Log classification model training and log classification methods, devices, products, and equipment

Abstract

The present application discloses log classification model training and log classification methods, devices, products, and equipment, including: obtaining log information training samples from a training sample set, wherein the log information training samples include log information text and classification label information corresponding to the log information text, and the log information text is a text that characterizes log rules; inputting the log information training samples into a preset network model for training to obtain a first text feature vector corresponding to the log information text, and based on the classification label information and the first text feature vector, guiding the preset network model to learn the association between the log information text and the classification label information to obtain a log classification model. In this way, the obtained log classification model can accurately classify logs and has generalization capabilities, which can improve the accuracy and generalization of log classification and reduce maintenance costs.

Description

Technical Field

[0001] The present application relates to the field of log processing technology, and in particular to log classification model training and log classification methods, devices, products, and equipment. Background Art

[0002] In order to process the logs efficiently later, the logs need to be classified first. At present, the common log classification scheme adopts the keyword rule method, but there are the following shortcomings: the traditional keyword matching method cannot truly understand the logs, resulting in classification errors and insufficient accuracy; the traditional keyword rules have the problem of non-generalization, which easily leads to missed classifications; the keyword rules need to be maintained frequently, and it is very likely that new keywords will need to be added for some new logs, which may also cause conflicts in the previous keyword classifications, resulting in high maintenance costs.

[0003] In summary, how to improve the accuracy and generalization of log classification and reduce maintenance costs are the problems that need to be solved at present. Summary of the invention

[0004] In view of this, the purpose of this application is to provide log classification model training and log classification methods, devices, products, and equipment, which can improve the accuracy and generalization of log classification and reduce maintenance costs. The specific plan is as follows:

[0005] In a first aspect, the present application discloses a log classification model training method, comprising:

[0006] Acquire a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule;

[0007] The log information training sample is input into a preset network model for training to obtain a first text feature vector corresponding to the log information text, and based on the classification label information and the first text feature vector, the preset network model is guided to learn the association between the log information text and the classification label information to obtain a log classification model.

[0008] Optionally, the classification label information includes classification label text and target label;

[0009] The classification label text is a label text of the same or different category as the log information text, and the target label represents whether the log information text and the classification label text corresponding to the log information text belong to the same category.

[0010] Optionally, the step of guiding the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model includes:

[0011] Based on the first text feature vector and the second text feature vector, the preset network model is guided to learn the similarity between the same type of log information text and the classification label text and the dissimilarity between different types of log information text and the classification label text to obtain a log classification model, wherein the second text feature vector is the extracted feature vector of the classification label text.

[0012] Optionally, the step of guiding the preset network model to learn similarities between similar log information texts and classification label texts and dissimilarity between different types of log information texts and classification label texts based on the first text feature vector and the second text feature vector to obtain a log classification model includes:

[0013] Calculating a training loss based on the first text feature vector and the second text feature vector, wherein the training loss includes a first loss and / or a second loss, the first loss is a loss calculated based on a predicted probability and the target label, the predicted probability is a probability of whether a log information text representing the similarity between a classification label text and an output based on the first text feature vector and the second text feature vector, and the second loss is a loss calculated based on a distance between the first text feature vector and the second text feature vector;

[0014] Update the preset network model based on the training loss;

[0015] When the training end condition is met, the currently updated preset network model is determined as the log classification model.

[0016] Optionally, also include:

[0017] Using a preset stop word list to remove stop words from the original log information text, the log information text is obtained to form a training sample set;

[0018] The preset stop word list includes high-frequency irrelevant words obtained by calculating the word frequency of the original log information text set, and the high-frequency irrelevant words are words irrelevant to log classification whose word frequency is greater than a preset threshold.

[0019] Optionally, also include:

[0020] If any type of log information text is less than the target number, the generation model is used to generate log information text of this type to reach the target number.

[0021] Optionally, the log rule is a rule determined based on attack means.

[0022] In a second aspect, the present application discloses a log classification method, comprising:

[0023] Get the log information text to be classified;

[0024] The log information text to be classified is input into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the aforementioned log classification model training method.

