time, the same data table is only recorded once if it is rewritten multiple times;

[0112] In practice, at the same time point, the large language model can be used to identify and detect the contents of all data tables in the database without protection measures and the database with protection measures. If the contents of the data table are different before and after, it means that the data table has been rewritten. The number of rewritten data tables is obtained by counting the number of rewritten data tables. The front and back contents of the data table are detected for abnormalities. If the content detected after is more than the content detected before, and there are abnormal characters in the content detected after, it means that abnormal characters have been added to the data table. The number of abnormal characters added can be obtained by counting the number of abnormal characters added in each data table.

[0113] In this embodiment, step S4 includes the following sub-steps:

[0114] Step S41, obtaining the rewrite number WJZ of the data table in the database without protection measures and the rewrite number YJZ of the data table in the database with protection measures at the same time node when the real-time network behavior log data is generated, and calculating the risk rewrite rate FXG of the database when the real-time network behavior log data is generated by the formula FXG=|WJZ-YJZ| / (YJZ+1);

[0115] Step S42, when the same time node of real-time network behavior log data generation is obtained, the number of abnormal characters added WCZi of any data table in the database without protective measures and the number of abnormal characters added YCZi of the same data table in the database with protective measures, i is the number of the data table, and the abnormal character appearance rate CXLi of any data table in the database is calculated by the formula CXLi=|WCZi-YCZi| / (YCZi+1), and the maximum value is taken after traversing and comparing the abnormal character appearance rates as the abnormal character appearance rate CXL of the database when the real-time network behavior log data is generated;

[0116] Step S43, the abnormal risk rate YCF of the database when the real-time network behavior log data is generated is calculated by a formula, and the specific formula is as follows:

[0117] YCF=k1×FXG+k2×CXL, where k1 and k2 are weight coefficients with fixed values, and k1>k2;

[0118] Step S44, when the abnormal risk rate is greater than the abnormal risk rate threshold, determining that the real-time network behavior log data is abnormal network behavior log data;

[0119] When the abnormal risk rate is less than or equal to the abnormal risk rate threshold, the real-time network behavior log data is determined to be normal network behavior log data.

[0120] Step S5, executing management operations corresponding to the log data according to the detection results;

[0121] In this embodiment, step S5 includes the following sub-steps:

[0122] Step S51: If the network security log data and the network behavior log data are normal, no operation is performed;

[0123] Step S52: If any one of abnormal network security log data or abnormal network behavior log data exists, the corresponding log data is isolated.

[0124] In this application, if corresponding calculation formulas appear, the above calculation formulas are all dimensionless and take their numerical calculations. The weight coefficients, proportional coefficients and other coefficients in the formulas are set to a result value obtained by quantifying each parameter. The size of the weight coefficient and the proportional coefficient can be determined as long as it does not affect the proportional relationship between the parameter and the result value.

[0125] Embodiment 2: Figure 3 The following is a schematic diagram of the structure of a computer device, such as Figure 3 As shown, the computer device may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The processor may call the logic instructions in the memory to execute a network security log analysis method based on a large language model, the method comprising: obtaining historical abnormal records of the computer device, detecting the abnormal degree corresponding to the abnormal record, and classifying the abnormal record according to the abnormal degree; setting abnormal rules for the classified abnormal records, and constructing log abnormal data packets in combination with the abnormal rules; obtaining real-time network security log data of the computer device, and then performing abnormal detection on the real-time network security log data; obtaining real-time network behavior log data of the computer device, and then performing in-depth detection on the real-time network behavior log data; and executing management operations corresponding to the log data according to the detection results.

[0126] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0127] Embodiment 3: The present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network security log analysis method based on a large language model provided by the above methods, and the method includes: obtaining historical abnormal records of computer devices, and detecting the degree of abnormality corresponding to the abnormal records, and classifying the abnormal records according to the degree of abnormality; setting abnormal rules for the classified abnormal records, and constructing log abnormality data packets in combination with the abnormal rules; obtaining real-time network security log data of the computer device, and then performing abnormality detection on the real-time network security log data; obtaining real-time network behavior log data of the computer device, and then performing in-depth detection on the real-time network behavior log data; and executing management operations corresponding to the log data based on the detection results.

[0128] Embodiment 4: The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned large language model-based network security log analysis methods, the methods comprising: obtaining historical abnormal records of computer devices, detecting the degree of abnormality corresponding to the abnormal records, and classifying the abnormal records according to the degree of abnormality; setting abnormal rules for the classified abnormal records, and constructing log abnormality data packets in combination with the abnormal rules; obtaining real-time network security log data of the computer device, and then performing abnormality detection on the real-time network security log data; obtaining real-time network behavior log data of the computer device, and then performing in-depth detection on the real-time network behavior log data; and executing management operations corresponding to the log data according to the detection results.

