A method, device, equipment and medium for checking abnormal events
By setting up multiple audit rules and behavior data for preset exception events, determining the target historical event behavior and generating target events, the existing audit methods are solved, and more efficient and accurate audit of abnormal events is achieved.
Patent Information
- Application Number
- CN202411841974.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-13
- Publication Date
- 2025-04-04
AI Technical Summary
The existing audit methods are inefficient and have low accuracy in finding abnormal events, making it difficult to effectively detect and troubleshoot abnormal events.
By obtaining multiple audit rules set for multiple exception event behaviors of preset exception events, based on these rules and behavior data of historical event behavior, the target historical event behavior is determined and the target event is generated, and the abnormal events in the target event set are finally determined according to the behavior timing.
It improves the efficiency and accuracy of abnormal event auditing, and can accurately determine abnormal events that meet the behavior timing from the target event.
Smart Images
Figure CN119760601A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of abnormality detection, and in particular to an abnormal event audit method, device, equipment and medium. Background Art
[0002] Internal data audit is a series of rules and procedures that enterprises carry out to ensure the accuracy, completeness and reliability of data. Its core purpose is to ensure the credibility of data and support correct decision-making and business operations. Through audit, enterprises can timely discover and correct data problems, prevent data risks and improve work efficiency.
[0003] Furthermore, the current audit method is mainly based on historical logs and manual investigation, but the current method is inefficient and has low accuracy in detecting abnormal events. Summary of the invention
[0004] The present invention provides a method, device, equipment and medium for auditing abnormal events. The technical solutions of the embodiments of the present invention can improve the efficiency and accuracy of the auditing of abnormal events.
[0005] In a first aspect, an embodiment of the present invention provides a method for checking abnormal events, comprising:
[0006] Acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior time sequences in the preset abnormal event;
[0007] Determine a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and generate a target event according to the target historical event behavior, wherein the behavior data is data related to the historical event behavior;
[0008] According to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set, the abnormal event in the target event set is determined.
[0009] In a second aspect, an embodiment of the present invention provides an abnormal event audit device, including:
[0010] An acquisition module, used to acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior timings in the preset abnormal event;
[0011] A target event generation module, used to determine a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and to generate a target event according to the target historical event behavior, wherein the behavior data is data related to the historical event behavior;
[0012] The abnormal event determination module is used to determine the abnormal events in the target event set according to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set.
[0013] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:
[0014] at least one processor; and,
[0015] a memory communicatively connected to the at least one processor; wherein,
[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for auditing abnormal events described in any one of the embodiments of the present invention.
[0017] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for investigating abnormal events described in any one of the embodiments of the present invention when executed.
[0018] The embodiments of the present invention provide a method, device, equipment and medium for auditing abnormal events, the method comprising: obtaining multiple audit rules established for multiple abnormal event behaviors of preset abnormal events, wherein different abnormal event behaviors have different behavioral timings in the preset abnormal events; determining target historical event behaviors according to the multiple audit rules and the behavioral data of historical event behaviors, and generating target events according to the target historical event behaviors, wherein the behavioral data are data related to the historical event behaviors; determining abnormal events in the target event set according to the behavioral timing and the behavioral data of the target historical event behaviors of the target events in the target event set. Specifically, by using the behavioral timing and the behavioral data of the target historical event behaviors of the target events in the target event set, abnormal events that meet the behavioral timing can be accurately determined from the target events. Through the technical solution of the embodiments of the present invention, the efficiency and accuracy of abnormal event audits can be improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0020] Figure 1A flowchart of an abnormal event audit method provided in Example 1 of the present invention;
[0021] Figure 2 A flowchart of a method for checking abnormal events provided in Embodiment 2 of the present invention;
[0022] Figure 3 A schematic diagram of the structure of an abnormal event inspection device provided in Embodiment 3 of the present invention;
[0023] Figure 4 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION
[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0026] It should be noted that the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the technical solution of the present disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0027] Embodiment 1
[0028] Figure 1 A flowchart of an abnormal event audit method provided in Example 1 of the present invention. The method can be applicable to the investigation of abnormal events within an enterprise. The method can be executed by an abnormal event audit device, which can be executed by software and / or hardware and configured in a computer or server.
