Weblog abnormal behavior analysis method based on time sequence prediction model

Abstract

The invention discloses a network log abnormal behavior analysis method based on a time sequence prediction model. The method comprises the following steps: collecting weblog data generated by a user access behavior, preprocessing the weblog data, and converting the weblog data into time sequence data; generating a behavior pattern prediction result based on a pre-constructed time sequence prediction model and the time sequence data; and when the behavior pattern prediction result is abnormal, performing anomaly analysis on the time series data based on an anomaly knowledge base. According to the method, the situation of data loss caused by machine learning based on regression statistics is avoided; and the influence of subjective consciousness of people caused by dependence on a sample library is avoided, a reasonable anomaly detection threshold value and rule can be set according to an actual application scene, and finally an abnormal object is output according to a confidence degree result.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network log abnormal behavior analysis method and system based on a time series prediction model. Background Art

[0002] With the rapid development of network technology, network security issues have become increasingly prominent. Traditional network security protection methods often focus on post-event response and are difficult to provide effective early warning before an attack occurs. Therefore, it is particularly important to develop a system that can monitor network logs in real time and identify abnormal behaviors.

[0003] The current mainstream analysis technology, such as machine learning based on logistic regression statistics, requires data transformation and other cleaning operations, using density maps, scatter plots and other methods to establish certain rules, and then performing multiple commonality tests on the data to finally establish the corresponding behavior analysis model. This method will lose a large amount of log data and will have a large deviation in the final behavior analysis results.

[0004] Other analysis techniques, such as extracting subject domain name data from network logs; then establishing corresponding platform entries based on subject domain name data; then disassembling the log traffic packets of the access subject through DPI technology, extracting keywords from the disassembled data, and counting the frequency and duration of keywords appearing in a unit of time, thereby determining user behavior. Although this method does not lose a large amount of log data, it has a strong reliance on the construction of a keyword library. Keywords maintained by different groups and standards will cause deviations in the final behavior analysis results.

[0005] Based on this, a new solution is needed. Summary of the invention

[0006] The main purpose of the present invention is to provide a method and system for analyzing abnormal behavior of network logs based on a time series prediction model.

[0007] To achieve the above object, the present invention provides a network log abnormal behavior analysis method based on a time series prediction model, comprising the following steps:

[0008] Collecting network log data generated by user access behavior, and converting the network log data into time series data after preprocessing;

[0009] Generate behavior pattern prediction results based on a pre-built time series prediction model and the time series data;

[0010] When the behavior pattern prediction result is abnormal, an abnormality analysis is performed on the time series data based on an abnormality knowledge base.

[0011] In the network log abnormal behavior analysis method based on the time series prediction model provided by the present invention, the steps of collecting network log data generated by user access behavior and converting the network log data into time series data after preprocessing include:

[0012] Collecting said network log data;

[0013] Normalizing, knowledge base matching and data enrichment of the network log data;

[0014] The preprocessed network log data is converted into the time series data.

[0015] In the network log abnormal behavior analysis method based on the time series prediction model provided by the present invention, the step of generating the behavior pattern prediction result based on the pre-built time series prediction model and the time series data includes:

[0016] Based on the time series data, domain name analysis is performed to define the nature of the user's access behavior to obtain a first information enhancement tag set;

[0017] Performing text mining on the URLs in the time series data by using a string matching algorithm to obtain a second information enhancement tag set;

[0018] The first information enhanced label set, the second information enhanced label set and the time series data are input into the time series prediction model, and a result set that meets the user-defined conditions is output as the behavior pattern prediction result.

[0019] In the network log abnormal behavior analysis method based on the time series prediction model provided by the present invention, when the behavior pattern prediction result is abnormal, the step of performing abnormal analysis on the time series data based on the abnormal knowledge base includes:

[0020] Comparing the second information enhancement label set with the anomaly knowledge base to obtain multiple anomaly analysis results;

[0021] Based on the judgment rules preset by the user, confidence judgment is performed on the multiple abnormal analysis results;

[0022] When the confidence judgment result exceeds the preset threshold, an early warning message is output.

[0023] In addition, to achieve the above purpose, the present invention also provides a network log abnormal behavior analysis system based on a time series prediction model, comprising:

[0024] A data collection and processing module is used to collect network log data generated by user access behavior, and convert the network log data into time series data after preprocessing;

[0025] A behavior pattern prediction module, used to generate a behavior pattern prediction result based on a pre-built time series prediction model and the time series data;

[0026] The abnormality analysis module is used to perform abnormality analysis on the time series data based on the abnormality knowledge base when the behavior pattern prediction result is abnormal.