[0025] In a third aspect, the present application discloses a log classification model training device, comprising:

[0026] A sample acquisition module, used to acquire a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule;

[0027] The model training module is used to input the log information training sample into a preset network model for training, obtain a first text feature vector corresponding to the log information text, and guide the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model.

[0028] In a fourth aspect, the present application discloses a log classification device, comprising:

[0029] The acquisition module is used to obtain the log information text to be classified;

[0030] The classification module is used to input the log information text to be classified into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the aforementioned log classification model training method.

[0031] In a fifth aspect, the present application discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the aforementioned log classification model training method and / or the aforementioned log classification method.

[0032] In a sixth aspect, the present application discloses an electronic device, including a memory and a processor, wherein:

[0033] The memory is used to store the computer program;

[0034] The processor is used to execute the computer program to implement the aforementioned log classification model training method and / or the aforementioned log classification method.

[0035] In a seventh aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned log classification model training method and / or the aforementioned log classification method.

[0036] It can be seen from the above scheme that the present application provides a log classification model training method, including: obtaining log information training samples from a training sample set, wherein the log information training samples include log information text and classification label information corresponding to the log information text, and the log information text is a text that characterizes log rules; inputting the log information training samples into a preset network model for training to obtain a first text feature vector corresponding to the log information text, and based on the classification label information and the first text feature vector, guiding the preset network model to learn the association between the log information text and the classification label information to obtain a log classification model.

[0037] It can be seen that the beneficial effects of the present application are: using log information training samples to train the network model, using the deep feature representation of the log information text to guide the model to learn the association between the log information text and the classification label information, the log information text is the text that characterizes the log rules, so that the obtained log classification model can accurately classify the logs and has generalization capabilities, which can improve the accuracy and generalization of log classification and reduce maintenance costs.

[0038] Correspondingly, the log classification method, log classification model training device, log classification device, product, equipment and readable storage medium provided by this application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A flow chart of a log classification model training method provided in an embodiment of the present application;

[0041] Figure 2 A flow chart of a log classification method provided in an embodiment of the present application;

[0042] Figure 3 A log classification model training and log classification schematic diagram provided in an embodiment of the present application;

[0043] Figure 4 A sample example diagram provided for an embodiment of the present application;

[0044] Figure 5 A log classification model diagram provided for an embodiment of the present application

[0045] Figure 6 A schematic diagram of the structure of a log classification model training device provided in an embodiment of the present application;

[0046] Figure 7 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] At present, most log access understanding adopts keyword rules for classification. This method is relatively simple and low-cost, but it has the following shortcomings: low accuracy. The traditional keyword matching method cannot truly understand the log name, resulting in classification errors. For example, Lanling’s unauthorized arbitrary file upload vulnerability may be classified as unauthorized or uploaded. Vulnerability attack; low generalization. Traditional keyword rules themselves have the problem of no generalization, which easily leads to missed classification problems; high maintenance cost. Keyword rules need to be maintained frequently. In the face of some new logs, it is very likely that new keywords will need to be added. At the same time, the addition may also cause conflicts in previous keyword classification. To this end, the present application provides a log classification model training and log classification scheme, which can improve the accuracy and generalization of log classification and reduce maintenance costs.

[0049] See also Figure 1 As shown, the embodiment of the present application discloses a log classification model training method, including:

[0050] Step S11: obtaining a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule.

[0051] Among them, the log rule is a rule that reflects the log content. When the log is collected, if the corresponding log rule is hit, it will be recorded in the corresponding log file. The log rule can be used as the log name, or the log file can be described based on the log rule. That is, the log information text can be the log name, which is the log rule name, or the log description, which is the description based on the log rule.

[0052] In an optional implementation, the log rule is a rule determined based on attack means. That is, in the field of information security, the log rule can be determined based on the attack means, and when the rule is hit, a corresponding log is generated, and the log name is the log rule name, or the log description contains the log rule. The embodiment of the present application can classify the log based on the log name or log description.

