A method and apparatus for collecting and analyzing system audit logs

Abstract

This invention discloses a method and apparatus for collecting and analyzing system audit logs, relating to the field of log collection and analysis technology. The method includes: defining each module in the system and the behavior performed by each module; when a user clicks a menu on the interface, triggering a corresponding event, intercepting the triggered event, obtaining object attributes related to the operation, and notifying the relevant business components of the obtained attribute information for further processing and recording; after receiving the attribute information of the operation object, the business component loads the audit log component; the audit log component processes the menu information and organizes it into a preset rule format, writing it into a log file; the log file is collected in real time, processed and cleaned to form structured data, which is then written into a data warehouse; correlation analysis is performed on the structured data in the data warehouse, and the analysis results are displayed intuitively. This invention is used for the real-time collection, storage, querying, and analysis of application system log data.

Description

Technical Field

[0001] This invention relates to the field of log collection and analysis technology, specifically a method and apparatus for collecting and analyzing system audit logs. Background Technology

[0002] With the rapid development of cloud computing technology and the deepening of e-government, the security, reliability, and compliance of e-government cloud, as a crucial infrastructure supporting government services and improving governance efficiency, have attracted significant attention. E-government cloud audit log technology has emerged to address this need, aiming to record operations and events within the e-government cloud environment, ensure information security, and provide a basis for compliance audits. Audit logs record all operations and events within the e-government cloud environment, including critical information such as user logins, resource configurations, and data access. These logs are of great importance for ensuring the secure and stable operation of the e-government cloud, monitoring abnormal behavior, tracing the source of security incidents, and meeting compliance requirements.

[0003] With the expansion of government cloud scale and the diversification of services, the generation, storage, and analysis of audit logs face enormous challenges. Because government cloud business systems have numerous modules, generating audit logs requires each module to call the log method module to write data to the table, resulting in bloated and difficult-to-maintain code. Simultaneously, frequent and large-scale user operations generate numerous logs daily, making traditional database tables insufficient for the needs of these business scenarios. Furthermore, for developers, business development often doesn't require concern with log writing, a function unrelated to business logic. Summary of the Invention

[0004] This invention addresses the needs and shortcomings of current technological development by providing a method and apparatus for collecting and analyzing system audit logs, enabling efficient and reliable real-time collection, storage, querying, and analysis of log data from large-scale application systems.

[0005] Firstly, the present invention provides a method for collecting and analyzing system audit logs, and the technical solution adopted to solve the above-mentioned technical problems is as follows:

[0006] A method for collecting and analyzing system audit logs, comprising the following steps:

[0007] S1. Define the various modules in the system and the behaviors performed by each module;

[0008] S2. When a user clicks a menu on the interface and triggers a corresponding event, the triggered event is intercepted, the object properties related to the operation are obtained, and the obtained property information is notified to the relevant business components for further processing and recording.

[0009] S3. After receiving the attribute information of the operation object, the business component loads the audit log component; the audit log component processes the menu information, then organizes the processed information into a preset rule format and writes it to the log file;

[0010] S4. Real-time collection of log files, processing and cleaning them to form structured data which is then written into the data warehouse;

[0011] S5. Use data analysis tools and techniques to perform correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0012] Optionally, the modules involved refer to relatively independent functional units or components in the system. The modules work together to achieve the overall function of the system. When defining the modules in the system, first divide the system into multiple functional modules according to business logic, or divide the system into multiple component modules according to technical implementation, and then clarify the functions and responsibilities of each module.

[0013] Behavior refers to the operation or activity that occurs within or between modules. When defining the behavior performed by each module, first identify the pre-specified behaviors in each module, then describe each behavior in detail, including the triggering conditions, execution process, expected results and possible abnormal situations, and finally assess the risk of each behavior.

[0014] Optionally, step S2 specifically includes:

[0015] S2.1 Define the interception logic: Using the concept of Spring AOP, write an aspect according to the actual business needs. The aspect includes three types of advice: before, after, and around, which are used to handle the interception and collection logic when the user clicks the menu event.

