Syslog log blacklist generation method and device based on regular expression
By introducing a regular expression-based log blacklist generation method in the Syslog log processing system, the inefficiency and resource utilization problems caused by unresolved Syslog logs are solved, and efficient log parsing and processing are achieved.
Patent Information
- Application Number
- CN202411705034.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-26
- Publication Date
- 2025-03-14
AI Technical Summary
When processing unresolved Syslog logs, the prior art needs to traverse a large number of regular expressions, resulting in inefficient parsing, which may cause log accumulation and server memory overflow.
The Syslog log blacklist generation method based on regular expressions is adopted. By establishing a log blacklist processing mechanism, matching the log source and format blacklist. If it cannot be parsed, extract features and generate regular expressions to update the blacklist, improving matching efficiency.
It effectively avoids the problem that unresolved logs occupy a large amount of computing resources, improves log parsing efficiency, and avoids log accumulation and memory overflow.
Smart Images
Figure CN119622046A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network log analysis, and in particular to a method and device for generating a Syslog blacklist based on a regular expression. Background Art
[0002] Syslog log is the most common log format in computer and network systems, generally following RFC3164 and RFC5424 standards. Syslog log is used to record the key processes of business systems or network devices during operation, and is used for auditing or analyzing problems. Syslog was first used in UNIX systems, and now almost all network devices support the Syslog protocol. It is a standard protocol, and each manufacturer and each device will have its own Syslog log standard to record key information of the device during business processing. The Syslog protocol supports TCP or UDP, and UDP is generally used as the transmission protocol. The receiving port defaults to 514.
[0003] Syslog logs come from software and hardware systems of different manufacturers, and their services are also different, and often do not have a unified Syslog format. For log auditing and analysis systems, parsing multi-source heterogeneous Syslog log data is an important task.
[0004] The usual solution is to write a log parsing template (usually a regular expression) for each different model of device and different version of software or system log, and provide parsing capabilities for logs in that format. This regular expression is defined as a static template, which is loaded when the log parsing module of the log system is started. At runtime, the log system will match each new log obtained with the predefined log format parsing template, and extract the contents of all fields after a successful match.
[0005] Because the log collection device cannot determine the format of the received logs when it is deployed, a traversal matching solution is generally adopted, that is, traversing the log parsing template (regular expression), finding a template that can be matched normally, and then parsing according to the template.
[0006] Disadvantages of current technology: If you encounter a log that cannot be parsed, you need to traverse all the log parsing templates. The number of templates may reach hundreds or even thousands. It takes a long time to traverse them all, which will greatly affect the efficiency of log parsing. In a short period of time, it may cause log accumulation or even server memory overflow. Summary of the invention
[0007] The present invention provides a Syslog log blacklist generation method based on regular expressions, comprising:
[0008] Step S1, establish a log blacklist processing mechanism;
[0009] Step S2: after receiving the Syslog log, perform blacklist matching on the Syslog log according to the log blacklist processing mechanism. If the match is successful, perform blacklist processing on the Syslog log. If the match is not successful, execute step S3.
[0010] Step S3: determine whether the Syslog log can be parsed. If yes, perform normal processing on the Syslog log; otherwise, execute step S4;
[0011] Step S4: extract features from the Syslog log, generate regular expressions according to the extracted features, and re-update the log blacklist processing mechanism according to the generated regular expressions.
[0012] As described above, a Syslog log blacklist generation method based on regular expressions is established, wherein a log blacklist processing mechanism is established, including establishing a log source blacklist and a log format blacklist; the log source blacklist records the log source IP addresses that have security risks, and the log format blacklist records the log regular expressions extracted and generated from the Syslog logs that cannot be parsed.
[0013] The above-mentioned Syslog log blacklist generation method based on regular expression, wherein the Syslog log is matched with the blacklist according to the log blacklist processing mechanism, specifically includes:
[0014] Step S21: first determine whether the source address of the Syslog log matches the log source blacklist. If yes, perform blacklist processing. If not, execute step S22.
[0015] Step S22: determine whether the Syslog log matches the log format blacklist. If yes, perform blacklist processing. If no match is successful, execute step S3.
[0016] The method for generating a Syslog blacklist based on a regular expression as described above, wherein features are extracted from the Syslog log, and a regular expression is generated according to the extracted features, specifically comprising the following sub-steps:
[0017] Initialize the regular expression dictionary based on the characteristics of the Syslog log;
[0018] Traverse the regular expression dictionary and search for the regular expressions stored in the regular expression dictionary in turn to determine the fixed string pattern in the Syslog log;
[0019] Traverse the regular expressions that match successfully and concatenate them to form a complete regular expression.