[0053] In an optional implementation, a stop word removal operation can be performed on the original log information text using a preset stop word list to obtain log information text to form a training sample set; wherein the preset stop word list includes high-frequency irrelevant words obtained by calculating the word frequency of the original log information text set, and the high-frequency irrelevant words are words that are irrelevant to log classification and have a word frequency greater than a preset threshold. The original log information text set is a collection of collected original log information texts.

[0054] In an optional implementation, if the number of log information texts of any type is less than the target number, the generation model is used to generate log information texts of this type to reach the target number. In this way, sample skew can be avoided.

[0055] In an optional implementation, the classification label information of the log information text may be verified based on the big model. If the big model determines that the classification label information of the log information text is incorrect, manual verification is performed to ensure the quality of the label information.

[0056] Step S12: Input the log information training sample into a preset network model for training to obtain a first text feature vector corresponding to the log information text, and guide the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model.

[0057] In an optional embodiment, the classification label information includes a classification label text and a target label; wherein the classification label text is a label text of the same or different class as the log information text, and the target label indicates whether the log information text and the classification label text corresponding to the log information text belong to the same class. That is, the training sample set includes log information training samples of the same class as the log information text and the classification label text and log information training samples of different class as the log information text and the classification label text. The target label can be represented by a preset numerical value, for example, if the log information text and the classification label text corresponding to the log information text belong to the same class, the target label is 1, and if they do not belong to the same class, the target label is 0. For example, the log information text is: sql injection attack, the classification label text is: injection using Sql, and the target label is 1. Accordingly, the preset network model can be guided to learn the similarity between the same class of log information text and the classification label text and the dissimilarity between the different class of log information text and the classification label text based on the first text feature vector and the second text feature vector to obtain a log classification model, wherein the second text feature vector is the extracted feature vector of the classification label text.

[0058] Further, the embodiment of the present application can calculate the training loss based on the first text feature vector and the second text feature vector, wherein the training loss includes the first loss and / or the second loss, the first loss is the loss calculated based on the predicted probability and the target label, the predicted probability is the probability of whether the log information text is similar to the classification label text based on the output of the first text feature vector and the second text feature vector, and the second loss is the loss calculated based on the distance between the first text feature vector and the second text feature vector; based on the training loss, the preset network model is updated; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The model can output the predicted probability through the softmax layer.

[0059] That is, in an optional embodiment, the first text feature vector and the second text feature vector are used to guide the preset network model to learn the similarity between the same type of log information text and the classification label text and the dissimilarity between the different types of log information text and the classification label text to obtain a log classification model, including: outputting a prediction probability based on the first text feature vector and the second text feature vector, the prediction probability being the probability of characterizing whether the log information text is similar to the classification label text; calculating a first loss based on the prediction probability and the target label; calculating a second loss based on the distance between the first text feature vector and the second text feature vector; calculating a comprehensive loss using the first loss and the second loss; updating the preset network model based on the comprehensive loss; and when the training end condition is met, determining the currently updated preset network model as the log classification model. The prediction probability may include similar probabilities and dissimilar probabilities. For example, the first loss may be calculated using a cross entropy loss function. The distance between the first text feature vector and the second text feature vector can be a cosine distance, a Euclidean distance, etc. The second loss can use a preset loss function, which makes the distance between the similar first text feature vector and the second text feature vector closer and closer, and the distance between the dissimilar first text feature vector and the second text feature vector farther and farther, for example, it can be a comparison loss. The training end condition can be that the model converges or the number of iterations reaches a preset number threshold. The model structure can include an embedding layer, a Transformer layer, a fully connected layer, and a Softmax layer. The classification label text is spliced ​​with the log information text. After the embedding vector is extracted by the embedding layer, the first text feature vector and the second text feature vector are obtained through the Transformer layer. The fully connected layer maps its input first text feature vector and the second text feature vector to two categories, and then calculates the probability of each category through the Softmax function. The two categories are similar and dissimilar, respectively. Optionally, a Dropout layer can be set before the fully connected layer, and the dropout rate can be set.

