Information processing method and device, equipment, storage medium and program product

Abstract

The invention provides an information processing method and device, equipment, a storage medium and a program product, and the method comprises the steps: obtaining first log information of target equipment, and the first log information comprises at least one of a file fingerprint, process information, network information, process hidden information and command line information; performing reconstruction processing on the first log information by using an information reconstruction model constructed based on normal log information to obtain second log information corresponding to the first log information, the normal log information referring to log information when the target device is not subjected to the network attack; detecting a reconstruction error of the first log information and the second log information; if the reconstruction error is larger than a preset error threshold value, it is recognized that the first log information belongs to abnormal log information, and the abnormal log information refers to log information generated when the target device is subjected to the network attack. According to the scheme, the log information corresponding to various network attacks can be identified by using the information reconstruction model, and network attack behaviors can be found in time.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to an information processing method, apparatus, device, storage medium and program product. Background Art

[0002] In order to improve the security of electronic devices, it is sometimes necessary to identify whether the log information of the electronic devices is abnormal log information, and take timely processing measures when abnormal log information is identified.

[0003] For example, when it is identified that the log information of an electronic device is abnormal log information, it can be considered that the electronic device is under a network attack, and then corresponding network protection measures are taken to avoid further attacks.

[0004] At present, the method for identifying abnormal log information generally involves extracting features of the log information, comparing the extracted features with the features of the set abnormal log information, and determining that the log information is abnormal if the two are similar.

[0005] This method has limited recognition capabilities and cannot identify abnormal log information for which corresponding features have not been set in advance. Summary of the invention

[0006] In view of this, the present application provides an information processing method, apparatus, device, storage medium and program product to solve the problem that the application scope of the existing protection technology is relatively small.

[0007] To achieve the above objectives, this application provides the following technical solutions:

[0008] The first aspect of the present application provides an information processing method, comprising:

[0009] Obtaining first log information of a target device, wherein the first log information includes at least one of file information, process information, network information, process hidden information, and command line information;

[0010] Reconstructing the first log information using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information;

[0011] determining a reconstruction error between the first log information and the second log information;

[0012] Based on the reconstruction error, it is determined whether the first log information is abnormal log information.

[0013] Optionally, also include:

[0014] Preprocessing the first log information to obtain preprocessed first log information, wherein the preprocessing includes at least one of data cleaning and data conversion;

[0015] The reconstructing the first log information using the information reconstruction model to obtain second log information corresponding to the first log information includes:

[0016] The preprocessed first log information is reconstructed using an information reconstruction model to obtain second log information corresponding to the first log information.

[0017] Optionally, the determining whether the first log information is abnormal log information based on the reconstruction error includes:

[0018] If the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

[0019] Optionally, obtaining the first log information of the target device includes:

[0020] Obtaining first log information of multiple processes of a target device, wherein the first log information at least includes process information;

[0021] The reconstructing the first log information using the information reconstruction model to obtain second log information corresponding to the first log information includes:

[0022] For each of the multiple processes, the first log information associated with the process is determined, and the first log information associated with the process is reconstructed using an information reconstruction model to obtain second log information corresponding to the process.

[0023] Optionally, at least one of the following is also included:

[0024] In the case where the first log information is abnormal log information, outputting abnormal prompt information;

[0025] When the first log information is abnormal log information, performing device protection processing on the target device;

[0026] Within a preset time period, the health status information of the target device is determined according to an identification result of whether the first log information belongs to abnormal log information.

[0027] Optionally, the method for determining the error threshold includes:

[0028] Determine a first association relationship and a second association relationship according to the detection rate and the false alarm rate of the information reconstruction model under different candidate thresholds, wherein the first association relationship represents the correlation between the threshold and the detection rate, and the second association relationship represents the correlation between the threshold and the false alarm rate;

[0029] The error threshold is determined according to the first association relationship and the second association relationship.

[0030] Optionally, also include:

[0031] In the case where it is determined that the first log information belongs to abnormal log information, obtaining manual marking information corresponding to the first log information, where the manual marking information is used to indicate that the first log information belongs to a normal device log or abnormal log information;

[0032] When the manual marking information indicates that the first log information belongs to a normal device log, the parameters of the information reconstruction model are updated according to the first log information.

[0033] Optionally, the process of constructing the information reconstruction model includes:

[0034] Get the normal device log as a build sample;

[0035] Using an encoder to encode the constructed sample to obtain a log feature code;

[0036] Decoding the log feature code using a decoder to obtain a reconstructed device log;

[0037] Determine a model loss according to the normal device log and the reconstructed device log, wherein the model loss is positively correlated with a reconstruction error between the normal device log and the reconstructed device log;

[0038] Adjusting the parameters of the encoder and the decoder according to the model loss, and returning to execute the encoding process of the constructed sample by using the encoder to obtain the log feature encoding step until the model loss converges;

[0039] When the model loss converges, the combination of the encoder and the decoder serves as the information reconstruction model.