[0016] S2.2 Create a custom annotation: Define an annotation named @OperateAuditLogAction, which is used to mark the methods that need to be intercepted;

[0017] S2.3 Apply annotations to controller methods: In the Spring MVC architecture, find the controller method that handles menu click events and add the @OperateAuditLogAction annotation to that method;

[0018] S2.4 Configuring Aspects: Configure aspects in the Spring configuration file to make them effective, ensuring that aspects can recognize and process methods annotated with @OperateAuditLogAction;

[0019] S2.5 Implement Aspect Logic: Implement specific interception logic in the aspect, including obtaining object properties related to the operation and notifying the relevant business components of the obtained property information for further processing and recording; the execution order will vary depending on the set notification type.

[0020] Optionally, the audit log component processes the menu information, then organizes the processed information into a preset rule format and writes it to a log file. This process includes:

[0021] S3.1 Defining Aspects and Pointcuts: Leveraging the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0022] S3.2 Define Around Advice: In the aspect class, use the @Around annotation to define an around advice method. This method will process the menu information before and after the target method is executed.

[0023] S3.3 Obtaining Request Parameters: In the around advice method, obtain relevant request information through method parameters and process the obtained information.

[0024] S3.4, Write global storage values ​​to the log: Use MDC global storage to process relevant information;

[0025] S3.5 Configuring the Logback framework: Specify the log output path and set variable templates through the logback.xml configuration file, so that the processed information is recorded in the specified log file according to preset rules;

[0026] S3.6 Message segmentation: Use the "@|@" symbol to segment log messages and pass in the relevant information to facilitate subsequent log collection, processing and cleaning;

[0027] S3.7 Output to a specified path: Through Logback configuration, the processed log information is output to a specified file path.

[0028] Optionally, step S5 is performed to conduct correlation analysis on the structured data in the data warehouse. This involves mining the relationships and patterns between data to discover potential problems, anomalies, or trends. Subsequently, the analyzed data is rendered using the ECharts plugin to create reports that are displayed to the client.

[0029] Secondly, the present invention provides a system audit log collection and analysis device, and the technical solution adopted to solve the above-mentioned technical problems is as follows:

[0030] A system audit log collection and analysis device, comprising:

[0031] The system definition module is used to define the various modules in the system and the behaviors performed by each module;

[0032] The event interception and handling module is used to monitor user menu click events on the interface, and first intercepts the menu click event when it occurs. Then, it obtains the object properties related to the operation and notifies the relevant business components of the obtained property information for further processing and recording.

[0033] The receiving and loading module is used to receive the attribute information of the operation object from the business component and load the audit log component;

[0034] The audit log processing module is used to process the received information using the audit log component, and then organize the processed information into a preset rule format and write it to the log file.

[0035] The log data processing module is used to collect log files in real time, process and clean them to form structured data, and write it into the data warehouse.

[0036] The data analysis and visualization module is used to perform correlation analysis on the structured data in the data warehouse using data analysis tools and techniques, and to intuitively display the analysis results.

[0037] Optionally, the system definition module defines each module in the system and the behavior performed by each module. Here, a module refers to a relatively independent functional unit or component in the system. The modules work together to achieve the overall function of the system, and the behavior refers to the operation or activity that occurs within or between modules.

[0038] When defining the modules in a system, first divide the system into multiple functional modules according to business logic, or into multiple component modules according to technical implementation, and then clarify the functions and responsibilities of each module.

[0039] When defining the behavior to be performed by each module, the system definition module first identifies the pre-specified behaviors in each module, then describes each behavior in detail, including the triggering conditions, execution process, expected results and possible abnormal situations, and finally assesses the risk of each behavior.

[0040] Optionally, the event interception and handling modules involved include:

[0041] Define an interception unit and, using the Spring AOP concept, write an aspect based on actual business needs. The aspect includes three notification types: before, after, and around, which are used to handle the interception and collection logic when the user clicks the menu event.

[0042] Define an annotation unit to define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0043] The annotation application unit is used to find the controller method that handles menu click events in the Spring MVC architecture and add the @OperateAuditLogAction annotation to that method;

[0044] Configure the aspect unit, which is used to configure aspects in the Spring configuration file to make them effective, ensuring that aspects can recognize and process methods annotated with @OperateAuditLogAction;

[0045] The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object properties related to the operation and notifying the relevant business components of the obtained property information for further processing and recording; the execution order will vary depending on the set notification type.