[0060] In another optional embodiment, the method of guiding the preset network model to learn the similarity between the same type of log information text and classification label text and the dissimilarity between different types of log information text and classification label text based on the first text feature vector and the second text feature vector to obtain a log classification model includes: calculating a second loss as a training loss based on the distance between the first text feature vector and the second text feature vector; updating the preset network model using the training loss; and determining the currently updated preset network model as the log classification model when the training end condition is met. The distance between the first text feature vector and the second text feature vector can be a cosine distance, a Euclidean distance, etc. The second loss can use a preset loss function, which makes the distance between similar first text feature vectors and second text feature vectors closer and closer, and the distance between dissimilar first text feature vectors and second text feature vectors farther and farther, for example, it can be a comparison loss.

[0061] In another optional embodiment, the first text feature vector and the second text feature vector are used to guide the preset network model to learn the similarity between the same type of log information text and the classification label text and the dissimilarity between different types of log information text and the classification label text to obtain a log classification model, including: outputting a prediction probability based on the first text feature vector and the second text feature vector, the prediction probability being a probability that characterizes whether the log information text is similar to the classification label text; calculating a first loss as a training loss based on the prediction probability and the target label; updating the preset network model based on the training loss; and when the training end condition is met, determining the currently updated preset network model as the log classification model.

[0062] In another optional embodiment, the log information training samples in the training sample set are all training samples of the same type of log information text and classification label text. The preset network model can be guided to learn the similarity between the same type of log information text and classification label text based on the first text feature vector and the second text feature vector to obtain a log classification model. The training loss can be calculated based on the first text feature vector and the second text feature vector, wherein the training loss includes a first loss and / or a second loss, the first loss is a loss calculated based on the predicted probability and the target label, the predicted probability is a probability of whether the log information text and the classification label text are similar based on the output of the first text feature vector and the second text feature vector, and the second loss is a loss calculated based on the distance between the first text feature vector and the second text feature vector; the preset network model is updated based on the training loss; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The model can output the predicted probability through the softmax layer. The second loss minimizes the distance between the first text feature vector and the second text feature vector.

[0063] In another optional implementation, the classification label information is a category characterization value corresponding to the log information text, for example, it can be a hot single code, other categories are 0, the corresponding category is 1, or a category number, that is, the number in the total category.

[0064] Correspondingly, based on the classification label information and the first text feature vector, the preset network model is guided to learn the association between the log information text and the classification label information to obtain a log classification model, including: calculating the training loss based on the first text feature vector and the classification label information, and updating the preset network model based on the training loss; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The training loss can be calculated using a cross entropy loss function.

[0065] It can be seen that the embodiment of the present application uses log information training samples to train the network model, and uses the deep feature representation of the log information text to guide the model to learn the association between the log information text and the classification label information. The log information text is the text that characterizes the log rules. In this way, the obtained log classification model can accurately classify the logs and has generalization capabilities, which can improve the accuracy and generalization of log classification and reduce maintenance costs.

[0066] For further information, see Figure 2 As shown, the embodiment of the present application discloses a log classification method, including:

[0067] Step S21: Obtain the log information text to be classified.

[0068] The log information text to be classified is text representing the log rule, and the log information text may be a log name, that is, a log rule name, or a log description, that is, a description based on the log rule.

[0069] Step S22: inputting the log information text to be classified into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the log classification model training method disclosed in the above embodiment.

[0070] In an optional embodiment, the classification label information includes classification label text and target label, and the log classification model training process is: calculating the training loss based on the first text feature vector and the second text feature vector, wherein the training loss is the first loss or the first loss and the second loss, the first loss is the loss calculated based on the predicted probability and the target label, the predicted probability is the probability of whether the log information text and the classification label text are similar based on the output of the first text feature vector and the second text feature vector, and the second loss is the loss calculated based on the distance between the first text feature vector and the second text feature vector; updating the preset network model based on the training loss; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The log information text to be classified can be combined with each classification label text in the classification label text set respectively, input into the log classification model, predict the similarity probability, and when the maximum similarity probability is greater than the preset probability threshold, the classification label text corresponding to the maximum similarity probability is determined as the category of the log information text to be classified.