[0029] Step 110: Acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior timings in the preset abnormal event.
[0030] Among them, the preset abnormal event is an event preset by the user that has security risks. Furthermore, the preset abnormal event may be composed of multiple abnormal event behaviors, such as security intrusion events, which may include login, retrieval and download behaviors. Furthermore, the audit rule is a rule set for abnormal event behaviors. Through the audit rule, it can be determined whether the abnormal event behavior is illegal. It can be understood that for a complete event, the event behavior will have some execution order, that is, the behavior sequence.
[0031] Step 120: determine a target historical event behavior based on the multiple audit rules and the behavior data of the historical event behavior, and generate a target event based on the target historical event behavior, wherein the behavior data is data related to the historical event behavior.
[0032] Among them, historical event behaviors can be determined from historical logs, and behavior data can be specific features of historical event behaviors, such as the user who performed the behavior, the action performed, and the time of execution, etc., and can also include specific operation records. The target historical event behavior is the historical event behavior that hits the audit rule. Furthermore, historical event behaviors can be abnormal event behaviors or non-abnormal event behaviors. For abnormal event behaviors, it is necessary to further confirm whether they are hit by the audit rules.
[0033] For example, if the abnormal event behavior is downloading, the download behavior must first be screened through historical logs. Furthermore, the download behavior itself may involve different types, and then the download behavior can be further judged according to the audit rules to confirm whether it is a violation.
[0034] Optionally, determine the audit time range of this audit task, and determine the historical event behavior based on the audit time range.
[0035] Specifically, an audit time range may be preset to conduct audits of corresponding historical events and behaviors.
[0036] Optionally, the behavior data includes a user identifier, and step 120 includes:
[0037] Determine the historical event behavior of the target user according to the user identifier of the historical event behavior;
[0038] If the historical event behavior of the target user is the abnormal event behavior, and the historical event behavior hits the audit rule corresponding to the abnormal event behavior, the historical event behavior of the target user is determined as the target historical event behavior, and a target event is generated according to the target historical event behavior.
[0039] Specifically, the historical event behaviors can be classified by user identification to determine the historical event behaviors of the target user. Furthermore, it is necessary to determine whether the historical event behaviors of the target user are abnormal event behaviors. If so, it is also necessary to determine whether the historical event behaviors of the target user hit the corresponding audit rules. If they hit, it means that the historical event behaviors of the target user are dangerous, so they are determined as target historical event behaviors.
[0040] It should be noted that the reason for classifying historical event behaviors according to user identification is that abnormal events are composed of multiple historical event behaviors. If the combined historical event behaviors belong to different users, it means that any user cannot actually complete the preset abnormal event and does not pose an actual threat.
[0041] Optionally, if the historical event behavior includes at least one target field corresponding to the audit rule, it is determined that the historical event behavior hits the audit rule, wherein the audit rule represents sub-rules connected by logical operators, and the sub-rules include target fields.
[0042] Specifically, if the field of the historical event behavior includes the target field, it means that the historical event behavior hits the sub-rule corresponding to the target field. Further, for the sub-rules connected with the AND operator, if the field of the historical event behavior hits all the sub-rules, it means that the historical event behavior hits the audit rule. For the sub-rules connected with the OR operator, if the field of the historical event behavior hits at least one of all the sub-rules, it means that the historical event behavior hits the audit rule.
[0043] Optionally, since the target historical event behavior has hit the audit rule, although the preset abnormal event has not been fully executed, it may still pose a security risk. Therefore, an alarm message for the user corresponding to the target historical event behavior may be generated.
[0044] Step 130: Determine abnormal events in the target event set based on the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set.
[0045] Specifically, the time of the target historical event behavior can be determined based on the behavior data. At the same time, for the completion of an abnormal event, multiple historical event behaviors need to be executed in a specific execution order. Therefore, if the order of occurrence of the target historical event behaviors of the target event in the target event set is chaotic, it means that the target event may not be actually executed.