[0046] Optionally, the audit log processing module uses the audit log component to process the received information, then organizes the processed information into a preset rule format and writes it to a log file. This process includes:

[0047] Leveraging the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods should be intercepted;

[0048] In the aspect class, an around advice method is defined using the @Around annotation. This method will process the menu information before and after the target method is executed.

[0049] In the around notification method, relevant information about the request is obtained through method parameters, and the obtained information is then processed.

[0050] Use MDC to globally store the relevant information after processing;

[0051] The logback.xml configuration file specifies the log output path and sets variable templates, so that the processed information is recorded in the specified log file according to preset rules;

[0052] Use the "@|@" symbol to separate log messages and pass in the relevant information to facilitate subsequent log collection, processing and cleaning;

[0053] Logback can be configured to output processed log information to a specified file path.

[0054] Optionally, the data analysis and display module involves correlation analysis of the structured data in the data warehouse. This means discovering potential problems, anomalies, or trends by mining the relationships and patterns between data. Subsequently, the analyzed data is rendered using the ECharts plugin to create reports that are displayed to the client.

[0055] The system audit log collection and analysis method and apparatus of the present invention have the following advantages compared with the prior art:

[0056] This invention can efficiently and reliably collect, store, query and analyze log data from large-scale application systems in real time, solving the problem of tracing the source of user operations. Attached Figure Description

[0057] Appendix Figure 1 This is a flowchart of the method according to Embodiment 1 of the present invention;

[0058] Appendix Figure 2 This is a module connection block diagram of Embodiment 2 of the present invention. Detailed Implementation

[0059] To make the technical solution, the technical problem solved, and the technical effect of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments.

[0060] Example 1:

[0061] Combined with appendix Figure 1 This embodiment proposes a method for collecting and analyzing system audit logs, which includes the following steps:

[0062] S1. Define the various modules in the system and the behaviors performed by each module.

[0063] A module refers to a relatively independent functional unit or component in a system. All modules work together to achieve the overall function of the system. When defining the modules in a system, first divide the system into multiple functional modules according to business logic, or into multiple component modules according to technical implementation. Then clarify the functions and responsibilities of each module.

[0064] Behavior refers to the operation or activity that occurs within or between modules. When defining the behavior performed by each module, first identify the pre-specified behaviors in each module, then describe each behavior in detail, including the triggering conditions, execution process, expected results and possible abnormal situations, and finally assess the risk of each behavior.

[0065] S2. When a user clicks a menu item on the interface, triggering a corresponding event, the triggered event is intercepted, the object properties related to the operation are obtained, and the obtained property information is notified to the relevant business components for further processing and recording. This process specifically includes:

[0066] S2.1 Define the interception logic: Using the concept of Spring AOP (Aspect-Oriented Programming), write an aspect according to the actual business requirements. The aspect includes three types of notifications: before, after, and around, which are used to handle the interception and collection logic when the user clicks the menu event.

[0067] S2.2 Create a custom annotation: Define an annotation named @OperateAuditLogAction, which is used to mark the methods that need to be intercepted;

[0068] S2.3 Apply annotations to controller methods: In the Spring MVC architecture, find the controller method that handles menu click events and add the @OperateAuditLogAction annotation to that method;

[0069] S2.4 Configuring Aspects: Configure aspects in the Spring configuration file (such as applicationContext.xml or using a Java configuration class) to make them effective, ensuring that aspects can recognize and process methods annotated with @OperateAuditLogAction;

[0070] S2.5 Implement Aspect Logic: Implement specific interception logic in the aspect, including obtaining object properties related to the operation and notifying the relevant business components of the obtained property information for further processing and recording; the execution order will vary depending on the set notification type.