[0129] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security log analysis method based on a large language model, characterized in that: Methods include: Step S1, obtaining the abnormal records of the computer device history, detecting the abnormality degree corresponding to the abnormal records, and classifying the abnormal records according to the abnormality degree; Step S2, setting exception rules for the classified exception records, and constructing a log exception data packet in combination with the exception rules; Step S3, obtaining real-time network security log data of the computer device, the real-time network security log data including the source IP address of the computer device, the real-time target IP address, the number of real-time requests sent when the real-time target IP address attempts to log in to the source IP address, the amount of real-time data sent between the real-time target IP address and the source IP address, and the real-time number of occurrences of malicious characters in the request content sent between the real-time target IP address and the source IP address, and then the log abnormality data packet performs abnormality detection on the real-time network security log data; Step S4, obtaining the real-time network behavior log data of the computer device, the process of obtaining the real-time network behavior log data is as follows: deploying a database without protective measures and a database with protective measures in the computer device, both sets of databases have the same number of data tables, counting the number of rewrites of the data tables in the database without protective measures and the number of rewrites of the data tables in the database with protective measures at the same time node when the real-time network behavior log data is generated, and at the same time, counting the number of abnormal characters added to any data table in the database without protective measures and the number of abnormal characters added to any data table in the database with protective measures at the same time node when the real-time network behavior log data is generated, and then merging them into the real-time network behavior log data, and then performing in-depth detection on the real-time network behavior log data; Step S5: Execute management operations corresponding to the log data according to the detection result.

2. The network security log analysis method based on a large language model according to claim 1 is characterized in that: The step S1 includes the following sub-steps: Step S11, pre-processing the abnormal records to remove duplicate abnormal records and blank abnormal records in the abnormal records; Step S12, obtaining the number of requests QQC sent by the target IP address when attempting to log in to the source IP address, the amount of data SJL sent between the target IP address and the source IP address, and the number of occurrences of malicious characters EYC in the abnormal record; Step S13, calculating the abnormality index YCC of any abnormal record according to the formula YCC=w1×SJL+w2×QQC+w3×EYC; wherein w1, w2 and w3 are weight coefficients of fixed values, and w1>w2>w3; Step S14, classifying the abnormal records according to the abnormality degree index; Step S15, when the abnormality index of any abnormal record is in the first abnormality range, the corresponding abnormal record is recorded as the first abnormal record; Step S16, when the abnormality index of any abnormal record is in the second abnormality range, the corresponding abnormal record is recorded as the second abnormal record; Step S17, when the abnormality index of any abnormal record is in the third abnormality range, the corresponding abnormal record is recorded as the third abnormal record; Among them, the endpoint value of the first abnormality degree interval is greater than the endpoint value of the second abnormality degree interval, the endpoint value of the second abnormality degree interval is greater than the endpoint value of the third abnormality degree interval, the abnormality degree of the first abnormal record is higher than the abnormality degree of the second abnormal record, and the abnormality degree of the second abnormal record is higher than the abnormality degree of the third abnormal record.

3. The network security log analysis method based on a large language model according to claim 2 is characterized in that: The exception record includes the source IP address, target IP address, and the number of requests sent by the target IP address when attempting to log in to the source IP address, the amount of data sent between the target IP address and the source IP address, and the number of times malicious characters appear in the request content sent between the target IP address and the source IP address.

4. The network security log analysis method based on a large language model according to claim 3 is characterized in that: Abnormal rules include abnormal IP address rules and abnormal data rules corresponding to abnormal records.

5. The network security log analysis method based on a large language model according to claim 4 is characterized in that: The step S2 includes the following sub-steps: Step S21, constructing abnormal IP address rules according to the target IP address in the abnormal record, as follows: Compare the target IP address of the target device with any blacklisted historical target IP address corresponding to the saved target device; If the target IP address is the same as any blacklist historical target IP address, the target IP address is determined to be an abnormal IP address and is included in the abnormal IP set. The abnormal IP set is the abnormal IP address rule; If the target IP address is different from any blacklisted historical target IP address, proceed to the next step; Step S22, searching the first abnormal record to obtain the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address and the minimum number of occurrences of malicious characters; Step S23, obtaining the data volume in the first abnormal record, and then calculating the standard deviation and mean of the data volume in the first abnormal record, and obtaining the first data volume interval corresponding to the first abnormal record according to the standard deviation and mean of the data volume, the first data volume interval being [mean-standard deviation, mean+standard deviation]; Step S24, combining the minimum number of requests sent by the target IP address in the first abnormal record to attempt to log in to the source IP address, the minimum number of occurrences of malicious characters, and the first data volume interval corresponding to the first abnormal record as the abnormal data rule of the first abnormal record; Step S25, the second abnormal record and the third abnormal record are obtained according to steps S22 to S24 to obtain abnormal data rules of the second abnormal record and the third abnormal record; Step S26, constructing a log exception data packet according to the exception IP address rule and the exception data rule of the exception record, and setting the comparison order of the exception records in the log exception data packet; The comparison order of the first abnormal record is earlier than the comparison order of the second abnormal record, and the comparison order of the second abnormal record is earlier than the comparison order of the third abnormal record.

