Artificial intelligence-based government and enterprise gateway log analysis method, device and equipment

Abstract

The invention provides a government and enterprise gateway log analysis method, device and equipment based on artificial intelligence, and relates to the technical field of artificial intelligence. The method comprises the following steps: firstly, performing multi-dimensional semantic mining operation on a target intrusion detection system log to obtain a first log semantic vector; secondly, on the basis of the first log semantic vector, screening out at least one historical intrusion detection system log similar to the target intrusion detection system log; then, based on a second log semantic vector and network intrusion identification data corresponding to each historical intrusion detection system log, performing semantic enhancement operation on the first log semantic vector, and outputting a target log semantic vector; and finally, based on the target log semantic vector, analyzing network intrusion analysis data corresponding to the target intrusion detection system log. Based on the above content, the problem that the reliability of government and enterprise gateway log analysis is relatively low in the prior art can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to an artificial intelligence-based government and enterprise gateway log analysis method, device, and equipment. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly serious, especially government and enterprise gateways are facing more complex network security threats. As an important device in the daily operation of governments and enterprises, government and enterprise gateways carry a large amount of sensitive data transmission and exchange. Therefore, it is very important to ensure their security. To this end, intrusion detection systems (IDS, Intrusion Detection System) have become an important security protection method, which identifies potential security threats and attack behaviors by real-time monitoring and analysis of network traffic. However, existing government and enterprise gateway intrusion detection systems mainly rely on traditional rule matching or signature-based detection technology. These methods often face the following problems: Low log analysis accuracy: Traditional intrusion detection systems can only compare network logs based on preset rules or specific signatures, which may lead to poor identification of unknown or complex network intrusion behaviors; Poor log processing efficiency: As the scale of government and enterprise networks continues to expand, the amount of intrusion detection logs generated is becoming increasingly large. Traditional log analysis methods are often unable to effectively process large-scale log data, resulting in long log analysis time and difficulty in providing real-time security responses. Lack of intelligent log analysis methods: Existing log analysis methods usually rely on manual experience and are unable to cope with increasingly complex network intrusion methods. Traditional methods cannot use the potential information in log data for effective semantic mining, resulting in delayed prediction and response to security incidents.

[0003] In general, in the existing technology, there is a problem of relatively low reliability of government and enterprise gateway log analysis in terms of analysis effect and analysis efficiency. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a government and enterprise gateway log analysis method, device and equipment based on artificial intelligence to improve the problem of relatively low reliability of government and enterprise gateway log analysis in the prior art.

[0005] To achieve the above objectives, this application adopts the following technical solutions: A government and enterprise gateway log analysis method based on artificial intelligence, comprising: Obtain a target intrusion detection system log of a target government and enterprise gateway, and perform a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector, wherein the first log semantic vector includes local log semantic vectors corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution, and scanning IP range; Based on the first log semantic vector, at least one historical intrusion detection system log having similarity with the target intrusion detection system log is screened out, wherein each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log has suffered a network intrusion, and the judgment condition of having similarity includes whether the similarity between the corresponding semantic vectors meets a preset condition; Based on the second log semantic vector and the network intrusion identification data corresponding to each of the historical intrusion detection system logs, a semantic enhancement operation is performed on the first log semantic vector, and a target log semantic vector corresponding to the first log semantic vector is output, wherein the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions; Based on the target log semantic vector, the network intrusion analysis data corresponding to the target intrusion detection system log is analyzed, wherein the network intrusion analysis data is used to reflect whether the target government and enterprise gateway has suffered a network intrusion.

[0006] In the preferred selection of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, the step of obtaining the target intrusion detection system log of the target government and enterprise gateway, and performing a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain the corresponding first log semantic vector includes: Obtain a target intrusion detection system log of a target government and enterprise gateway, wherein the target intrusion detection system log includes a first local system log, a second local system log, a third local system log, a fourth local system log, and a fifth local system log corresponding to a scanning speed, a scanning mode, a data packet size, a traffic distribution, and a scanning IP range, respectively; Perform word segmentation and embedding operations on the first local system log, the second local system log, the third local system log, the fourth local system log, and the fifth local system log, respectively, and output corresponding first local log embedding vectors, second local log embedding vectors, third local log embedding vectors, fourth local log embedding vectors, and fifth local log embedding vectors; Based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector and the fifth local log embedding vector, a corresponding first log semantic vector is determined.