[0020] In the above-mentioned Syslog blacklist generation method based on regular expressions, the standard pattern character string in the Syslog log is initialized as a regular expression dictionary.
[0021] The Syslog blacklist generation method based on regular expressions as described above, wherein the regular expression dictionary is sorted according to the inclusion relationship between standard pattern strings, longer and more complex regular expressions are matched first, and longer and more complex string patterns are recognized first.
[0022] In the above-mentioned method for generating a Syslog blacklist based on regular expressions, if the number of Syslog format blacklists of a certain log source exceeds a set threshold limit, the log source is added to the log source blacklist.
[0023] The present invention also provides a Syslog log blacklist generation device based on regular expressions, comprising:
[0024] Log blacklist mechanism establishment module, used to establish a log blacklist processing mechanism;
[0025] The blacklist matching module is used to perform blacklist matching on the Syslog log according to the log blacklist processing mechanism after receiving the Syslog log. If the match is successful, the blacklist processing is performed on the Syslog log. If the match is not successful, the parsing module is triggered;
[0026] The parsing module is used to parse the Syslog log and determine whether the Syslog log can be parsed. If yes, the Syslog log is processed normally, otherwise the blacklist update module is triggered;
[0027] The blacklist update module is used to extract features from Syslog logs, generate regular expressions according to the extracted features, and re-update the log blacklist processing mechanism according to the generated regular expressions.
[0028] The present invention also provides a computer storage medium, characterized in that it comprises: at least one memory and at least one processor;
[0029] The memory is used to store one or more program instructions;
[0030] The processor is used to run one or more program instructions to execute any one of the above-mentioned methods for generating a Syslog log blacklist based on regular expressions.
[0031] The beneficial effects achieved by the present invention are as follows: the present invention uses a log blacklist processing mechanism to perform blacklist processing on Syslog logs. For logs that cannot be parsed normally, an automated method is used to extract the features of the logs, and a regular expression blacklist corresponding to the logs is generated. A regular expression is used to check whether the log belongs to the blacklist. The matching efficiency is very high, which greatly avoids the problem that logs that cannot be parsed normally occupy a large amount of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0033] Figure 1 This is a flow chart of a Syslog blacklist generation method based on regular expressions provided in Example 1 of the present application;
[0034] Figure 2 It is a schematic diagram of a Syslog log blacklist generation device based on regular expressions provided in Example 2 of the present application. DETAILED DESCRIPTION
[0035] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.
[0036] Embodiment 1
[0037] like Figure 1 As shown, the first embodiment of the present invention provides a Syslog log blacklist generation method based on regular expressions, which specifically includes:
[0038] Step 110: Establish a log blacklist processing mechanism;
[0039] The log blacklist includes the log source blacklist and the log format blacklist. The log source blacklist records the log source IP addresses that pose security risks, and the log format blacklist records the log regular expressions extracted from the Syslog logs that cannot be parsed. When blacklisting different Syslog logs, the log source blacklist and log format blacklist will be updated in real time.
[0040] Step 120: After receiving the Syslog log, perform blacklist matching on the Syslog log according to the log blacklist processing mechanism. If the match is successful, perform blacklist processing on the Syslog log. If the match is not successful, execute step 130.
[0041] Syslog logs are matched against blacklists based on the log blacklist processing mechanism, including:
[0042] Step 121: first determine whether the source address of the Syslog log matches the log source blacklist. If yes, perform blacklist processing. If not, execute step 122.
[0043] Because log parsing selects the corresponding regular expression parsing template based on a specific log source, the corresponding generated blacklist also needs to be applied to the log source. That is, when receiving the log sent by the log source, first check whether the log source belongs to the blacklist, and then check whether the log belongs to the blacklist. If any item belongs to the blacklist, it will be processed according to the blacklist processing mechanism.
[0044] Specifically, since the IP address can be obtained directly, the IP address is matched first to reduce the number of matches and improve the matching efficiency. After receiving the Syslog log, first determine whether the IP address from which the Syslog log comes is in the log source blacklist. If so, the Syslog log has a security risk and can be discarded or otherwise processed in a special way; if the IP address from which the received Syslog log comes is not in the log source blacklist, the subsequent log format blacklist mechanism is processed.
[0045] Step 122: determine whether the Syslog log matches the log format blacklist. If yes, perform blacklist processing. If no match is successful, execute step 130.