[0071] In an optional embodiment, the classification label information used for training includes classification label text and target label, and the log classification model training process is: based on the first text feature vector and the second text feature vector, the training loss is calculated, wherein the training loss is the second loss, and the preset network model is updated based on the training loss; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The log information text to be classified can be combined with each classification label text in the classification label text set respectively, and input into the log classification model to obtain the feature vectors corresponding to the log information text to be classified and the classification label text, and the similarity between the vectors, such as the distance, is calculated. When the most similar classification label text meets the preset condition, the most similar classification label text is determined as the category of the log information text to be classified. The preset condition can be that the distance is less than a preset distance threshold.

[0072] In an optional implementation, the classification label information used for training is the category representation value corresponding to the log information text, and the training process includes: calculating the training loss based on the first text feature vector and the classification label information, and updating the preset network model based on the training loss; when the training end condition is met, the currently updated preset network model is determined as the log classification model. The training loss can be calculated using the cross entropy loss function. The log information text to be classified can be input into the log classification model to obtain the classification result output by the model.

[0073] Below, taking security logs as an example, the log classification model training and log classification scheme provided by this application are further explained. Third-party logs are connected to SIEM (Security Information and Event Management), NGSOC (Next Generation Security Operation Center), XDR (Extended Detection and When using platforms such as XDR (Extended Detection and Response), it is necessary to understand and classify logs, and then perform subsequent aggregation (for example, how to aggregate alarms between multi-source logs, such as security device A and security device B both alarm that host C has been subjected to SQL injection. When security devices A and B are connected to platforms such as XDR, they need to be aggregated into one alarm, otherwise repeated alarms will be issued), empowerment (empowerment can include many aspects, such as attack result analysis. The third-party log reports a command execution alarm, but the attack result is unknown. At this time, the attack success analysis engine of platforms such as XDR can further analyze the attack result of the alarm), etc. However, in most cases, the third-party log does not provide a classification field, but only a log name or description field (the log name refers to the name of the third-party log. For example, an interception log reported by the firewall will contain a log name, such as "SQL injection attack". The description field refers to the description of the third-party log, such as: "A blind injection type SQL injection attack"). This requires the third-party log to be understood and classified based on the log name or description. The embodiment of the present application can automatically understand and classify the third-party log name / description. For example, if the third-party log rule name is "select sql injection attack", it will be automatically identified and classified into the sql injection category. Figure 3 As shown, Figure 3 A log classification model training and log classification schematic diagram provided in an embodiment of the present application.

[0074] First, we collect samples. We need to collect more positive samples to provide to the BERT model for learning and training. The sample collection is established by semi-automatic + manual correction. Semi-automatic means that the unknown log names are classified by traditional keywords, and then the wrong classifications are corrected by manual correction to ensure the quality of the samples. In the sample selection process, we need to consider the sample skew problem (too many samples in some categories, too few samples in some categories). In the classification samples, we need to solve the problem of sample skew caused by too few samples in some categories. We use a large model to generate similar data. For example, if there are few samples in the Java code injection category, we can design a large model prompt (i.e., prompt) as "What are the names of log rules related to Java code injection?" The examples of large model generation are as follows: general JAVA code injection, JAVA command injection, JAVA code execution, JAVA code injection attack, etc.

[0075] In this way, the existing sample skew problem is solved by using the large model sample generation method. Currently, each category has 50 samples. Secondly, in order to ensure the quality of sample labeling, the labeled samples are calibrated using the large model automatic verification + manual confirmation calibration method. Here, the sample data of the 233 classification labels are verified by the large model. The prompt is designed to be "Can the XXX rule name be classified into the XXX classification label?" After a round of automatic verification, the parts that the large model believes are wrong are manually verified. See Figure 4 , Figure 4 This is a sample example diagram.