[0071] S3. After receiving the attribute information of the operation object, the business component loads the audit log component. The audit log component processes the menu information, then organizes the processed information into a preset rule format and writes it to the log file. This process includes:

[0072] S3.1 Defining Aspects and Pointcuts: Leveraging the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0073] S3.2 Define Around Advice: In the aspect class, use the @Around annotation to define an around advice method. This method will process the menu information before and after the target method is executed.

[0074] S3.3 Obtaining Request Parameters: In the around advice method, obtain relevant request information through method parameters and process the obtained information.

[0075] S3.4 Writing global storage values ​​to the log: Using MDC (Mapped Diagnostic Context) to globally store relevant information after processing;

[0076] S3.5 Configuring the Logback framework: Specify the log output path and set variable templates through the logback.xml configuration file, so that the processed information is recorded in the specified log file according to preset rules;

[0077] S3.6 Message segmentation: Use the "@|@" symbol to segment log messages and pass in the relevant information to facilitate subsequent log collection, processing and cleaning;

[0078] S3.7 Output to a specified path: Through Logback configuration, the processed log information is output to a specified file path.

[0079] S4. Real-time collection of log files, processing and cleaning them to form structured data which is then written into the data warehouse.

[0080] This step involves using the Filebeat log collection component to collect logs and output them to Logstash. Logstash then processes and cleans the logs to create structured data, which is then written to the data warehouse. Processing refers to parsing, extracting, and transforming the data in the log files to convert them into a structured data format. Cleaning involves removing noise, duplicates, and invalid data from the log data to improve its accuracy and usability.

[0081] It should be added that Filebeat is a mature log collector that collects data into a data warehouse through rule configuration.

[0082] S5. Use data analysis tools and techniques to perform correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0083] Correlation analysis of structured data in a data warehouse refers to discovering potential problems, anomalies, or trends by mining the relationships and patterns between data. Subsequently, the analyzed data is rendered using the ECharts plugin to create reports that are displayed to the client.

[0084] Example 2:

[0085] Combined with appendix Figure 2 This embodiment proposes a system audit log collection and analysis device, which includes:

[0086] The system definition module is used to define the various modules in the system and the behaviors performed by each module;

[0087] The event interception and handling module is used to monitor user menu click events on the interface, and first intercepts the menu click event when it occurs. Then, it obtains the object properties related to the operation and notifies the relevant business components of the obtained property information for further processing and recording.

[0088] The receiving and loading module is used to receive the attribute information of the operation object from the business component and load the audit log component;

[0089] The audit log processing module is used to process the received information using the audit log component, and then organize the processed information into a preset rule format and write it to the log file.

[0090] The log data processing module is used to collect log files in real time, process and clean them to form structured data, and write it into the data warehouse.

[0091] The data analysis and visualization module is used to perform correlation analysis on the structured data in the data warehouse using data analysis tools and techniques, and to intuitively display the analysis results.

[0092] In this embodiment, the system definition module defines each module in the system and the behavior performed by each module. A module refers to a relatively independent functional unit or component within the system, with all modules collaborating to achieve the overall function of the system. A behavior refers to an operation or activity occurring within or between modules. When defining the modules in the system, the system definition module first divides the system into multiple functional modules according to business logic, or into multiple component modules according to technical implementation. Then, it clarifies the functions and responsibilities of each module. When defining the behavior performed by each module, the system definition module first identifies the pre-specified behaviors within each module, then provides a detailed description of each behavior, including its triggering conditions, execution process, expected results, and possible anomalies. Finally, it assesses the risk of each behavior.

[0093] In this embodiment, the event interception and processing module includes:

[0094] Define an interception unit and use the Spring AOP (Aspect-Oriented Programming) concept to write an aspect based on actual business needs. The aspect includes three notification types: before, after, and around, which are used to handle the interception and collection logic when the user clicks the menu event.

[0095] Define an annotation unit to define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0096] The annotation application unit is used to find the controller method that handles menu click events in the Spring MVC architecture and add the @OperateAuditLogAction annotation to that method;

[0097] Configure the aspect unit, which is used to configure aspects in Spring configuration files (such as applicationContext.xml or using Java configuration classes) to make them effective and ensure that aspects can recognize and process methods annotated with @OperateAuditLogAction;

[0098] The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object properties related to the operation and notifying the relevant business components of the obtained property information for further processing and recording; the execution order will vary depending on the set notification type.