[0027] In the network log abnormal behavior analysis system based on the time series prediction model provided by the present invention, the data acquisition and processing module includes:

[0028] A data collection unit, used to collect the network log data;

[0029] A data preprocessing unit, used for normalizing, knowledge base matching and data enrichment of the network log data;

[0030] The data conversion unit is used to convert the preprocessed network log data into the time series data.

[0031] In the network log abnormal behavior analysis system based on the time series prediction model provided by the present invention, the behavior pattern prediction module includes:

[0032] A domain name analysis unit, configured to perform domain name analysis based on the time series data to define the nature of the user's access behavior and obtain a first information enhancement tag set;

[0033] A text mining unit, used to perform text mining on the URLs in the time series data by using a string matching algorithm to obtain a second information enhancement tag set;

[0034] A prediction unit is used to input the first information enhancement label set, the second information enhancement label set and the time series data into the time series prediction model, and output a result set that meets the user-defined conditions as the behavior pattern prediction result.

[0035] In the network log abnormal behavior analysis system based on the time series prediction model provided by the present invention, the abnormal analysis module includes:

[0036] a comparison unit, configured to compare the second information enhancement label set with the anomaly knowledge base to obtain a plurality of anomaly analysis results;

[0037] A confidence calculation unit, configured to make confidence judgments on the plurality of abnormal analysis results based on judgment rules preset by a user;

[0038] The abnormal output unit is used to output warning information when the confidence judgment result exceeds a preset threshold.

[0039] The present invention also provides a network log abnormal behavior analysis device based on a time series prediction model, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the network log abnormal behavior analysis method based on the time series prediction model as described above are implemented.

[0040] The present invention also provides a storage medium storing one or more programs, which can be executed by one or more processors to implement the steps of the network log abnormal behavior analysis method based on the time series prediction model as described above.

[0041] The network log abnormal behavior analysis system and method based on the time series prediction model provided by the present invention have the following beneficial effects: based on network logs and existing black and gray domain name sample libraries, the present invention combines time series models with LSTM neural network algorithms to compare the behavior patterns output by the prediction model with actual log data, and predict and identify abnormal behaviors in advance; it avoids the situation where machine learning based on regression statistics leads to data loss, and avoids the influence of human subjective consciousness caused by reliance on sample libraries, and can also set reasonable anomaly detection thresholds and rules according to actual application scenarios, and finally outputs abnormal objects according to confidence results. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work:

[0043] Figure 1 The figure is a flow chart of a method for analyzing abnormal behavior of network logs based on a time series prediction model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0046] Figure 1 FIG. 1 is a flow chart of a method for analyzing abnormal behavior of network logs based on a time series prediction model provided by an embodiment of the present invention. Figure 1 As shown, the network log abnormal behavior analysis method based on the time series prediction model includes the following steps:

[0047] Step S1, collecting network log data generated by user access behavior, and converting the network log data into time series data after preprocessing;

[0048] Specifically, in one embodiment of the present invention, network log data generated when users access the network is collected in real time from sources such as network devices and servers to ensure that the data is not missing and is not affected by the devices and networks; preprocessing operations are performed on the data collected in real time to improve the data quality; and then the preprocessed log data is converted into time series data for subsequent analysis and prediction. Therefore, step S1 includes:

[0049] Step S11, collecting the network log data;

[0050] Specifically, in this embodiment, by deploying a log collection tool or service on a network device or server, the network log of the user's access behavior is obtained in real time. Common sources of log data include Web servers, proxy servers, network firewalls, load balancers, etc. The collected log files are often unstructured and contain a large amount of original information. In order to be able to perform subsequent analysis, the log data needs to be parsed. For example, a Web server log may be stored in an Apache log format or an Nginx log format, and the parsing tool will convert the original data into structured data according to a specific log format. The parsed log data may contain fields such as the timestamp of the request, the URL of the request, the IP address, the user agent information, the response status code, the response time, etc. The parsed log data will be written to the distributed message queue platform Kafka. Kafka is a high-throughput, low-latency stream processing platform that can ensure the real-time and reliability of data. Data is transmitted through Kafka and can be easily transferred between different analysis tools or systems.

[0051] Step S12, normalizing, knowledge base matching and data enrichment are performed on the network log data;

[0052] Specifically, in this embodiment, a series of preprocessing operations are performed on the collected raw log data, including normalization, knowledge base matching, and data enrichment, to improve data quality and information availability.