[0040] A second aspect of the present application provides an information processing device, including:

[0041] An obtaining unit, configured to obtain first log information of a target device, wherein the first log information includes at least one of file information, process information, network information, process hidden information, and command line information;

[0042] a reconstruction unit, configured to reconstruct the first log information by using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information;

[0043] a detection unit, configured to determine a reconstruction error between the first log information and the second log information;

[0044] An identification unit is used to determine whether the first log information is abnormal log information based on the reconstruction error.

[0045] Optionally, when the identification unit determines whether the first log information is abnormal log information based on the reconstruction error, it is configured to:

[0046] If the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

[0047] A third aspect of the present application provides an electronic device, including:

[0048] one or more processors;

[0049] a storage device having one or more programs stored thereon;

[0050] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the first aspects of the present application.

[0051] A fourth aspect of the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any method described in the first aspect of the present application.

[0052] The fifth aspect of the present application provides a computer program product, comprising executable computer instructions, which, when executed by a processor, implement any method described in the first aspect of the present application.

[0053] The beneficial effects of this solution are:

[0054] The information reconstruction model of this scheme is built based on normal log information, so the model can accurately reconstruct normal log information and obtain reconstructed log information with a smaller reconstruction error than the input original log information. However, the accuracy is lower when reconstructing abnormal log information related to network attack behavior, and the reconstruction error between the reconstructed log information and the original abnormal log information is larger. Based on this feature, the reconstruction error between the log information reconstructed by the information reconstruction model and the original log information can be determined, and whether the original log information belongs to abnormal log information can be identified. It can be seen that this scheme does not rely on the recognition of the characteristics of the abnormal log information itself, so compared with the existing method of installing corresponding patches, this scheme can be widely used to identify various types of abnormal log information. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0056] Figure 1 A flowchart of a method for processing log information disclosed in an embodiment of the present application;

[0057] Figure 2 A data flow diagram disclosed in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of the structure of an information reconstruction model disclosed in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of the distribution of reconstruction errors of normal log information and abnormal log information provided by an embodiment of the present application;

[0060] Figure 5 A schematic diagram of the structure of a log information processing device provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of the structure of another log information processing device provided in an embodiment of the present application;

[0062] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0065] Furthermore, in this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0066] In order to facilitate understanding of the technical solution of the present application, some terms that may be involved in the present application are first explained.

[0067] SecOps, the abbreviation of Secure Operations, refers to the technology of achieving network security operation and maintenance through automated threat detection, incident response, security analysis and predictive security.

[0068] Box products refer to integrated hardware and software products. Manufacturers of such products usually package and integrate the software and hardware used to implement a series of functions into one product. Users only need to connect the product with other devices, and the product can provide users with corresponding solutions. For example, box products in the field of industrial automation can provide solutions for monitoring and controlling industrial production processes; box products in the medical field can provide diagnosis and treatment support solutions based on medical images or other physiological signals (such as electrocardiograms); box products in network security can provide firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS) and other multi-functional integrated network security solutions; box products in the field of the Internet of Things (such as the Internet of Things gateway) can integrate communication modules, processors and the Internet of Things protocol stack, thereby providing a bridge between Internet of Things devices and cloud platforms.

[0069] A file fingerprint may refer to information that can serve as a unique identifier and feature of a file and can be used to distinguish different files.

[0070] ROOTKIT information refers to a type of software that can hide the existence of the software itself, hide the communication behavior between the software itself and other programs, and hide other programs or information. Due to the above functions, this type of software is often used to remotely control the system infected by this type of software.

[0071] This application embodiment provides a method for processing log information. Figure 1 , the method may include the following steps.

[0072] S101, obtaining first log information of a target device, where the first log information includes at least one of file fingerprint, process information, network information, process hidden information, and command line information.

[0073] The command line information may include commands executed when the process of the target device is running.

[0074] File fingerprints can indicate which files are accessed by processes running on the target device.

[0075] The process information may indicate which processes are running on the target device and the resource usage of the processes, such as how much memory is occupied and how much processor time is occupied.

[0076] The network information can indicate the network status of the target device's process, such as what data is uploaded or downloaded, which addresses in the network are accessed, etc.

[0077] The process hidden information may include the aforementioned ROOTKIT information.