[0046] An embodiment of the present invention provides an audit method for abnormal events, the method comprising: obtaining multiple audit rules established for multiple abnormal event behaviors of preset abnormal events, wherein different abnormal event behaviors have different behavioral timings in the preset abnormal events; determining a target historical event behavior according to the multiple audit rules and the behavioral data of historical event behaviors, and generating a target event according to the target historical event behavior, wherein the behavioral data is data related to the historical event behavior; determining abnormal events in a target event set according to the behavioral timing and the behavioral data of the target historical event behavior of the target event in the target event set. Specifically, by using the behavioral timing and the behavioral data of the target historical event behavior of the target event in the target event set, abnormal events that meet the behavioral timing can be accurately determined from the target event. Through the technical solution of the embodiment of the present invention, the efficiency and accuracy of abnormal event audits can be improved.
[0047] Embodiment 2
[0048] Figure 2 A flowchart of an abnormal event audit method provided in the second embodiment of the present invention, this embodiment specifically defines determining abnormal events in a target event set based on the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set.
[0049] like Figure 2 As shown, including:
[0050] Step 210: Acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior timings in the preset abnormal event.
[0051] Step 220: determine a target historical event behavior based on the multiple audit rules and the behavior data of the historical event behavior, and generate a target event based on the target historical event behavior, wherein the behavior data is data related to the historical event behavior.
[0052] Step 230: Determine the execution order according to the operation time of each target historical event behavior of the target event.
[0053] Step 240: If the execution sequence is consistent with the behavior sequence of the abnormal event behavior of the preset abnormal event, the target event is determined as an abnormal event.
[0054] The execution order can be determined by sorting the operation time of the target historical event behavior.
[0055] Specifically, if the execution order is consistent with the behavior timing of the abnormal event behavior of the preset abnormal event, it means that the target user has completed all steps of the preset abnormal event and the abnormal event has been executed. Therefore, the target event is an abnormal event and the user of the abnormal event needs to be alerted.
[0056] For example, the preset abnormal event is downloading confidential file A, then the abnormal event behavior includes login operation, search operation and download operation, and the audit rules are whether to log in to the database where A is located, whether to retrieve A's information, and whether to download A file. It is known that the target historical event behavior includes logging in to the database where A is located; retrieving A's information; downloading A file; however, the time of downloading A file is before logging in to the database where A is located, which means that these two may be independent events, but in the two independent events, some event behaviors trigger the audit rules due to errors, and for any of the two independent events, the preset abnormal event cannot be completed independently.
[0057] Optionally, after an abnormal event is determined, alarm information for a user corresponding to the abnormal event is generated.
[0058] Embodiment 3
[0059] Figure 3 This is a schematic diagram of the structure of an abnormal event inspection device provided by the third embodiment of the present invention. Figure 3 As shown, the device comprises:
[0060] The acquisition module 310 is used to acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior time sequences in the preset abnormal event;
[0061] The target event generation module 320 is used to determine the target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and generate the target event according to the target historical event behavior, wherein the behavior data is data related to the historical event behavior;
[0062] The abnormal event determination module 330 is used to determine the abnormal events in the target event set according to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set.
[0063] The embodiment of the present invention provides an audit device for abnormal events, which obtains multiple audit rules established for multiple abnormal event behaviors of preset abnormal events, wherein different abnormal event behaviors have different behavioral timings in the preset abnormal events; determines a target historical event behavior according to the multiple audit rules and the behavioral data of historical event behaviors, and generates a target event according to the target historical event behavior, wherein the behavioral data is data related to the historical event behavior; determines abnormal events in the target event set according to the behavioral timing and the behavioral data of the target historical event behavior of the target event in the target event set. Specifically, by using the behavioral timing and the behavioral data of the target historical event behavior of the target event in the target event set, abnormal events that meet the behavioral timing can be accurately determined from the target event. Through the technical solution of the embodiment of the present invention, the efficiency and accuracy of abnormal event audits can be improved.