[0053] Furthermore, in the collected log data, different data fields may have different dimensions or inconsistent units. For example, numerical data such as the number of user visits and page loading time may have different magnitudes, and direct use may affect the stability of the analysis results. The goal of normalization is to convert data values ​​to a uniform range, usually scaling the data to the interval of [0,1] or [-1,1], so as to avoid the deviation of certain numerical features from affecting the results of machine learning algorithms or statistical analysis.

[0054] Furthermore, by matching with an existing knowledge base, a deeper analysis of the log data can be performed. For example, certain specific IP addresses, access paths, or user behaviors may be a harbinger of abnormal behavior. By matching the rules or patterns in the knowledge base, these potential anomalies or risks can be marked. The knowledge base can contain a variety of information, such as: known malicious IP addresses to identify potential attackers; common access patterns to determine whether there is abnormal traffic; user behavior patterns to determine whether there are abnormal logins, frequent requests, etc.

[0055] Furthermore, the purpose of data enrichment is to add contextual information to log data by integrating external data sources, so that subsequent analysis can be more in-depth. For example, combined with geographic location data, the IP address of the visit can be mapped to the corresponding geographic location, thereby obtaining the geographic distribution of users. Other enriched content can also include; user device information, such as operating system, browser type; time information, such as whether it is working hours, holidays, etc.; access network operator or regional information.

[0056] Through the above operations, the preprocessed data will be more complete and accurate, and can provide more useful information for subsequent analysis and modeling.

[0057] Step S13: converting the preprocessed network log data into the time series data.

[0058] Specifically, in this embodiment, the pre-processed log data is converted into a time series data format to provide structured data input for subsequent analysis, modeling, prediction and other tasks. Time series data has a clear timestamp, and each record is associated with a specific time point. In order to perform effective time series analysis, the logs need to be sorted according to the timestamp of each log first. For network logs, the timestamp usually contains the exact time when the request occurs, and the log data can be arranged into a time series by the timestamp to observe the trend over time. Further, if the granularity of the original log data is too fine (for example, each request corresponds to a record), it can be converted into a more meaningful time granularity through aggregation operations. Common aggregation operations include aggregating log data by time intervals such as hours, days, and weeks, such as calculating the number of requests per hour, the average response time, etc. Further, if necessary, the data can be converted into a data stream with a fixed time interval by resampling to ensure that the data at each time point is consistent. After the time series data is sorted, it can be used as input data for the time series prediction model. Through the time series model, network traffic, server load, potential user behavior, etc. can be predicted. Through this step, the original network log data is converted into time series data that is easy to analyze and predict, ensuring that more efficient and accurate analysis tasks can be supported.

[0059] Step S2, generating a behavior pattern prediction result based on a pre-built time series prediction model and the time series data;

[0060] Specifically, in one embodiment of the present invention, firstly, based on a large number of existing black and gray domain name samples, a prediction model for predicting the normal behavior pattern of network logs is constructed based on the LSTM (long short-term memory) neural network algorithm. The prediction model can identify and output a result set that satisfies a special condition (user-defined condition) group according to the frequency, combination, time, etc. of the user's access behavior. LSTM is a neural network architecture for processing and predicting time series data. Compared with traditional feedforward neural networks, LSTM can effectively capture long-term dependencies in time series. Time series data is usually collected in chronological order and has strong temporality and dependency. LSTM can handle this temporality well through internal memory units and gating mechanisms. Time series data, such as time records, access frequency, and access duration of users visiting certain websites, will be used as input to the LSTM model. By training the LSTM network, the model can learn the law of access patterns changing over time, capture long-term and short-term dependencies, and thus predict the user's future behavior patterns. At the same time, in order to improve the prediction accuracy, the input data of the LSTM model not only includes the original time series data, but also combines the information enhancement label set. These label sets come from different data mining techniques, such as domain name analysis and URL text mining. By enhancing the label set with this information, more context and feature information can be provided to the LSTM model. Therefore, step S2 includes:

[0061] Step S21: Based on the time series data, domain name analysis is performed to define the nature of the user's access behavior, and a first information enhancement tag set is obtained;

[0062] Specifically, in this embodiment, domain name analysis refers to determining the nature of access behavior by analyzing the domain names accessed by users. Domain names can be used as a key indicator of behavior. Some domain names may represent normal business operations, while some domain names may indicate abnormal behaviors, such as malicious attacks or illegal operations. The goal of domain name analysis is to classify user access behaviors and define which accesses are normal and which may have potential risks. Based on this judgment, a first information enhancement label set is generated, which can be used as the input of the LSTM model to assist the model in understanding the behavior patterns that may be represented by different domain names.