[0078] See also Figure 2 The execution subject of the processing method of this embodiment may be a server device. The server device may be connected to the target device for communication so as to obtain the first log information of the target device.

[0079] The target device may be any electronic device that needs to be protected against network attacks using the method of this embodiment.

[0080] As an example, the target device may be the above-mentioned box-type product. In the case where the target device is a box-type product, the execution subject of this embodiment may be a server device of a manufacturer of the box-type product.

[0081] The first log information can be collected and reported to the server device by an agent program (such as a collection client) pre-installed on the target device. The collection client can be pre-installed by the manufacturer through the device background before the target device leaves the factory, or can be downloaded and installed by the target device from the server device according to the user's needs during the user's use of the target device.

[0082] The number of target devices may be one or more. For example, in S101, the server may obtain the first log information of the three target devices through the collection clients installed on the target devices 1, 2 and 3. When there are multiple target devices, the server device may process the first log information of each target device respectively according to the method of this embodiment to determine whether the first log information is abnormal log information.

[0083] In order to avoid affecting the normal use of the target device, the collection client can detect the resource usage of the target device. When it is detected that the processor resource usage and memory resource usage of the target device are both lower than a certain usage threshold, that is, when it is determined that the target device is in an idle state, the first log information is collected and reported. If the target device is not in an idle state, the first log information may not be collected and reported.

[0084] The collection client can perform the log reporting operation once every certain reporting period. Taking the reporting period of 30 minutes as an example, when the target device is turned on, the collection client detects whether the target device is in an idle state every 30 minutes. If it is in an idle state, the collection client collects and reports the first log information. If the target device is not in an idle state for 5 consecutive minutes, the collection client can continue to wait for 30 minutes and repeat the above operation after 30 minutes.

[0085] Each time the collection client reports the first log information, all log information generated by the first device between the last report and the current report can be reported to the server as the first log information. Alternatively, in order to reduce network occupancy and reduce the burden on the server device, the collection client can identify network security-related alarm information generated during the operation of the target device, and report the log information when the alarm information is identified as the first log information to the server, for example, the log information within one minute before the alarm information is generated and the log information within one minute after the alarm information is generated can be reported to the server as the first log information.

[0086] The collection client can display the configuration and notification interface to the user by displaying the interface on the monitor connected to the target device, so that the user can connect to the collection client operation and configure the relevant parameters of the collection client, such as configuring the reporting cycle, configuring the screening conditions, etc.

[0087] The filter condition is used to control which log information is not reported by the collection client. For example, the user can specify application A in the filter condition, and the collection client does not report the log information related to application A to the server based on the filter condition.

[0088] When collecting and reporting log information, the collection client can filter the log information and delete or block the user privacy data involving the privacy of the user (individual or corporate user) in the log information to ensure that the first log information reported to the server does not contain these user privacy data.

[0089] Before the collection client collects and reports logs for the first time, the collection client can display a notification interface to the user through the display. The user can choose whether to agree to the collection client to collect and report log information in the notification interface. If not agreeing, the collection client may not report the log information, and then not execute the method of this embodiment. The collection client can collect and report log information only if the user chooses to agree.

[0090] S102, reconstructing the first log information by using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information.

[0091] Normal log information may include log information collected from the target device when the target device is not attacked by the network.

[0092] like Figure 2 As shown, the server may be preloaded with an information reconstruction model. The information reconstruction model may reconstruct a log message to generate a new log message similar to the input log message. In this embodiment, the server may input the first log message of each target device into the information reconstruction model to obtain the second log message of each target device.

[0093] by Figure 2 For example, the server can use the information reconstruction model to process the first log information of target device 1 to obtain the second log information of target device 1, use the information reconstruction model to process the first log information of target device 2 to obtain the second log information of target device 2, and use the information reconstruction model to process the first log information of target device 3 to obtain the second log information of target device 3.

[0094] This embodiment does not limit the structure of the information reconstruction model. Figure 3 The information reconstruction model may be a neural network model implemented based on an automatic encoding algorithm (Autoencoder), and the model may include an encoder and a decoder. In step S102, the server may encode the first log information with the encoder of the information reconstruction model to obtain a log feature code corresponding to the first log information, and then decode the log feature code with the decoder to obtain the corresponding second log information.

[0095] The first log information obtained by the server may include first log information of multiple processes of the target device, for example, may include first log information associated with process A, first log information associated with process B, and first log information associated with process C of the target device.

[0096] In view of this situation, under the premise that the first log information at least includes process information, the server can reconstruct the first log information in the following manner:

[0097] For each of the multiple processes, first log information associated with the process is determined, and the first log information associated with the process is reconstructed using an information reconstruction model to obtain second log information corresponding to the process.