6. The network security log analysis method based on a large language model according to claim 5 is characterized in that: The step S3 includes the following sub-steps: Step S31, searching the real-time network security log data, and then removing the retrieved duplicate real-time network security log data and blank real-time network security log data; Step S32, constructing a real-time network security log data table according to the pre-processed real-time network security log data, and then inputting the real-time network security log data table into the log exception data packet; Step S33, the log abnormal data packet detects the real-time network security log data table; Step S34, detecting the target IP address in the real-time network security log data table, if the real-time target IP address is the same as any IP address in the abnormal IP address rule, then the real-time target IP address is determined to be an abnormal IP address, and the real-time network security log data is abnormal network security log data; If the real-time target IP address is different from all IP addresses in the abnormal IP address rule, proceed to the next step; Step S35, searching the real-time request times sent when the real-time target IP address attempts to log in to the source IP address, the real-time data volume sent between the real-time target IP address and the source IP address, and the real-time occurrence times of malicious characters in the request contents sent between the real-time target IP address and the source IP address in the real-time network security log data, and then matching them with the abnormal data rules corresponding to the ordered and abnormal records; Step S36: if the real-time network security log data matches the abnormal data rule corresponding to the abnormal record, the real-time network security log data is marked as abnormal network security log data, as follows: When the number of requests sent by the real-time target IP address in the real-time network security log data to attempt to log in to the source IP address is greater than or equal to the minimum number of requests corresponding to the first abnormal data rule, and the number of occurrences of malicious characters in the real-time network security log data is greater than or equal to the minimum number of occurrences of malicious characters corresponding to the first abnormal data rule, and the amount of data sent between the target IP address and the source IP address in the real-time network security log data is in the first data amount interval corresponding to the first abnormal record, the real-time network security log data is determined to be abnormal real-time network security log data, and the abnormality degree of the real-time network security log data is marked as the first abnormality degree, and the real-time network security log data is abnormal network security log data; Step S37: if the real-time network security log data does not match the abnormal data rules corresponding to the abnormal record, the real-time network security log data is marked as normal network security log data.

7. The network security log analysis method based on a large language model according to claim 6 is characterized in that: The step S4 includes the following sub-steps: Step S41, obtaining the rewrite number WJZ of the data table in the database without protection measures and the rewrite number YJZ of the data table in the database with protection measures at the same time node when the real-time network behavior log data is generated, and calculating the risk rewrite rate FXG of the database when the real-time network behavior log data is generated by the formula FXG=|WJZ-YJZ| / (YJZ+1); Step S42, when the same time node of real-time network behavior log data generation is obtained, the number of abnormal characters added WCZi of any data table in the database without protective measures and the number of abnormal characters added YCZi of the same data table in the database with protective measures, i is the number of the data table, and the abnormal character appearance rate CXLi of any data table in the database is calculated by the formula CXLi=|WCZi-YCZi| / (YCZi+1), and the maximum value is taken after traversing and comparing the abnormal character appearance rates as the abnormal character appearance rate CXL of the database when the real-time network behavior log data is generated; Step S43, calculating the abnormal risk rate YCF of the database when the real-time network behavior log data is generated by the formula YCF=k1×FXG+k2×CXL; In the formula, k1 and k2 are weight coefficients with fixed values, and k1>k2; Step S44, when the abnormal risk rate is greater than the abnormal risk rate threshold, determining that the real-time network behavior log data is abnormal network behavior log data; When the abnormal risk rate is less than or equal to the abnormal risk rate threshold, the real-time network behavior log data is determined to be normal network behavior log data.

8. The network security log analysis method based on a large language model according to claim 7 is characterized in that: The step S5 includes the following sub-steps: Step S51: If the network security log data and the network behavior log data are normal, no operation is performed; Step S52: If any one of abnormal network security log data or abnormal network behavior log data exists, the corresponding log data is isolated.

Images