[0076] See also Figure 5 As shown, Figure 5 A schematic diagram of a log classification model provided in an embodiment of the present application.

[0077] Tokenization: The input text is first tokenized into a series of tokens, such as "CLS", "Tok 1", "Tok 2", etc. "CLS" is a special token used for classification tasks, while "SEP" is used to separate different text sequences.

[0078] Embedding: Each token is converted into an embedding vector. This includes token embeddings, position embeddings, and segment embeddings. Token embeddings represent the semantic information of each word, position embeddings represent the position of the word in the sentence, and segment embeddings are used to distinguish different sentences.

[0079] Transformer Layers: The BERT model consists of multiple Transformer layers that process the input embedding vectors through self-attention mechanisms and feed-forward neural networks. The figure shows two Transformer layers, but the actual BERT model may contain more layers.

[0080] Output Layer: The output of the Transformer layer is fed into the output layer. In the figure, the output layer consists of a fully connected layer (Dense Layer) followed by a Dropout layer to prevent overfitting.

[0081] Dense Layer + Softmax (Fully Connected Layer + Softmax): The fully connected layer maps the features to two categories, and then calculates the probability of each category through the Softmax function. In the figure, 0.08 and 0.92 represent the probabilities of the two categories respectively.

[0082] Dropout: Before the fully connected layer, there is a Dropout layer with a dropout rate of 0.1. Dropout is a regularization technique that prevents the model from overfitting by randomly dropping a portion of neurons.

[0083] Probability output: Ultimately, the model outputs two probability values, representing the likelihood that the input text pair belongs to the “similar” or “dissimilar” category.

[0084] Figure 5 It shows how to process text data through multiple layers of Transformers based on the BERT (Bidirectional Encoder Representations from Transformer) model, and finally use it for the binary classification task of text similarity. The BERT model is a pre-trained language representation model, which emphasizes that it no longer uses the traditional unidirectional language model or the shallow concatenation of two unidirectional language models for pre-training as in the past, but uses the new MLM (masked language model) to generate deep bidirectional language representation. The power of the BERT model lies in its bidirectional context understanding ability, which makes it perform well in various natural language processing tasks.

[0085] In the embodiment of the present application, data preprocessing can be performed, including preprocessing stop words: Since the names of third-party logs vary, there may be many irrelevant words that affect classification. For example, "injection attack through sql", "through" and "conducted" are irrelevant words and similar stop words need to be removed. The word frequency is calculated through a large number of third-party log names (all third-party logs are combined into a long string to count the word frequency, and the highest frequency words are extracted). The high-frequency irrelevant words + common stop words are combined into a stop word list. When the third-party log is input, the stop word removal operation is first performed. Further, tokenization is performed. Tokenization process: For example, if you need to calculate the similarity of the following names: sql injection attack and injection using Sql, tokenize the text and split it into word arrays: [sql injection attack], [injection using Sql], and then concatenate the two sentences as follows: [CLS] sql injection attack [SEP] injection using Sql [SEP], [CLS] in the concatenated sentence is a special delimiter indicating the beginning of each sample, and [SEP] is the end marker of each sentence in the sample. Further, use Bert's Embedding (embedding layer) for vectorization.

[0086] Bert model pre-training & fine-tuning process: The ultimate goal is to complete the classification task, such as classifying the third-party log name to be classified into the target classification list. However, as an unsupervised model, Bert is not suitable for direct classification tasks. The embodiment of the present application classifies the third-party log name to be classified by traversing and calculating the semantic similarity with the target classification label, and calculates the most similarity value between the name to be classified and the target classification label. If this similarity value is greater than 0.8, it is considered that the name to be classified belongs to the corresponding target classification label. For example, if the similarity between the sql injection attack (third-party name to be classified) and the injection using Sql (target classification label) is as high as 0.9, it is considered that the sql injection attack belongs to the "injection using Sql" category. The final model effect is similar to a multi-classification model. The pre-training & fine-tuning process is to train a large amount of known labeled data, such as:

[0087] [CLS] SQL injection attack [SEP] Injection using SQL [SEP]

[0088] [CLS] Linux command injection attack [SEP] Command injection attack [SEP]

[0089] [CLS] Windows Command Injection Attack [SEP] Command Injection Attack [SEP]

[0090] [CLS] PHP code injection attack [SEP] PHP code injection [SEP] ............