[0098] In combination with the above example, assuming that the first log information obtained contains the information of the first logs generated by processes A, B and C of the target device, the server device can extract the first log information associated with process A, reconstruct this part of the first log information, and obtain the second log information of process A. Similarly, the second log information of process B and the second log information of process C can be obtained.

[0099] The first log information associated with process A may include the following information:

[0100] The command line information of process A is used to indicate the commands executed when process A is running;

[0101] The file fingerprint corresponding to process A indicates the files accessed when process A is running;

[0102] Process information of process A, including the name of process A and resource usage during operation;

[0103] The network information of process A indicates the network status of process A;

[0104] The process A generates hidden information.

[0105] The method of determining which process the first log information is associated with may be to read the process information of the first log information, and determine the process associated with the first log information based on an identifier or name in the process information that can characterize a specific process. For example, if the process information of a first log information includes the name of process A, then it is determined that the first log information is associated with process A, and if the process information of another first log information includes the identifier of process B, then it is determined that the first log is associated with process B.

[0106] S103: Determine a reconstruction error between the first log information and the second log information.

[0107] The reconstruction error can be determined based on the similarity between the first log information and the second log information. The more similar the first log information and the second log information are, the greater the similarity is and the smaller the reconstruction error is. The less similar the first log information and the second log information are, the smaller the similarity is and the larger the reconstruction error is. The method for determining the reconstruction error can refer to the technical information on the reconstruction model in the prior art, which will not be described in detail.

[0108] It should be noted that when the first log information includes first log information associated with multiple processes, the reconstruction error detected in S103 is the first log information and the second log information associated with the same process.

[0109] In combination with the foregoing example, assuming that the first log information includes the first log information associated with process A, the first log information associated with process B, and the first log information associated with process C, in S103, the server may compare the first log information associated with process A with the second log information of process A to obtain the reconstruction error corresponding to process A, compare the first log information associated with process B with the second log information of process B to obtain the reconstruction error corresponding to process B, and compare the first log information associated with process C with the second log information of process C to obtain the reconstruction error corresponding to process C.

[0110] S104: Determine whether the first log information is abnormal log information based on the reconstruction error.

[0111] In an implementation manner of step S104, a manner of determining whether the first log information is abnormal log information may be that if the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

[0112] The server device can compare the reconstruction error with a preset error threshold. If the reconstruction error is less than or equal to the error threshold, it means that the information reconstruction model can more correctly identify and reconstruct the input first log information. The information reconstruction model is constructed based on normal log information, so it can be considered that: if the information reconstruction model can more correctly identify and reconstruct the first log information, then the first log information is normal log information.

[0113] Correspondingly, if the reconstruction error is greater than the error threshold, it means that the information reconstruction model cannot correctly identify and reconstruct the input first log information, and thus it can be considered that the input first log information is abnormal log information.

[0114] In S104, if the first log information obtained by the server is related to multiple processes of the target device, the reconstruction error corresponding to each process may be identified to determine which processes' first log information is abnormal log information and which processes' first log information is normal log information.

[0115] In combination with the foregoing example, in S104, the server may compare the reconstruction error and the error threshold corresponding to process A, the reconstruction error and the error threshold corresponding to process B, and the reconstruction error and the error threshold corresponding to process C. If, after comparison, it is found that the reconstruction error corresponding to process A is less than the error threshold, and the reconstruction errors corresponding to process B and process C are both greater than the error threshold, then it can be determined that the first log information corresponding to process A is normal log information, and the log information corresponding to process B and process C are both abnormal log information.

[0116] In some optional embodiments, the server device may not distinguish between the first log information associated with different processes, and directly input all the first log information reported by the acquisition client into the information reconstruction model at one time in step S102 to obtain the corresponding second log information, and then directly determine the reconstruction error based on the first log information and the second log information. If the reconstruction error is greater than the error threshold, it is determined that the first log information reported this time is abnormal log information. If the reconstruction error is not greater than the error threshold, it is determined that the first log information reported this time is normal log information.

[0117] In another implementation of step S104, a method for determining whether the first log information is abnormal log information may be: comparing the current reconstruction error with the reference reconstruction error; if the difference between the current reconstruction error and the reference reconstruction error is within a certain range, determining that the first log information is normal log information; if the difference between the two exceeds the certain range, determining that the first log information is abnormal log information.

[0118] The reference reconstruction error may be a reconstruction error when normal log information is reconstructed based on the information reconstruction model, that is, the normal log information is reconstructed using the information reconstruction model, and the reconstruction error obtained by comparing the output of the information reconstruction model with the normal log information is used as the reference reconstruction error.