[0007] In a preferred option of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, the step of determining the corresponding first log semantic vector based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector and the fifth local log embedding vector includes: performing self-attention operations on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector, and the fifth local log embedding vector respectively to form corresponding first local log vectors, second local log vectors, third local log vectors, fourth local log vectors, and fifth local log vectors; The first local log vector, the second local log vector, the third local log vector, the fourth local log vector and the fifth local log vector are concatenated to form a corresponding first log semantic vector.

[0008] In a preferred option of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, the step of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log based on the first log semantic vector includes: Determine a historical log database, wherein the historical log database includes each historical intrusion detection system log generated in the history of the target government and enterprise gateway and other government and enterprise gateways; Determine a second log semantic vector corresponding to each historical intrusion detection system log in the historical log database, and respectively calculate a vector similarity between each second log semantic vector and the first log semantic vector; Based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, at least one historical intrusion detection system log having similarity to the target intrusion detection system log is screened out in the historical log database.

[0009] In a preferred option of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, the step of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log in the historical log database based on the vector similarity between each of the second log semantic vectors and the first log semantic vector includes: Based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, each second log semantic vector having a corresponding vector similarity greater than a preset similarity is screened out in the historical log database to form a semantic vector candidate set; Based on the network intrusion identification data corresponding to each of the historical intrusion detection system logs, the semantic vector candidate set is split to form a corresponding first subset and a second subset, wherein when the first subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the first subset is used to reflect that a network intrusion has been suffered, and when the second subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the second subset is used to reflect that a network intrusion has not been suffered; Counting the number of second log semantic vectors in the first subset and the second subset respectively, and determining whether a difference between the two numbers is greater than a preset value; If the difference between the two numbers is greater than the preset value, determining the historical intrusion detection system log corresponding to each second log semantic vector in a subset with a larger number as a historical intrusion detection system log having similarity with the target intrusion detection system log; If the difference between the two quantities is not greater than the preset value, the historical intrusion detection system log corresponding to each second log semantic vector in the semantic vector candidate set is determined as a historical intrusion detection system log having similarity with the target intrusion detection system log.

[0010] In the preferred selection of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, the step of performing a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, and outputting a target log semantic vector corresponding to the first log semantic vector includes: Performing word segmentation and embedding operations on the network intrusion identification data corresponding to each of the historical intrusion detection system logs to form an intrusion identification semantic vector corresponding to each historical intrusion detection system; For each of the historical intrusion detection system logs, based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation is performed on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log to form an enhanced log semantic vector corresponding to the historical intrusion detection system log; For each of the historical intrusion detection system logs, based on each local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log, respectively perform a semantic enhancement operation on each local log semantic vector in the first log semantic vector to form a first enhanced log semantic vector corresponding to the historical intrusion detection system log; Based on the first enhanced log semantic vector corresponding to each of the historical intrusion detection system logs, a target log semantic vector corresponding to the first log semantic vector is determined.

[0011] In the preferred selection of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, for each of the historical intrusion detection system logs, based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log, each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log is subjected to a semantic enhancement operation to form an enhanced log semantic vector corresponding to the historical intrusion detection system log, including: For each of the historical intrusion detection system logs, a dot product operation is performed on the transposed result of the intrusion identification semantic vector corresponding to the historical intrusion detection system log and any one of the local log semantic vectors in the second log semantic vector corresponding to the historical intrusion detection system log, so as to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the intrusion identification semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the intrusion identification semantic vector and the local log semantic vector; For each row matrix parameter in the dot product matrix, based on the row matrix parameter, performing a weighted sum calculation on the local log semantic vector to obtain a weighted value corresponding to the row matrix parameter; Combining the weighted values ​​corresponding to each row matrix parameter in the dot product matrix to form a column vector, and obtaining a corresponding local enhanced log semantic vector; After each of the local log semantic vectors is enhanced based on the intrusion identification semantic vector to form a corresponding local enhanced log semantic vector, the formed local enhanced log semantic vectors are concatenated to form a corresponding enhanced log semantic vector.