[0063] Step S22: performing text mining on the URLs in the time series data by using a string matching algorithm to obtain a second information enhancement tag set;

[0064] Specifically, in this embodiment, URL text mining refers to analyzing the URL through a string matching algorithm to mine out possible related features. These features can help the model better identify potential abnormalities or attack behaviors. Through regular expressions or more complex string matching techniques, important information in the URL, such as paths, query parameters, etc., is extracted. Some special URL structures or specific query parameters may be related to attack behaviors (such as SQL injection, cross-site scripting attacks, etc.). By analyzing these URLs, potential security threats can be discovered. By analyzing and mining the URL, a new set of tags is obtained. These tags can further improve the predictive ability of the LSTM model, allowing the model to identify behavior patterns related to the URL structure.

[0065] Step S23: input the first information enhanced label set, the second information enhanced label set and the time series data into the time series prediction model, and output a result set that meets the user-defined conditions as the behavior pattern prediction result.

[0066] Specifically, in this embodiment, the first information enhancement label set from domain name analysis, the second information enhancement label set from URL text mining, and the original time series data are input into the LSTM model together. This fusion process provides more features for the model, enabling it to understand behavior patterns at a higher dimension. Based on these fused data, the LSTM model is trained and predicted to obtain behavior pattern results that meet user needs. For example, the model may predict the user's possible behavior trends in a certain period of time in the future, or identify potential abnormal behaviors. According to the user-defined conditions, the model outputs behavior pattern prediction results that meet these conditions. For example, the user may only care about a certain type of abnormal behavior, or pay attention to the behavior trends in certain specific time periods. Through flexible settings, the model can provide detailed behavior pattern analysis results, such as identifying potential malicious activities or abnormal access, providing users with future behavior trend predictions, and warning of behaviors under specific conditions.

[0067] In this embodiment, LSTM (Long Short-Term Memory Network) is used to predict the behavior pattern of time series data. At the same time, in order to improve the accuracy of the model and enhance the model's ability to recognize various behavior patterns, an information enhancement label set is used to enrich the input data and optimize the model's prediction results by analyzing domain names and mining URL text. Through in-depth analysis and modeling of user behavior, combined with LSTM's powerful time series processing capabilities and enhanced information of domain names and URLs, the model can predict behavior patterns based on richer data. This method can not only identify regular user behavior, but also effectively capture potential anomalies and risks.

[0068] Step S3: when the behavior pattern prediction result is abnormal, performing abnormal analysis on the time series data based on the abnormal knowledge base;

[0069] Specifically, in one embodiment of the present invention, the prediction result obtained by the time series prediction model is only normal or abnormal. When it is abnormal, it is impossible to determine where the abnormal point is. Therefore, in this embodiment, it also includes judging and identifying the abnormal behavior of the abnormal result. During identification, reasonable anomaly detection thresholds and rules can be set according to the actual application scenario, and finally the abnormal object is output according to the confidence result, avoiding the influence of human subjective consciousness. Therefore, there is no need to rely on a large number of third-party resources, only a small sample size of target data is needed, and abnormal network behavior can be accurately predicted based on time series, LSTM neural network and other technologies. Therefore, step S3 includes:

[0070] Step S31, comparing the second information enhancement label set with the anomaly knowledge base to obtain multiple anomaly analysis results;

[0071] Specifically, in this embodiment, the second information enhancement tag set is obtained by text mining technology, extracting the URL path, query parameters, request method, etc. in the access request. By extracting rich information features, each access behavior or event can be marked more carefully and accurately. Through these rich features, the system can classify and annotate each behavior in detail, thereby laying the foundation for subsequent abnormal behavior detection and comparative analysis. The abnormal knowledge base is a database containing a variety of known abnormal behavior patterns. Its construction is usually based on historical data and feedback from security experts, covering a variety of typical abnormal behaviors. By comparing the behavioral features in the second information enhancement tag set with the known abnormal patterns in the abnormal knowledge base, the system can quickly determine whether there are features that match a certain known abnormal behavior. This matching not only helps to quickly detect potential anomalies, but also can more accurately determine the type of anomaly and its possible risks. The matching method may include: rule-based matching: using a rule engine to match preset rules for specific URLs, request patterns or time features, etc.; similarity-based matching: by calculating the similarity between feature vectors (for example, using cosine similarity or Jaccard similarity), the behavior in the second information enhancement tag set is compared with the behavior pattern in the abnormal knowledge base. If a behavior pattern is found to be highly matched with a pattern in the anomaly knowledge base, the system will mark the behavior as a potential anomaly.