[0119] The beneficial effects of this solution are:

[0120] The information reconstruction model of this scheme is built based on normal log information, so the model can accurately reconstruct normal log information and obtain reconstructed log information with a smaller reconstruction error than the input original log information. However, the accuracy is lower when reconstructing abnormal log information related to network attack behavior, and the reconstruction error between the reconstructed log information and the original abnormal log information is larger. Based on this feature, the reconstruction error between the log information reconstructed by the information reconstruction model and the original log information can be determined, and whether the original log information belongs to abnormal log information can be identified. It can be seen that this scheme does not rely on the recognition of the characteristics of the abnormal log information itself, so compared with the existing method of installing corresponding patches, this scheme can be widely used to identify various types of abnormal log information.

[0121] In some optional embodiments, the server device may pre-process the obtained first log information before executing S102, that is, the server device may execute the following steps before S102:

[0122] The first log information is preprocessed to obtain preprocessed first log information, where the preprocessing includes at least one of data cleaning and data conversion.

[0123] Correspondingly, in S102, the server may reconstruct the preprocessed first log information using the information reconstruction model to obtain second log information corresponding to the first log information.

[0124] Cleaning the first log information may include identifying and deleting erroneous data in the first log information. The data cleaning method is not limited. As an example, the value corresponding to each item of data in the first log information may be identified. If the value exceeds the value range of the data, the data is determined to be erroneous data and deleted.

[0125] The data conversion for the first log information may be to convert a plurality of data in different formats in the first log information into data in a unified format.

[0126] The beneficial effects of this embodiment are:

[0127] By preprocessing the first log information, the preprocessed first log information can be obtained in a format that better meets the log reconstruction requirements, thereby facilitating improving the model processing efficiency and accuracy.

[0128] The method provided in this embodiment can be applied to the field of network security protection of electronic devices. For example, the method of this embodiment can be used to detect whether the first log information of the target device is abnormal log information. When it is detected that the first log information is abnormal log information, it is determined that the target device is under a network attack, and then corresponding network protection measures are taken.

[0129] Optionally, after identifying whether the first log information is normal log information or abnormal log information in the above manner, the server may further perform at least one of the following post-processing methods.

[0130] Post-processing method 1: when the first log information is abnormal log information, output abnormal prompt information, where the abnormal prompt information is used to indicate that the first log information is abnormal log information;

[0131] Post-processing method 2: when it is determined that the first log information is abnormal log information, device protection processing is performed on the target device;

[0132] Post-processing method three, within a preset time period, according to the identification result of whether the first log information belongs to abnormal log information, determining the health status information of the target device.

[0133] See also Figure 2 In post-processing method one, the server can display abnormal prompt information on the display device connected to the server for communication, and the abnormal prompt information can indicate that the first log information belongs to abnormal log information. In addition, the abnormal prompt information can also include the device identifier of the target device to which the first log information belongs, the time when the target device generates the first log information, the time when the collection client reports the first log information, the identifier of the process associated with the first log information, and other information, so that relevant technical personnel can quickly perform maintenance.

[0134] The abnormal prompt information can also indicate that the corresponding target device may be subject to a network attack.

[0135] Exemplarily, the abnormal prompt information may include "The log information reported by the target device 1 at a certain time on a certain day is abnormal. The target device 1 may be attacked by the network. Please handle it in time."

[0136] In post-processing method 2, the protection processing method can be that the server determines the target process associated with the first log information in the target device, and then sends an instruction to the target device to close the process and delete the program corresponding to the process, so as to prevent the related process from causing further damage to the target device. In combination with the above example, after the server determines that the first log information associated with process B is abnormal log information, it can send the above instruction to control the target device to close process B and delete the program corresponding to process B.

[0137] In post-processing method three, the preset time period can be the past 24 hours, past 12 hours, past 30 minutes, etc. up to the current moment. The specific duration can be set as needed without limitation.

[0138] The identification result may be "the log information belongs to abnormal log information" or "the log information belongs to normal log information".

[0139] The health status display information may include the identification result of the first log information of the target device obtained most recently, and may include statistical information of the identification result of the target device in the historical time period. For example, in the historical time period, the acquisition client of the target device 1 reported the first log information to the server 50 times in total, and the identification results of 5 of the reported first log information were abnormal log information. Then the health status display information of the target device may include "In the past 24 hours, the target device 1 was suspected to have been attacked by 5 network attacks, please take protective measures."