[0012] In the preferred selection of the present application, in the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method, for each of the historical intrusion detection system logs, based on each local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log, each local log semantic vector in the first log semantic vector is subjected to semantic enhancement operation to form the first enhanced log semantic vector corresponding to the historical intrusion detection system log, including: For each of the historical intrusion detection system logs, a dot product operation is performed on any local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log and a transposed result of a local log semantic vector of a corresponding dimension in the first log semantic vector to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the local enhanced log semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the local enhanced log semantic vector and the local log semantic vector; For each row matrix parameter in the dot product matrix, based on the row matrix parameter, performing a weighted sum calculation on the local log semantic vector to obtain a weighted value corresponding to the row matrix parameter; Combining the weighted values ​​corresponding to each row matrix parameter in the dot product matrix to form a column vector, and obtaining a corresponding local enhancement vector; After a local log semantic vector of a corresponding dimension is enhanced based on each local enhanced log semantic vector to form a corresponding local enhanced vector, the formed local enhanced vectors are concatenated to form a corresponding first enhanced log semantic vector.

[0013] The present application also provides a government and enterprise gateway log analysis device based on artificial intelligence, including: A semantic mining module is used to obtain a target intrusion detection system log of a target government and enterprise gateway, and perform a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector, wherein the first log semantic vector includes a local log semantic vector corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution, and scanning IP range; A log screening module, used to screen out at least one historical intrusion detection system log having similarity with the target intrusion detection system log based on the first log semantic vector, wherein each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log has suffered a network intrusion, and the judgment condition of having similarity includes whether the similarity between the corresponding semantic vectors meets a preset condition; A semantic enhancement module, configured to perform a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, and output a target log semantic vector corresponding to the first log semantic vector, wherein the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions; The intrusion analysis module is used to analyze the network intrusion analysis data corresponding to the target intrusion detection system log based on the target log semantic vector, wherein the network intrusion analysis data is used to reflect whether the target government and enterprise gateway has suffered a network intrusion.

[0014] Based on the above, the present application also provides an electronic device, including: Memory for storing computer programs; The processor connected to the memory is used to execute the computer program stored in the memory to implement the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method.

[0015] The artificial intelligence-based government and enterprise gateway log analysis method, device and equipment provided in this application, first, perform multi-dimensional semantic mining operations on the target intrusion detection system log to obtain a first log semantic vector; secondly, based on the first log semantic vector, screen out at least one historical intrusion detection system log that is similar to the target intrusion detection system log; then, based on the second log semantic vector and network intrusion identification data corresponding to each historical intrusion detection system log, perform semantic enhancement operations on the first log semantic vector, and output the target log semantic vector; finally, based on the target log semantic vector, analyze the network intrusion analysis data corresponding to the target intrusion detection system log. Based on the above content, on the one hand, artificial intelligence technology can be used to replace manual detection, so that efficiency can be improved. On the other hand, artificial intelligence technology can be used to perform multi-dimensional semantic mining on the target intrusion detection system log, and potential semantic information in multiple dimensions can be mined, and further enhanced by screening similar historical intrusion detection system logs, so that the semantic representation accuracy of the formed target log semantic vector can be higher, so that the reliability of the analysis can be improved, thereby improving the problem of relatively low reliability of government and enterprise gateway log analysis in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings.

[0017] Figure 1 A structural block diagram of an electronic device provided in an embodiment of the present application.

[0018] Figure 2 A flow chart of the artificial intelligence-based government and enterprise gateway log analysis method provided in an embodiment of the present application.

[0019] Figure 3 A block diagram of an artificial intelligence-based government and enterprise gateway log analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] like Figure 1 As shown, an embodiment of the present application provides an electronic device, wherein the electronic device may include a memory, a processor, and a government and enterprise gateway log analysis device based on artificial intelligence.