[0072] Step S32: Based on the judgment rules preset by the user, confidence judgment is performed on the multiple abnormal analysis results;

[0073] Specifically, in this embodiment, the system needs to make confidence judgments on multiple possible abnormal analysis results, and use preset rules to evaluate which abnormal behavior is most likely to be an actual problem. Normally, the model assigns a confidence score to each abnormal behavior. The higher the score, the more likely the model believes that the abnormal behavior is likely to occur. For example: high confidence: when the abnormal behavior pattern is highly matched with the known attack pattern, or has obvious malicious characteristics, the confidence score will be very high, indicating that the anomaly is very likely to be an actual threat; low confidence: if the characteristics of the abnormal behavior do not match the known pattern, or the characteristics are not obvious enough, the confidence is low. In order to better adapt to different application scenarios and security requirements, users can set a set of judgment rules according to specific circumstances to make judgments in multiple abnormal analysis results. Common judgment rules include: time rules: the time period when the abnormal behavior occurs may affect the confidence assessment, for example, abnormal traffic at night or on holidays may be considered to have a higher probability of attack; frequency rules: frequent requests within a certain period of time (for example, more than 1,000 requests per minute) may indicate anomalies; feature rules: for example, the access to certain specific URL paths may itself be a feature of abnormal behavior.

[0074] Step S33: When the confidence judgment result exceeds a preset threshold, output warning information.

[0075] Specifically, in this embodiment, the system will generate and output warning information based on the previous analysis results. When the confidence level of abnormal behavior exceeds the preset threshold, the system will trigger the warning mechanism to remind the security team to respond in time. The warning information usually contains the following key contents: abnormal behavior type, specific time when the abnormality occurs, abnormal feature information, confidence score, recommended response measures, etc.

[0076] In this embodiment, by combining the second information enhanced label set, the abnormal knowledge base, the confidence assessment and judgment rules, the system can effectively distinguish between normal behavior and abnormal behavior, thereby providing timely and accurate warning information to help security personnel quickly respond to and deal with potential security risks.

[0077] The present invention also provides a network log abnormal behavior analysis system based on a time series prediction model, comprising: a data acquisition and processing module, used to collect network log data generated by user access behavior, and convert the network log data into time series data after pre-processing; a behavior pattern prediction module, used to generate a behavior pattern prediction result based on a pre-built time series prediction model and the time series data; an abnormality analysis module, used to perform an abnormality analysis on the time series data based on an abnormality knowledge base when the behavior pattern prediction result is abnormal.

[0078] Specifically, in one embodiment of the present invention, the data acquisition and processing module includes: a data collection unit, used to collect the network log data; a data preprocessing unit, used to normalize, knowledge base match and enrich the network log data; a data conversion unit, used to convert the preprocessed network log data into the time series data.

[0079] Specifically, in one embodiment of the present invention, the behavior pattern prediction module includes: a domain name analysis unit, which is used to perform domain name analysis based on the time series data to define the nature of the user's access behavior and obtain a first information enhancement label set; a text mining unit, which is used to perform text mining on the URLs in the time series data through a string matching algorithm to obtain a second information enhancement label set; a prediction unit, which is used to input the first information enhancement label set, the second information enhancement label set and the time series data into the time series prediction model, and output a result set that meets the user-defined conditions as the behavior pattern prediction result.

[0080] Specifically, in one embodiment of the present invention, the anomaly analysis module includes: a comparison unit, used to compare the second information enhancement label set and the anomaly knowledge base to obtain multiple anomaly analysis results; a confidence calculation unit, used to perform confidence judgment on the multiple anomaly analysis results based on user preset judgment rules; an anomaly output unit, used to output warning information when the confidence judgment result exceeds a preset threshold.

[0081] The embodiment of the present invention further provides a network log abnormal behavior analysis device based on a time series prediction model, which may include:

[0082] Memory for storing computer programs;

[0083] The processor can implement the following steps when executing the computer program stored in the above memory:

[0084] Collect network log data generated by user access behavior, and convert the network log data into time series data after preprocessing; generate behavior pattern prediction results based on a pre-built time series prediction model and the time series data; when the behavior pattern prediction result is abnormal, perform an abnormality analysis on the time series data based on an abnormality knowledge base.