[0140] Optionally, in the processing method of this embodiment, the error threshold may be determined as follows:

[0141] A1, determining a first correlation relationship and a second correlation relationship according to the detection rate and the false alarm rate of the information reconstruction model under different candidate thresholds, wherein the first correlation relationship represents the correlation between the threshold and the detection rate, and the second correlation relationship represents the correlation between the threshold and the false alarm rate;

[0142] A2, determining an error threshold according to the first association relationship and the second association relationship.

[0143] In step A1, a plurality of log information serving as samples may be first obtained, a portion of which is normal log information, referred to as positive samples, and another portion of which is abnormal log information, referred to as negative samples.

[0144] Then, for each sample, the information reconstruction model is used to reconstruct the sample to obtain the reconstruction log information corresponding to the sample after model reconstruction. The sample is compared with the corresponding reconstruction log information to determine the reconstruction error corresponding to the sample.

[0145] Next, based on the reconstruction errors corresponding to the above samples, the false alarm rate and the detection rate when any candidate threshold is used as the error threshold are determined.

[0146] Among them, the detection rate can be the proportion of negative samples identified as abnormal log information in all negative samples under the current error threshold. For example, there are 100 negative samples, and 90 of them can be identified as abnormal log information based on the current error threshold. The detection rate corresponding to the current error threshold is 90%.

[0147] The false alarm rate can be the proportion of positive samples identified as abnormal log information in all positive samples under the current error threshold. For example, there are 100 positive samples, and 5 of them will be identified as abnormal log information based on the current error threshold. The false alarm rate corresponding to the current error threshold is 5%.

[0148] In the above manner, the detection rate and false alarm rate corresponding to each alternative threshold can be obtained. Then, through data fitting, a first correlation relationship can be determined based on multiple alternative thresholds and the detection rates corresponding to these alternative thresholds, and a second correlation relationship can be determined based on multiple alternative thresholds and the false alarm rates corresponding to these alternative thresholds.

[0149] In step A2, the first correlation relationship can be represented by a first curve with the detection rate as the ordinate and the alternative threshold as the abscissa, and the false alarm rate as the ordinate and the alternative threshold as the abscissa, and the second correlation relationship can be represented by a second curve with the false alarm rate as the ordinate and the alternative threshold as the abscissa, and the false alarm rate as the abscissa. Then, the abscissa corresponding to the intersection of the first curve and the second curve is determined as the error threshold. In other words, based on the first correlation relationship and the second correlation relationship, the alternative threshold that makes the detection rate and the false alarm rate equal can be determined as the error threshold.

[0150] By determining the error threshold in the above manner, a high detection rate and a low false alarm rate can be obtained at the same time, which can ensure security while not affecting the normal use of the target device due to excessive false alarms. Figure 4 The error threshold shown, Figure 4 Characterizes the distribution of the number of samples corresponding to different reconstruction errors, where the horizontal axis is the reconstruction error and the vertical axis is the number of samples with the corresponding reconstruction error after reconstruction by the information reconstruction model.

[0151] The server can construct the information reconstruction model as follows:

[0152] B1, obtain normal log information as a construction sample;

[0153] B2, use the encoder to encode the constructed sample to obtain the log feature code;

[0154] B3, using a decoder to decode the log feature code to obtain reconstructed log information;

[0155] B4, determine the model loss based on the normal log information and the reconstructed log information. The model loss is positively correlated with the reconstruction error of the normal log information and the reconstructed log information.

[0156] B5, adjust the parameters of the encoder and decoder according to the model loss, and return to execute the encoding process of the constructed sample using the encoder to obtain the log feature encoding step until the model loss converges, wherein, when the model loss converges, the combination of the encoder and the decoder is used as the information reconstruction model.

[0157] Before executing step B2, the server may also perform data preprocessing on the construction samples and associate the construction samples by process so as to divide the construction samples into log information corresponding to different processes. The specific method can be found in the previous text and will not be described in detail.

[0158] In steps B2 and B3, the server device can first load the initial encoder and decoder determined based on the automatic encoding algorithm. When B2 and B3 are executed for the first time, the parameters contained in the encoder and decoder can be generated by random initialization, and then the constructed sample is input into the encoder to obtain the log feature encoding output by the encoder, and the log feature encoding is input into the decoder to obtain the reconstructed log information output by the decoder.

[0159] In step B4, the reconstruction error between the normal log information and the reconstructed log information used as construction samples may be determined first, and then the model loss may be determined according to the reconstruction error.

[0160] The model loss can be determined by calculating the average value of the reconstruction errors of multiple construction samples and using the average value as the model loss. The model loss can also be determined by counting the proportion of construction samples with different reconstruction errors in all construction samples, using the proportion as a weight to perform a weighted average operation on the reconstruction errors of all construction samples, and using the result as the model loss.