[0099] In this embodiment, the audit log processing module uses the audit log component to process the received information, then organizes the processed information into a preset rule format and writes it to a log file. This process includes:

[0100] Leveraging the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods should be intercepted;

[0101] In the aspect class, an around advice method is defined using the @Around annotation. This method will process the menu information before and after the target method is executed.

[0102] In the around notification method, relevant information about the request is obtained through method parameters, and the obtained information is then processed.

[0103] Use MDC (Mapped Diagnostic Context) to globally store the relevant information after processing;

[0104] The logback.xml configuration file specifies the log output path and sets variable templates, so that the processed information is recorded in the specified log file according to preset rules;

[0105] Use the "@|@" symbol to separate log messages and pass in the relevant information to facilitate subsequent log collection, processing and cleaning;

[0106] Logback can be configured to output processed log information to a specified file path.

[0107] In this embodiment, the data analysis and display module performs correlation analysis on the structured data of the data warehouse. This means that by mining the relationships and patterns between data, potential problems, anomalies, or trends can be discovered. Subsequently, the analyzed data is rendered using the ECharts plugin to create reports that are displayed to the client.

[0108] In summary, the system audit log collection and analysis method and apparatus of the present invention can efficiently and reliably perform real-time collection, storage, query and analysis of log data from large-scale application systems.

[0109] The above specific examples illustrate the principles and implementation methods of the present invention in detail. These embodiments are merely for the purpose of helping to understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made to the present invention by those skilled in the art without departing from the principles of the present invention should fall within the patent protection scope of the present invention.

Claims

1. A method for collecting and analyzing system audit logs, comprising: The method comprises the following steps: S1, define each module in the system and the behavior performed by each module; S2, when the user clicks the menu on the interface to trigger the corresponding event, intercept the triggered event, obtain the object attributes related to the operation, and notify the related business components of the obtained attribute information for further processing and recording; specifically including: S2.1, define the interception logic: use the idea of Spring AOP to write an aspect according to the actual business requirements, the aspect includes three notification types of pre, post and around, which are used to process the interception and collection logic when the user clicks the menu event; S2.2, create a custom annotation: define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted; S2.3, apply the annotation to the controller method: in the Spring MVC architecture, find the controller method that handles the menu click event, and add the @OperateAuditLogAction annotation to the method; S2.4, configure the aspect: in the Spring configuration file, configure the aspect to make it effective, ensure that the aspect can identify and process the method with the @OperateAuditLogAction annotation; S2.5, implement the aspect logic: implement the specific interception logic in the aspect, including obtaining the object attributes related to the operation, and notifying the related business components of the obtained attribute information for further processing and recording; according to the set notification type, the execution order will be different; S3, after the business component receives the attribute information of the operation object, load the audit log component; the audit log component processes the menu information, then processes the information into a preset rule format, and writes it into a log file, this process includes: S3.1, define the aspect and the pointcut: use the characteristics of Spring AOP to define an aspect and a pointcut, wherein: the aspect class is marked with the @Aspect annotation; the pointcut method is marked with the @Pointcut annotation, which is used to specify which methods need to be intercepted; S3.2, define the around notification: in the aspect class, define an around notification method using the @Around annotation, which will be processed before and after the target method execution, so as to realize the processing of the menu information; S3.3, get the request parameters: in the around notification method, get the related information of the request through the method parameters, and process the obtained related information; S3.4, write the processed related information into the log using MDC global storage; S3.5, configure the Logback framework: use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rule; S3.6, message packet segmentation: use the "@|@" symbol to segment the log message, and pass the obtained related information into it, so as to collect, process and clean the subsequent log. S3.7, output to the specified path: through the configuration of Logback, the processed log information is output to the specified file path; S4, real-time collection of log files, processing and cleaning to form structured data and write to the data warehouse; S5, using data analysis tools and techniques to analyze the structured data of the data warehouse, and intuitively display the analysis results.