[0046] Specifically, features are extracted from the Syslog log, regular expressions are generated according to the extracted features, and blacklist matching is performed on the regular expressions of the Syslog log according to the log format blacklist. If the match is successful, blacklist processing is performed; if the match is not successful, step 130 is executed.
[0047] Step 130, determine whether the Syslog log can be parsed, if yes, perform normal processing on the Syslog log, otherwise execute step 140;
[0048] Considering a log that can be normally parsed using a regular expression, the time spent is generally no more than 1 millisecond, and a small amount of logs with overlong characters and super-many fields may exceed 1 millisecond, and generally no more than 2 milliseconds. Taking 1 millisecond as an example for calculating, if a certain log cannot be normally parsed, it is necessary to traverse all regular expressions. Assuming that there are more than 100 regular expressions, it may take almost 100 milliseconds, and the performance consumption increases by 100 times. Therefore, the present invention is directed to the log that cannot be normally parsed, and adopts an automated means to extract the feature of the log, generates a regular expression blacklist corresponding to the log, and utilizes a regular expression to check whether the log belongs to the blacklist, and the matching efficiency is very high, which greatly avoids the problem that the log that cannot be normally parsed occupies a large amount of computing resources.
[0049] Step 140: extract features from the Syslog log, generate regular expressions according to the extracted features, re-update the log blacklist processing mechanism according to the generated regular expressions, and return to execute step S2.
[0050] Specifically, extracting features from Syslog logs to generate regular expressions includes the following sub-steps:
[0051] Step 141: Initialize a regular expression dictionary according to the characteristics of the Syslog log;
[0052] Syslog logs are currently mainly used for network devices or servers to send logs to the outside world. They will inevitably use some special characters (non-word characters) as delimiters. The delimiters designed by different manufacturers vary greatly. The main content of the log may be numbers or words, and the length is uncertain. Syslog logs are typical network logs, and some standard pattern strings usually appear in the logs, including but not limited to: IP address, date and time, MAC address, SNMPOID, etc. In order to accurately match the log blacklist, it is necessary to prioritize the identification of these special string patterns, so first initialize these standard pattern strings as regular expression dictionaries.
[0053] The following are examples of regular expressions:
[0054] Regular expression for SNMPOID:
[0055] 1(\\.[0-9]+){4,}
[0056] Regular expression for IPV4:
[0057] ((25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)
[0058] Regular expression for MAC address:
[0059] ([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}
[0060] Regular expression for datetime:
[0061] ([1-9]{1}[0-9]{3})[\\-\\.\\\\ / ]? ([0-1]?[0-9]{1})[\\-\\.\\\\ / ]? ([0-3]?[0-9]{1})[T\\s]+[0-2]? ([0-9]{1}:[0-9]{1,2}:[0-9]{1,2})
[0062] In addition, in order to ensure that all characters in the log can be matched successfully, special characters (such as :, .=-<>, etc.) and common word characters (such as English letters, numbers, and Chinese, etc.) need to be included.
[0063] Regular expression for special characters: \\W
[0064] Regular expression for word characters: [\\w\\u2014-\\u9FFF\\uFF01-\\uFF1F]+
[0065] Because there is an inclusion relationship between these special string patterns, long string patterns should be matched first and short string patterns should be ignored. If a part of the string in the log has already matched a longer string pattern, there is no need to consider the short string pattern. The log pattern extracted in this way is more efficient and accurate. So the first thing to do is to sort the regular expression dictionary according to the inclusion relationship, give priority to matching longer and more complex regular expressions, and give priority to identifying longer and more complex string patterns. It should be noted that the regular expression sorting principle involved in this application may have different known string patterns in different industries, and it is preferred that they should be compared and sorted according to this principle.
[0066] For example, the regular expression of MAC address: ([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}; the regular expression of special characters: \\W. The regular expression of MAC address contains special characters, that is, if a Syslog log contains MAC address, it must contain special characters such as colon or hyphen. In this case, the regular expression of MAC address is sorted before the regular expression of special characters. For another example, the string pattern of SNMPOID contains the string pattern of IPV4, so the regular expression of SNMPOID should be sorted before the regular expression of IPV4 in the dictionary.
[0067] In addition, the dictionary should also contain a set of normal characters so that all characters in the log can find corresponding regular expressions.
[0068] A typical regular expression dictionary table is as follows:
[0069]
[0070]
[0071] Step 142, traverse the regular expression dictionary to find the fixed string pattern in the Syslog log;
[0072] For Syslog log strings that cannot be parsed normally, the regular expression dictionary is traversed to search for regular expressions stored in the dictionary in turn, that is, to confirm the fixed string pattern. If the match is successful, the preceding dictionary is checked to see whether the match has been successful. If the match has been successful, the current match is not processed. Otherwise, the current match content is recorded, including the dictionary memory, the starting position, and the length of the matched string.