[0161] In step B5, the server may determine the adjustment amount of each parameter in the encoder and decoder according to the model loss, adjust the corresponding parameters based on the adjustment amount, and after adjusting all parameters, return to execute step B2 until the model loss converges.

[0162] Among them, the method of determining the adjustment amount of each parameter according to the model loss can refer to the relevant existing technologies in the fields of deep learning technology and automatic encoder technology, which will not be repeated here.

[0163] The condition for the model loss to converge may be that the model loss is less than a preset convergence threshold. That is, if the model loss determined in step B4 is not less than the convergence threshold, the parameters of the encoder and decoder can be adjusted according to step B5, and the execution of step B2 can be returned. If the model loss determined in step B4 is less than the convergence threshold after repeating the process from B2 to B5 several times, it can be determined that the model loss has converged at this time, and the combination of the encoder and decoder at this time is determined as Figure 3 The information reconstruction model shown.

[0164] Optionally, the server can also update the model based on human feedback in the following manner in response to false positives of the information reconstruction model:

[0165] C1, when it is determined that the first log information is abnormal log information, obtaining manual marking information corresponding to the first log information, where the manual marking information is used to indicate whether the first log information is normal log information or abnormal log information;

[0166] C2: when the manual marking information indicates that the first log information is normal log information, update the parameters of the information reconstruction model according to the first log information.

[0167] In step C1, the server may send all or part of the first log information identified as abnormal log information to a manual review terminal, and relevant technical personnel may manually determine whether the first log information is abnormal log information, thereby obtaining manual marking information corresponding to the first log information.

[0168] In step C2, the server may identify the first log information that meets the following update conditions:

[0169] The first log information is identified as abnormal log information by the information reconstruction model, while the manual marking information indicates that the first log information belongs to normal log information.

[0170] Then, the first log information that meets the update conditions is input into the information reconstruction model to obtain the second log information after reconstruction, and the model loss is determined according to the reconstruction error between the first log information and the second log information. The parameters of the information reconstruction model are updated according to the model loss. After the update, the first log information that meets the update conditions is input into the information reconstruction model again. This process is repeated until after a certain update, the reconstruction error of the first log information that meets the update conditions is less than or equal to the error threshold.

[0171] By updating the parameters of the information reconstruction model in the above manner, the false alarm rate of the model can be continuously reduced during the use of the information reconstruction model.

[0172] The present application also provides a log information processing device, such as Figure 5 As shown, specifically including:

[0173] An obtaining unit 501 is used to obtain first log information of a target device, where the first log information includes at least one of file information, process information, network information, process hidden information, and command line information;

[0174] A reconstruction unit 502 is used to reconstruct the first log information by using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information;

[0175] A detection unit 503, configured to determine a reconstruction error between the first log information and the second log information;

[0176] The identification unit 504 is configured to determine whether the first log information is abnormal log information based on the reconstruction error.

[0177] Optionally, when the identification unit 504 determines whether the first log information is abnormal log information based on the reconstruction error, it is configured to:

[0178] If the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

[0179] Optionally, when the obtaining unit 501 obtains the first log information of the target device, it can be used to:

[0180] Obtaining first log information of multiple processes of a target device, where the first log information at least includes process information;

[0181] When the reconstruction unit 502 reconstructs the first log information using the information reconstruction model to obtain the second log information corresponding to the first log information, it can be used to:

[0182] For each of the multiple processes, first log information associated with the process is determined, and the first log information associated with the process is reconstructed using an information reconstruction model to obtain second log information corresponding to the process.

[0183] Optional, see Figure 6 The device may also include a training unit 601 for constructing an information reconstruction model, specifically for:

[0184] Get normal log information as a build sample;

[0185] The encoder is used to encode the constructed sample to obtain the log feature code;

[0186] The decoder is used to decode the log feature code to obtain the reconstructed log information;

[0187] Determine the model loss based on the normal log information and the reconstructed log information, and the model loss is positively correlated with the reconstruction error of the normal log information and the reconstructed log information;

[0188] The parameters of the encoder and decoder are adjusted according to the model loss, and the encoder is used to encode the constructed sample to obtain the log feature encoding step until the model loss converges. When the model loss converges, the combination of the encoder and decoder is used as the information reconstruction model.