[0023] In detail, the memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, the memory and the processor can be electrically connected through one or more communication buses or signal lines. The artificial intelligence-based government and enterprise gateway log analysis device includes at least one software function module stored in the memory in the form of software or firmware. The processor is used to execute an executable computer program stored in the memory, for example, the software function modules and computer programs included in the artificial intelligence-based government and enterprise gateway log analysis device, so as to implement the artificial intelligence-based government and enterprise gateway log analysis method provided in the embodiment of the present application.

[0024] Optionally, the memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc.

[0025] Furthermore, the processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a system on chip (SoC), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0026] Understandably, Figure 1 The structure shown is for illustration only, and the electronic device may also include Figure 1 More or fewer components as shown, or with Figure 1 The different configurations shown, for example, may also include a communication unit for exchanging information with other devices.

[0027] Combination Figure 2 , the embodiment of the present application also provides a government and enterprise gateway log analysis method based on artificial intelligence that can be applied to the above electronic device. Among them, the method steps defined in the process related to the government and enterprise gateway log analysis method based on artificial intelligence can be implemented by the electronic device. Figure 2 The specific process shown is explained in detail.

[0028] Step S110, obtaining a target intrusion detection system log of a target government and enterprise gateway, and performing a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector.

[0029] In an embodiment of the present application, the electronic device can obtain the target intrusion detection system log of the target government and enterprise gateway, and perform a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector. The first log semantic vector includes a local log semantic vector corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution, and scanning IP range, etc. For example, the specific contents are as follows: 1. Scanning speed: Port scanning behavior: When an attacker performs a port scan, they may send a large number of probe requests in a short period of time to identify which ports are open. Normal network users will not access multiple ports so quickly. IDS detection: IDS can monitor the speed at which requests are sent. If it detects a large number of port requests in a short period of time, it may identify that this is a port scan. Example: Suppose within 1 second, there are 10 requests to access different ports (such as port 80, 443, 22, 21, etc.). This will appear abnormal because it is impossible for a normal user to access so many ports in such a short period of time.

[0030] 2. Scan mode: Port scanning behavior: Common types of port scanning include Full Port Scan, Stealth Scan, SYN Scan, etc. Different scanning methods will produce different traffic patterns. Full Port Scan: The attacker will scan all possible ports on the target machine, usually generating a large number of requests. Stealth Scan: The purpose is to scan ports covertly, usually by sending incomplete connections (such as only sending SYN packets) so that the target server cannot determine the source of the request. SYN Scan: The attacker tests whether the port is open by sending a large number of SYN packets. IDS detection: The IDS system will identify scanning behavior based on the scan type and packet characteristics. Example: If the IDS finds that a large number of SYN packet requests are not followed by an ACK response, or that many ports receive duplicate SYN packets, it may identify that the attacker is performing a SYN scan.

[0031] 3. Packet size: Port scanning behavior: The attacker's scanning request and normal user request usually have significant differences in data packet size. For example, a port scan may send very small packets because it only needs to test the open status of the port without transmitting a large amount of data. IDS detection: IDS can analyze the size and structure of data packets in the network. Compared with normal network traffic, if a large number of small data packets access multiple ports, this may be a signal of scanning behavior. Example: An attacker sends a large number of SYN packets, each of which may be only a few dozen bytes in size. When normal users access a website or server, the size of the data packets is usually larger because they usually contain more data. IDS can detect these frequent small data packets and analyze potential scanning activities.

[0032] 4. Distribution of scan targets: Port scanning behavior: An attacker may scan multiple ports of one or more IP addresses. This process usually manifests as requests to multiple IP addresses. IDS detection: IDS can detect whether the scan requests are distributed across multiple IP addresses. If there are requests for multiple ports within a certain IP address or subnet, or the scan target spans multiple IP addresses, IDS can infer that these requests may be a network scan. Example: Suppose the IDS detects a large number of port scan requests from multiple source IP addresses, and these requests are concentrated on certain ports (such as ports 22, 80, and 443). This behavior may indicate that the attacker is trying to scan a large range of IP address segments to find vulnerable hosts.