[0073] After the traversal is completed, a list of regular expressions sorted in matching order is generated. For example, a log original is: <1> 2006-03-12 20:12:23 kemel IDS 0PPLive online streaming media 192.168.10.244138192.168.10.255138, after traversal matching, the generated regular expression list is:
[0074] [start=0,end=1,type=NOT_WORD,content=<],
[0075] [start=1,end=2,type=COMMON_WORD,content=1],
[0076] [start=2,end=3,type=NOT_WORD,content=>],
[0077] [start=3,end=4,type=NOT_WORD,content=],
[0078] [start=4,end=23,type=DATETIME,content=2006-03-1220:12:23],
[0079] [start=23, end=24, type=NOT_WORD, content=],
[0080] [start=24,end=29,type=COMMON_WORD,content=kemel],
[0081] [start=29,end=30,type=NOT_WORD,content=],
[0082] [start=30,end=33,type=COMMON_WORD,content=IDS],
[0083] [start=33,end=34,type=NOT_WORD,content=],
[0084] [start=34,end=35,type=COMMON_WORD,content=0],
[0085] [start=35,end=36,type=NOT_WORD,content=],
[0086] [start=36,end=42,type=COMMON_WORD,content=PPLive],
[0087] [start=42,end=43,type=NOT_WORD,content=],
[0088] [start=43,end=50,type=COMMON_WORD,content=online streaming media playback],
[0089] [start=50,end=51,type=NOT_WORD,content=],
[0090] [start=51,end=65,type=IPV4,content=192.168.10.244],
[0091] [start=65,end=66,type=NOT_WORD,content=],
[0092] [start=66,end=69,type=COMMON_WORD,content=138],
[0093] [start=69,end=70,type=NOT_WORD,content=],
[0094] [start=70, end=84, type=IPV4, content=192.168.10.255],
[0095] [start=84, end=85, type=NOT_WORD, content=],
[0096] [start=85, end=88, type=COMMON_WORD, content=138]
[0097] Step 143, traverse the regular expressions that are successfully matched, and splice them to form a complete regular expression;
[0098] The regular expression lists formed above are concatenated to form a regular expression extracted from the log. For special metacharacters in the regular expression, escape characters need to be added during concatenation.
[0099] Corresponding to the log in the above example, the regular expression finally extracted is:
[0100] <[\w\u2014-\u9FFF\uFF01-\uFF1F]+>
[0101] ([1-9]{1}[0-9]{3})[\-\.\\ / ]? ([0-1]?[0-9]{1})[\-\.\\ / ]? ([0-3]?[0-9]{1})
[0102] [T\s]+[0-2]? ([0-9]{1}:[0-9]{1,2}:[0-9]{1,2})
[0103] [\w\u2014-\u9FFF\uFF01-\uFF1F]+[\w\u2014-\u9FFF\uFF01-\uFF1F]+
[0104] [\w\u2014-\u9FFF\uFF01-\uFF1F]+[\w\u2014-\u9FFF\uFF01-\uFF1F]+
[0105] [\w\u2014-\u9FFF\uFF01-\uFF1F]+
[0106] ((25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)
[0107] [\w\u2014-\u9FFF\uFF01-\uFF1F]+
[0108] ((25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|
[01] ?[0-9][0-9]?)
[0109] [\w\u2014-\u9FFF\uFF01-\uFF1F]+
[0110] For Syslog logs that the system cannot parse, after extracting log features to generate regular expressions, the regular expressions of the logs are added to the log format blacklist. If the number of Syslog format blacklists of a certain log source exceeds the set threshold limit, the log source is added to the log source blacklist, which can avoid the problem of too many log format blacklists. After receiving the logs, first compare them with the log source blacklist. If there is no match, then match the log format blacklist. If the match is successful, it will directly enter the blacklist processing process.
[0111] Embodiment 2
[0112] like Figure 2 As shown, Embodiment 2 of the present invention provides a Syslog log blacklist generation device based on regular expressions, comprising:
[0113] A log blacklist mechanism establishment module 21 is used to establish a log blacklist processing mechanism;
[0114] The blacklist matching module 22 is used to perform blacklist matching on the Syslog log according to the log blacklist processing mechanism after receiving the Syslog log. If the match is successful, the blacklist processing is performed. If the match is not successful, the parsing module 23 is triggered;
[0115] The parsing module 23 is used to parse the Syslog log and determine whether the Syslog log can be parsed. If yes, the Syslog log is processed normally, otherwise the blacklist update module 24 is triggered;
[0116] The blacklist updating module 24 is used to extract features from the Syslog log, generate regular expressions according to the extracted features, and re-update the log blacklist processing mechanism according to the generated regular expressions.