[0064] Optionally, the behavior data includes a user identifier, and the target event generation module 320 includes:
[0065] A classification unit, used to determine the historical event behavior of a target user according to the user identifier of the historical event behavior;
[0066] The judgment unit is used to determine the historical event behavior of the target user as the target historical event behavior if the historical event behavior of the target user is the abnormal event behavior and the historical event behavior hits the audit rule corresponding to the abnormal event behavior, and generate a target event according to the target historical event behavior.
[0067] Optionally, the judgment unit is specifically used to: if the historical event behavior includes at least one target field corresponding to the audit rule, determine that the historical event behavior hits the audit rule, wherein the audit rule represents sub-rules connected by logical operators, and the sub-rules include target fields.
[0068] Optionally, the behavior data includes operation time, and the abnormal event determination module 330 includes:
[0069] An execution order determination unit, used to determine the execution order according to the operation time of each target historical event behavior of the target event;
[0070] A judging unit is configured to determine the target event as an abnormal event if the execution sequence is consistent with a behavior timing of an abnormal event behavior of the preset abnormal event.
[0071] Optionally, the device further comprises: an event determination module, used to determine the audit time range of the current audit task, and determine the historical event behavior according to the audit time range;
[0072] The first alarm module is used to generate alarm information for users corresponding to the abnormal event.
[0073] The second alarm module is used to generate alarm information for users corresponding to the target historical event behavior.
[0074] The abnormal event auditing device provided in the embodiment of the present invention can execute the abnormal event auditing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0075] Embodiment 4
[0076] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0077] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0078] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0079] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the audit method of abnormal events.
[0080] In some embodiments, the audit method for abnormal events can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the audit method for abnormal events described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the audit method for abnormal events by any other appropriate means (for example, by means of firmware).
[0081] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0082] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0083] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0084] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0085] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0086] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0087] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0088] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A method for checking abnormal events, characterized in that: include: Acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior time sequences in the preset abnormal event; Determine a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and generate a target event according to the target historical event behavior, wherein the behavior data is data related to the historical event behavior; According to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set, the abnormal event in the target event set is determined.
2. The method according to claim 1, characterized in that The behavioral data includes a user identifier; Determining a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and generating a target event according to the target historical event behavior, comprises: Determine the historical event behavior of the target user according to the user identifier of the historical event behavior; If the historical event behavior of the target user is the abnormal event behavior, and the historical event behavior hits the audit rule corresponding to the abnormal event behavior, the historical event behavior of the target user is determined as the target historical event behavior, and a target event is generated according to the target historical event behavior.
3. The method according to claim 2, characterized in that The historical event behavior hits the audit rules corresponding to the abnormal event behavior, including: If the historical event behavior includes at least one target field corresponding to the audit rule, it is determined that the historical event behavior hits the audit rule, wherein the audit rule represents sub-rules connected by logical operators, and the sub-rules include target fields.
4. The method according to claim 1, characterized in that: The behavior data includes operation time; Determining abnormal events in the target event set according to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set includes: Determine the execution order through the operation time of each target historical event behavior of the target event; If the execution sequence is consistent with the behavior timing of the abnormal event behavior of the preset abnormal event, the target event is determined as an abnormal event.
5. The method according to claim 1, characterized in that Before determining a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior and generating a target event according to the target historical event behavior, the method further includes: Determine the audit time range for this audit task, and determine the historical event behavior based on the audit time range.
6. The method according to claim 1, characterized in that After determining the abnormal event in the target event, the method further includes: Generate warning information for users corresponding to the abnormal event.
7. The method according to claim 1, characterized in that Also includes: Generate user warning information corresponding to the target historical event behavior.
8. An abnormal event audit device, characterized in that: include: An acquisition module, used to acquire multiple audit rules established for multiple abnormal event behaviors of a preset abnormal event, wherein different abnormal event behaviors have different behavior timings in the preset abnormal event; A target event generation module, used to determine a target historical event behavior according to the plurality of audit rules and the behavior data of the historical event behavior, and to generate a target event according to the target historical event behavior, wherein the behavior data is data related to the historical event behavior; The abnormal event determination module is used to determine the abnormal events in the target event set according to the behavior time sequence and the behavior data of the target historical event behavior of the target event in the target event set.
9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal event audit method described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal event audit method described in any one of claims 1 to 7 when executed.