2. The method of claim 1, wherein the system audit log is collected and analyzed. A module refers to a relatively independent functional unit or component in a system, and each module cooperates to achieve the overall function of the system. When defining each module in the system, first divide the system into multiple functional modules according to business logic, or divide the system into multiple component modules according to technical implementation, and then clarify the functions and responsibility scope of each module. Behavior refers to the operation or activity occurring within a module or between modules. When defining the behavior performed by each module, first identify the pre-designated behavior in each module, then describe each behavior in detail, including the triggering condition, execution process, expected result, and possible exceptions, and finally assess the risk of each behavior.

3. The method of claim 1, wherein the system audit log is collected and analyzed. The execution step S5 is to perform correlation analysis on the structured data of the data warehouse, which refers to discovering potential problems, anomalies or trends by mining the correlation between data and patterns, and then using the echart plug-in to render the analyzed data and make reports to the client.

4. A system audit log collection and analysis apparatus, characterized by comprising: It includes: System definition module, for defining each module in the system and the behavior performed by each module; Event interception and processing module, for monitoring menu click events on the interface, and first intercepting when the menu click event occurs, then obtaining the object properties related to the operation, and notifying the related business component of the obtained property information for further processing and recording; Receive loading module, for receiving the attribute information of the operation object using the business component, and loading the audit log component; Audit log processing module, for processing the received information using the audit log component, then arranging the processed information into a pre-set rule format, and writing it into a log file; Log data processing module, for real-time collection of log files, processing and cleaning to form structured data and write to the data warehouse; Data analysis and display module, for using data analysis tools and techniques to analyze the structured data of the data warehouse, and intuitively displaying the analysis results; The event interception and processing module includes: Define the interception unit, use the idea of Spring AOP to write an aspect according to actual business needs, the aspect contains three notification types of pre, post and around, which is used to process the interception and collection logic when the user clicks the menu event; Define the annotation unit, define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted; Annotation application unit, for finding the controller method that handles the menu click event in the Spring MVC architecture, and adding the @OperateAuditLogAction annotation to the method. The configuration aspect unit is configured in the Spring configuration file to enable the aspect, and ensures that the aspect can identify and process the method with the @OperateAuditLogAction annotation. The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object properties related to the operation, and notifying the relevant business components of the obtained property information for further processing and recording; according to the set notification type, the execution sequence will be different. The audit log processing module processes the received information using the audit log component, then arranges the processed information into a preset rule format, and writes it into a log file, this process includes: Using the characteristics of Spring AOP, define an aspect and a pointcut, where: the aspect class is marked with the @Aspect annotation; the pointcut method is marked with the @Pointcut annotation, which is used to specify which methods need to be intercepted; In the aspect class, define a surrounding notification method using the @Around annotation, which will process the target method before and after execution, thereby realizing the processing of the menu information; In the surrounding notification method, obtain the relevant information of the request through the method parameter, and process the obtained relevant information; Use MDC to globally store the processed relevant information; Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules; Use the "@|@" symbol to split in the log message, and pass in the obtained relevant information, so as to collect, process and clean the subsequent log; Through the configuration of Logback, output the processed log information to the specified file path.

5. The system audit log collection and analysis apparatus of claim 4 wherein, The system definition module defines each module in the system and the behavior performed by each module, wherein a module refers to a relatively independent functional unit or component in the system, and each module cooperates to realize the overall function of the system, and the behavior refers to the operation or activity occurring within the module or between modules; When the system definition module defines each module in the system, it first divides the system into multiple functional modules according to business logic, or divides the system into multiple component modules according to technical implementation, and then clearly defines the functions and responsibility scope of each module; When the system definition module defines the behavior performed by each module, it first identifies the pre-specified behaviors in each module, then describes each behavior in detail, including the triggering condition, execution process, expected result and possible abnormal situation of the behavior, and finally evaluates the risk of each behavior.

6. The system audit log collection and analysis apparatus of claim 4 wherein, The data analysis and display module performs correlation analysis on the structured data of the data warehouse, which refers to discovering potential problems, abnormalities or trends by mining the correlation between data and patterns, then using the echart plug-in to render the analyzed data and make a report to the client.

Images