[0117] Corresponding to the above embodiment, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;
[0118] The memory is used to store one or more program instructions;
[0119] The processor is used to run one or more program instructions to execute a Syslog log blacklist generation method based on regular expressions.
[0120] Corresponding to the above embodiment, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer storage medium contains one or more program instructions, and the one or more program instructions are used by a processor to execute a Syslog log blacklist generation method based on a regular expression.
[0121] The embodiment disclosed in the present invention provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed on a computer, the computer executes the above-mentioned Syslog log blacklist generation method based on regular expressions.
[0122] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0123] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.
[0124] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.
[0125] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
[0126] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus DRAM (DRRAM).
[0127] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.
[0128] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention can be implemented using a combination of hardware and software. When software is used, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.
[0129] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.
Claims
1. A Syslog blacklist generation method based on regular expressions, characterized in that: include: Step S1, establishing a log blacklist processing mechanism; Step S2: after receiving the Syslog log, perform blacklist matching on the Syslog log according to the log blacklist processing mechanism. If the match is successful, perform blacklist processing on the Syslog log. If the match is not successful, execute step S3. Step S3: determine whether the Syslog log can be parsed. If yes, perform normal processing on the Syslog log; otherwise, execute step S4; Step S4: extract features from the Syslog log, generate regular expressions according to the extracted features, and re-update the log blacklist processing mechanism according to the generated regular expressions.
2. A Syslog blacklist generation method based on regular expressions as described in claim 1, characterized in that: Establish a log blacklist processing mechanism, including establishing a log source blacklist and a log format blacklist; the log source blacklist records the log source IP addresses that pose security risks, and the log format blacklist records the log regular expressions extracted from Syslog logs that cannot be parsed.
3. A Syslog blacklist generation method based on regular expressions as described in claim 2, characterized in that: Syslog logs are matched against blacklists based on the log blacklist processing mechanism, including: Step S21: first determine whether the source address of the Syslog log matches the log source blacklist. If yes, perform blacklist processing. If not, execute step S22. Step S22: determine whether the Syslog log matches the log format blacklist. If yes, perform blacklist processing. If no match is successful, execute step S3.
4. A Syslog log blacklist generation method based on regular expressions as described in claim 1, characterized in that: Extract features from Syslog logs and generate regular expressions based on the extracted features. The specific steps include the following: Initialize the regular expression dictionary based on the characteristics of the Syslog log; Traverse the regular expression dictionary and search for the regular expressions stored in the regular expression dictionary in turn to determine the fixed string pattern in the Syslog log; Traverse the regular expressions that match successfully and concatenate them to form a complete regular expression.
5. A Syslog blacklist generation method based on regular expressions as described in claim 4, characterized in that: Initializes the regular expression dictionary with standard pattern strings in Syslog logs.
6. A method for generating a Syslog blacklist based on regular expressions as described in claim 5, characterized in that: The regular expression dictionary is sorted according to the inclusion relationship between the standard pattern strings, and longer and more complex regular expressions are matched first, and longer and more complex string patterns are recognized first.
7. A method for generating a Syslog blacklist based on regular expressions as claimed in claim 1, characterized in that: If the number of Syslog format blacklists for a log source exceeds the set threshold, the log source is added to the log source blacklist.
8. A Syslog blacklist generation device based on regular expressions, characterized in that: include: Log blacklist mechanism establishment module, used to establish a log blacklist processing mechanism; The blacklist matching module is used to perform blacklist matching on the Syslog log according to the log blacklist processing mechanism after receiving the Syslog log. If the match is successful, the blacklist processing is performed on the Syslog log. If the match is not successful, the parsing module is triggered; The parsing module is used to parse the Syslog log and determine whether the Syslog log can be parsed. If yes, the Syslog log is processed normally, otherwise the blacklist update module is triggered; The blacklist update module is used to extract features from Syslog logs, generate regular expressions according to the extracted features, and re-update the log blacklist processing mechanism according to the generated regular expressions.
9. A computer storage medium, characterized in that: include: at least one memory and at least one processor; The memory is used to store one or more program instructions; A processor is used to run one or more program instructions to execute a Syslog log blacklist generation method based on regular expressions as described in any one of claims 1 to 7.