[0033] 5. Abnormal traffic patterns: Port scanning behavior: Port scanning may produce abnormal traffic patterns, for example, some ports are frequently accessed, while other ports have no traffic. IDS detection: IDS can use traffic analysis technology to detect abnormal traffic patterns in the network. If some ports are accessed abnormally frequently, while other ports are accessed less frequently, IDS may consider this to be a manifestation of port scanning. Example: IDS detects that a specific IP address has extremely high access frequencies to port 80 (HTTP) and port 22 (SSH), while other ports (such as port 25, port 21, etc.) have almost no traffic.

[0034] 6. Scanned IP address range: Port scanning behavior: Attackers often scan an IP address range (e.g., from 192.168.1.0 to 192.168.1.255) to look for exposed systems. IDS detection: IDS can detect the scanned IP range. Frequent scan requests across multiple IPs may indicate that the attacker is looking for open ports. Example: Suppose the IDS finds that a source IP address sends requests to multiple IP addresses in a short period of time, scanning multiple ports. This is usually a common scanning behavior.

[0035] Step S120: based on the first log semantic vector, filter out at least one historical intrusion detection system log that is similar to the target intrusion detection system log.

[0036] In an embodiment of the present application, after determining the first log semantic vector, the electronic device can screen out at least one historical intrusion detection system log that is similar to the target intrusion detection system log based on the first log semantic vector. Each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log (which can be the target government and enterprise gateway or other government and enterprise gateways) has suffered a network intrusion. In addition, the judgment condition of similarity includes whether the similarity between the corresponding semantic vectors meets the preset conditions.

[0037] Step S130: Based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, a semantic enhancement operation is performed on the first log semantic vector, and a target log semantic vector corresponding to the first log semantic vector is output.

[0038] In an embodiment of the present application, after determining at least one historical intrusion detection system log with similarity, the electronic device can perform a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, and output a target log semantic vector corresponding to the first log semantic vector. Among them, the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions. In other words, since the screened historical intrusion detection system logs have similarities, the corresponding semantic information and the corresponding network intrusion identification data have the function of associative representation. In this way, when the semantic enhancement operation is performed on the first log semantic vector based on the corresponding second log semantic vector and the network intrusion identification data, the reliability of the basis for enhancement can be guaranteed, so that the semantic information of the enhanced target log semantic vector can be more reliable and more accurate on a richer basis.

[0039] Step S140: Analyze the network intrusion analysis data corresponding to the target intrusion detection system log based on the target log semantic vector.

[0040] In an embodiment of the present application, after obtaining the target log semantic vector, the electronic device can analyze the network intrusion analysis data corresponding to the target intrusion detection system log based on the target log semantic vector. The network intrusion analysis data is used to reflect whether the target government and enterprise gateway has suffered a network intrusion. Exemplarily, the above steps S110-S140 can be completed using a trained neural network (trained using log samples and intrusion labels), wherein the neural network can include a fully connected network and a classification function (such as softmax, etc.), so that the fully connected network can perform fully connected processing on the target log semantic vector to obtain the corresponding fully connected vector, and then, the fully connected vector is mapped and outputted through the classification function to obtain the corresponding probability distribution, such as (0.2, 0.8), that is, the probability of suffering a network intrusion and the probability of not suffering a network intrusion.

[0041] Based on the above content, on the one hand, artificial intelligence technology can be used to replace manual detection, so that efficiency can be improved. On the other hand, artificial intelligence technology can be used to perform multi-dimensional semantic mining on the target intrusion detection system log, which can mine potential semantic information in multiple dimensions, and further strengthen it by screening similar historical intrusion detection system logs, so that the semantic representation accuracy of the formed target log semantic vector can be higher, so that the reliability of the analysis can be improved, thereby improving the relatively low reliability of government and enterprise gateway log analysis in the existing technology, and ensuring reliable identification and response to network intrusions.