[0092] In the above example, we use the same type of labels. We can also add different labels. After processing a pair of sentences using the Bert pre-trained model, we will get the final representations of the two sentences. In order to reduce the risk of the model overfitting the data, a Dropout ratio of 0.1 is applied to these representations. After Dropout processing, these representations are passed to a fully connected network layer, and the output size of this layer is set to 2.

[0093] Model prediction: Through the operation of the softmax function, we can get the predicted probability that the two sentences are similar or dissimilar.

[0094] In this embodiment, when the model is applied, the semantic similarity between the classification rule name and each classification label can be directly calculated, and the classification label with the highest similarity is used as the classification result (the similarity must also be greater than 0.8). The similarity can be the similarity probability output by the model.

[0095] In this way, third-party logs are classified through a more generalized AI (artificial intelligence) model. Using the Bert model as the basic model to train a model for automatic classification of third-party logs, specific data preprocessing and training fine-tuning can be performed based on the Bert model so that the classification model can automatically classify third-party logs more accurately. The biggest role of the Bert model is to convert the name of the third-party log into a word vector, and then connect it to softmax for classification. It realizes the automatic classification of third-party logs, and then aggregates and empowers third-party logs.

[0096] For further information, see Figure 6 As shown, a log classification model training device includes:

[0097] The sample acquisition module 11 is used to acquire a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule;

[0098] The model training module 12 is used to input the log information training sample into the preset network model for training, obtain the first text feature vector corresponding to the log information text, and guide the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model.

[0099] In an optional embodiment, the classification label information includes classification label text and a target label; wherein the classification label text is a label text of the same or different category as the log information text, and the target label represents whether the log information text and the classification label text corresponding to the log information text belong to the same category.

[0100] In an optional implementation, the model training module 12 may be used to:

[0101] Based on the first text feature vector and the second text feature vector, the preset network model is guided to learn the similarity between the same type of log information text and the classification label text and the dissimilarity between different types of log information text and the classification label text to obtain a log classification model, wherein the second text feature vector is the extracted feature vector of the classification label text.

[0102] In an optional implementation, the model training module 12 may be used to:

[0103] Calculating a training loss based on the first text feature vector and the second text feature vector, wherein the training loss includes a first loss and / or a second loss, the first loss is a loss calculated based on a predicted probability and the target label, the predicted probability is a probability of whether a log information text representing the similarity between a classification label text and an output based on the first text feature vector and the second text feature vector, and the second loss is a loss calculated based on a distance between the first text feature vector and the second text feature vector;

[0104] Update the preset network model based on the training loss;

[0105] When the training end condition is met, the currently updated preset network model is determined as the log classification model

[0106] In an optional implementation, the device may further include a stop word processing module, configured to:

[0107] Using a preset stop word list to remove stop words from the original log information text, the log information text is obtained to form a training sample set;

[0108] The preset stop word list includes high-frequency irrelevant words obtained by calculating the word frequency of the original log information text set, and the high-frequency irrelevant words are words irrelevant to log classification whose word frequency is greater than a preset threshold.

[0109] In an optional implementation, the device may also include a sample generation module, which is used to:

[0110] If any type of log information text is less than the target number, the generation model is used to generate log information text of this type to reach the target number.

[0111] In an optional implementation, the log rule is a rule determined based on attack means.

[0112] It can be seen that the embodiment of the present application uses log information training samples to train the network model, and uses the deep feature representation of the log information text to guide the model to learn the association between the log information text and the classification label information. The log information text is the text that characterizes the log rules. In this way, the obtained log classification model can accurately classify the logs and has generalization capabilities, which can improve the accuracy and generalization of log classification and reduce maintenance costs.