[0085] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps can be implemented;

[0086] Collect network log data generated by user access behavior, and convert the network log data into time series data after preprocessing; generate behavior pattern prediction results based on a pre-built time series prediction model and the time series data; when the behavior pattern prediction result is abnormal, perform an abnormality analysis on the time series data based on an abnormality knowledge base.

[0087] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM)> a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0088] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0089] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0090] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0091] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A network log abnormal behavior analysis method based on a time series prediction model, characterized in that: The following steps are involved: Collecting network log data generated by user access behavior, and converting the network log data into time series data after preprocessing; Generate behavior pattern prediction results based on a pre-built time series prediction model and the time series data; When the behavior pattern prediction result is abnormal, an abnormality analysis is performed on the time series data based on an abnormality knowledge base.

2. The network log abnormal behavior analysis method based on the time series prediction model according to claim 1 is characterized in that: The steps of collecting network log data generated by user access behavior and converting the network log data into time series data after preprocessing include: Collecting said network log data; Normalizing, knowledge base matching and data enrichment of the network log data; The preprocessed network log data is converted into the time series data.

3. The network log abnormal behavior analysis method based on the time series prediction model as claimed in claim 2 is characterized in that: The steps of generating behavior pattern prediction results based on the pre-built time series prediction model and the time series data include: Based on the time series data, domain name analysis is performed to define the nature of the user's access behavior to obtain a first information enhancement tag set; Performing text mining on the URLs in the time series data by using a string matching algorithm to obtain a second information enhancement tag set; The first information enhanced label set, the second information enhanced label set and the time series data are input into the time series prediction model, and a result set that meets the user-defined conditions is output as the behavior pattern prediction result.

4. The network log abnormal behavior analysis method based on the time series prediction model as claimed in claim 3 is characterized in that: When the behavior pattern prediction result is abnormal, the step of performing abnormal analysis on the time series data based on the abnormal knowledge base includes: Comparing the second information enhancement label set with the anomaly knowledge base to obtain multiple anomaly analysis results; Based on the judgment rules preset by the user, confidence judgment is performed on the multiple abnormal analysis results; When the confidence judgment result exceeds the preset threshold, an early warning message is output.

5. A network log abnormal behavior analysis system based on a time series prediction model, characterized in that: include: A data collection and processing module is used to collect network log data generated by user access behavior, and convert the network log data into time series data after preprocessing; A behavior pattern prediction module, used to generate a behavior pattern prediction result based on a pre-built time series prediction model and the time series data; The abnormality analysis module is used to perform abnormality analysis on the time series data based on the abnormality knowledge base when the behavior pattern prediction result is abnormal.

6. The network log abnormal behavior analysis system based on the time series prediction model as claimed in claim 5, characterized in that: The data acquisition and processing module comprises: A data collection unit, used to collect the network log data; A data preprocessing unit, used for normalizing, knowledge base matching and data enrichment of the network log data; The data conversion unit is used to convert the preprocessed network log data into the time series data.

7. The network log abnormal behavior analysis system based on the time series prediction model as claimed in claim 6, characterized in that: The behavior pattern prediction module comprises: A domain name analysis unit, configured to perform domain name analysis based on the time series data to define the nature of the user's access behavior and obtain a first information enhancement tag set; A text mining unit, used to perform text mining on the URLs in the time series data by using a string matching algorithm to obtain a second information enhancement tag set; A prediction unit is used to input the first information enhancement label set, the second information enhancement label set and the time series data into the time series prediction model, and output a result set that meets the user-defined conditions as the behavior pattern prediction result.

8. The network log abnormal behavior analysis method based on the time series prediction model as claimed in claim 7, characterized in that: The abnormality analysis module comprises: a comparison unit, configured to compare the second information enhancement label set with the anomaly knowledge base to obtain a plurality of anomaly analysis results; A confidence calculation unit, configured to make confidence judgments on the plurality of abnormal analysis results based on judgment rules preset by a user; The abnormal output unit is used to output warning information when the confidence judgment result exceeds a preset threshold.

9. A network log abnormal behavior analysis device based on a time series prediction model, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the network log abnormal behavior analysis method based on the time series prediction model as described in any one of claims 1 to 4 are implemented.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the network log abnormal behavior analysis method based on the time series prediction model described in any one of claims 1 to 4.

Images