[0189] Optionally, the training unit 601 is further used to determine an error threshold, specifically:

[0190] Determine a first correlation relationship and a second correlation relationship according to the detection rate and the false alarm rate of the information reconstruction model under different candidate thresholds, wherein the first correlation relationship represents the correlation between the threshold and the detection rate, and the second correlation relationship represents the correlation between the threshold and the false alarm rate;

[0191] An error threshold is determined according to the first association relationship and the second association relationship.

[0192] Optionally, the device may further include a preprocessing unit 602 for:

[0193] Preprocessing the first log information to obtain preprocessed first log information, where the preprocessing includes at least one of data cleaning and data conversion;

[0194] The reconstruction unit 502 reconstructs the first log information using the information reconstruction model to obtain the second log information corresponding to the first log information, which is specifically used for:

[0195] The preprocessed first log information is reconstructed using the information reconstruction model to obtain second log information corresponding to the first log information.

[0196] Optionally, the apparatus further includes a post-processing unit 603, configured to perform at least one of the following:

[0197] When the first log information is abnormal log information, output abnormal prompt information;

[0198] When the first log information is abnormal log information, performing device protection processing on the target device;

[0199] Within a preset time period, the health status information of the target device is determined according to an identification result of whether the first log information belongs to abnormal log information.

[0200] Optionally, the device further includes an updating unit 604, configured to:

[0201] In the case where it is determined that the first log information belongs to abnormal log information, obtaining manual marking information corresponding to the first log information, where the manual marking information is used to indicate whether the first log information belongs to normal log information or abnormal log information;

[0202] When the manual marking information indicates that the first log information belongs to normal log information, parameters of the information reconstruction model are updated according to the first log information.

[0203] The working principle of the information processing device provided in this embodiment can be found in the relevant steps of the information processing method provided in any embodiment of the present application, and will not be repeated here.

[0204] Another embodiment of the application also provides an electronic device, such as Figure 7As shown, specifically including:

[0205] One or more processors 701.

[0206] The storage device 702 stores one or more programs.

[0207] When one or more programs are executed by one or more processors 701 , the one or more processors 701 implement any one of the methods in the above embodiments.

[0208] Another embodiment of the present application further provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, any one of the methods in the above embodiments is implemented.

[0209] An embodiment of the present application also provides a computer program product, including executable computer instructions. When these computer instructions are executed by a processor, the method provided in any embodiment of the present application can be implemented.

[0210] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0211] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0212] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An information processing method, characterized in that: include: Obtaining first log information of a target device, wherein the first log information includes at least one of file information, process information, network information, process hidden information, and command line information; Reconstructing the first log information using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information; determining a reconstruction error between the first log information and the second log information; Based on the reconstruction error, it is determined whether the first log information is abnormal log information.

2. The method according to claim 1, characterized in that The determining whether the first log information is abnormal log information based on the reconstruction error includes: If the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

3. The method according to claim 1, characterized in that The first log information includes process information; The reconstructing the first log information using the information reconstruction model to obtain second log information corresponding to the first log information includes: The first log information is associated based on the process information; the associated first log information is sent to the information reconstruction model for reconstruction processing to obtain the second log information.

4. The method according to claim 1, characterized in that: Also includes at least one of the following: In the case where the first log information is abnormal log information, outputting abnormal prompt information; When the first log information is abnormal log information, performing device protection processing on the target device; Within a preset time period, the health status information of the target device is determined according to an identification result of whether the first log information belongs to abnormal log information.

5. The method according to claim 2, characterized in that: The method for determining the error threshold comprises: Determine a first association relationship and a second association relationship according to the detection rate and the false alarm rate of the information reconstruction model under different candidate thresholds, wherein the first association relationship represents the correlation between the threshold and the detection rate, and the second association relationship represents the correlation between the threshold and the false alarm rate; The error threshold is determined according to the first association relationship and the second association relationship.

6. An information processing device, characterized in that: include: An obtaining unit, configured to obtain first log information of a target device, wherein the first log information includes at least one of file information, process information, network information, process hidden information, and command line information; a reconstruction unit, configured to reconstruct the first log information by using an information reconstruction model to obtain second log information corresponding to the first log information, wherein the information reconstruction model is constructed based on normal log information; a detection unit, configured to determine a reconstruction error between the first log information and the second log information; An identification unit is used to determine whether the first log information is abnormal log information based on the reconstruction error.

7. The device according to claim 6, characterized in that When the identification unit determines whether the first log information belongs to abnormal log information based on the reconstruction error, it is used to: If the reconstruction error is greater than a preset error threshold, it is determined that the first log information is abnormal log information.

8. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 5.

9. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

10. A computer program product, characterized in that The method comprises executable computer instructions, which implement the method according to any one of claims 1 to 5 when executed by a processor.

Images