[0113] Furthermore, the embodiment of the present application discloses a log classification device, including:

[0114] The acquisition module is used to obtain the log information text to be classified;

[0115] The classification module is used to input the log information text to be classified into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the log classification model training method disclosed in the above embodiment.

[0116] An embodiment of the present application discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the log classification model training method disclosed in the aforementioned embodiment, and / or the log classification method disclosed in the aforementioned embodiment.

[0117] For the specific process of the above-mentioned log classification model training method and log classification method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0118] See also Figure 7 As shown, an embodiment of the present application discloses an electronic device 20, including a processor 21 and a memory 22; wherein the memory 22 is used to store a computer program; the processor 21 is used to execute the computer program to implement the log classification model training method disclosed in the aforementioned embodiment, and / or the log classification method disclosed in the aforementioned embodiment.

[0119] For the specific process of the above-mentioned log classification model training method and log classification method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0120] Furthermore, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the storage method may be temporary storage or permanent storage.

[0121] In addition, the electronic device 20 also includes a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26; wherein the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and an external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input / output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0122] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the log classification model training method disclosed in the aforementioned embodiment and / or the log classification method disclosed in the aforementioned embodiment is implemented.

[0123] For the specific process of the above-mentioned log classification model training method and log classification method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0124] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0125] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0126] The above is a detailed introduction to the log classification model training and log classification methods, devices, products, and equipment provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A log classification model training method, characterized in that: include: Acquire a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule; The log information training sample is input into a preset network model for training to obtain a first text feature vector corresponding to the log information text, and based on the classification label information and the first text feature vector, the preset network model is guided to learn the association between the log information text and the classification label information to obtain a log classification model.

2. The log classification model training method according to claim 1, characterized in that: The classification label information includes classification label text and target label; The classification label text is a label text of the same or different category as the log information text, and the target label represents whether the log information text and the classification label text corresponding to the log information text belong to the same category.

3. The log classification model training method according to claim 2, characterized in that: The step of guiding the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model includes: Based on the first text feature vector and the second text feature vector, the preset network model is guided to learn the similarity between the same type of log information text and the classification label text and the dissimilarity between different types of log information text and the classification label text to obtain a log classification model, wherein the second text feature vector is the extracted feature vector of the classification label text.

4. The log classification model training method according to claim 1, characterized in that: Also includes: Using a preset stop word list to remove stop words from the original log information text, the log information text is obtained to form a training sample set; The preset stop word list includes high-frequency irrelevant words obtained by calculating the word frequency of the original log information text set, and the high-frequency irrelevant words are words irrelevant to log classification whose word frequency is greater than a preset threshold.

5. A log classification method, characterized in that: include: Get the log information text to be classified; The log information text to be classified is input into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the log classification model training method according to any one of claims 1 to 4.

6. A log classification model training device, characterized in that: include: A sample acquisition module, used to acquire a log information training sample from a training sample set, wherein the log information training sample includes a log information text and classification label information corresponding to the log information text, and the log information text is a text representing a log rule; The model training module is used to input the log information training sample into a preset network model for training, obtain a first text feature vector corresponding to the log information text, and guide the preset network model to learn the association between the log information text and the classification label information based on the classification label information and the first text feature vector to obtain a log classification model.

7. A log classification device, characterized in that: include: The acquisition module is used to obtain the log information text to be classified; A classification module is used to input the log information text to be classified into a log classification model to obtain a log classification result corresponding to the log information text to be classified, wherein the log classification model is trained by the log classification model training method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the log classification model training method as described in any one of claims 1 to 4 and / or the log classification method as described in claim 5 are implemented.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is used to execute the computer program to implement the log classification model training method as described in any one of claims 1 to 4, and / or the log classification method as described in claim 5.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the log classification model training method according to any one of claims 1 to 4 and / or the log classification method according to claim 5 is implemented.

Images