[0042] In the first aspect, it should be noted that for step S110 , the specific method of obtaining the corresponding first log semantic vector is not limited and can be selected according to actual needs.

[0043] For example, in an alternative implementation, in order to achieve reliable mining of multi-dimensional semantics, the above-mentioned step S110 may further include step S111, step S112 and step S113, and the specific content of each step is described as follows.

[0044] Step S111, obtaining the target intrusion detection system log of the target government and enterprise gateway.

[0045] In an embodiment of the present application, the target intrusion detection system log of the target government and enterprise gateway can be obtained first. The target intrusion detection system log includes the first local system log, the second local system log, the third local system log, the fourth local system log and the fifth local system log corresponding to the scanning speed, scanning mode, data packet size, traffic distribution and scanning IP range, respectively, that is, the information of the five dimensions is characterized by the five local system logs.

[0046] Step S112, respectively perform word segmentation and embedding operations on the first local system log, the second local system log, the third local system log, the fourth local system log, and the fifth local system log, and output corresponding first local log embedding vectors, second local log embedding vectors, third local log embedding vectors, fourth local log embedding vectors, and fifth local log embedding vectors.

[0047] In an embodiment of the present application, after obtaining the target intrusion detection system log, the first local system log, the second local system log, the third local system log, the fourth local system log and the fifth local system log in the target intrusion detection system log can be respectively subjected to word segmentation embedding operations, and the corresponding first local log embedding vector, second local log embedding vector, third local log embedding vector, fourth local log embedding vector and fifth local log embedding vector are output. In this way, by performing word segmentation embedding operations respectively, the accuracy of word segmentation embedding can be improved, so that the representation ability of the corresponding embedding vector is better. In addition, the word segmentation embedding operation can be implemented by the word embedding model in the corresponding neural network.

[0048] Step S113: determining a corresponding first log semantic vector based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector and the fifth local log embedding vector.

[0049] In an embodiment of the present application, after obtaining each local log embedding vector, the corresponding first log semantic vector can be determined based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector and the fifth local log embedding vector, that is, the first log semantic vector that can effectively represent the semantic information of each dimension, that is, the global semantic vector.

[0050] It is understandable that, in the above step S113, the specific method of determining the corresponding first log semantic vector is not limited. For example, in an alternative implementation, in order to improve the accuracy of the semantic representation of the first log semantic vector, the above step S113 may further include the following specific implementation contents: First, a self-attention operation can be performed on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector, and the fifth local log embedding vector, respectively, to form a corresponding first local log vector, a second local log vector, a third local log vector, a fourth local log vector, and a fifth local log vector; in this way, the correlation information within the semantic information of each dimension can be captured, so that the correlation information can be represented in an important way, that is, the capture of important information is achieved; Secondly, the first local log vector, the second local log vector, the third local log vector, the fourth local log vector and the fifth local log vector may be concatenated to form a corresponding first log semantic vector.

[0051] In the second aspect, it should be noted that for step S120, the specific method of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log is not limited and can be selected according to actual needs.

[0052] For example, in an alternative implementation, in order to screen out historical intrusion detection system logs that can reliably enhance the target intrusion detection system logs, the above-mentioned step S120 may further include step S121, step S122 and step S123, the specific contents of which are described as follows.

[0053] Step S121, determining a historical log database.

[0054] In the embodiment of the present application, a historical log database is first determined. The historical log database includes each historical intrusion detection system log formed in the history of the target government and enterprise gateway and other government and enterprise gateways (each historical intrusion detection system log also has corresponding network intrusion identification data, which can be based on historical identification by a neural network or based on manual identification, and the specific determination method is not limited).

[0055] Step S122: determining a second log semantic vector corresponding to each historical intrusion detection system log in the historical log database, and respectively calculating a vector similarity between each second log semantic vector and the first log semantic vector.

[0056] In an embodiment of the present application, after determining the historical log database, the second log semantic vector corresponding to each historical intrusion detection system log in the historical log database can be determined (such as obtained by multi-dimensional semantic mining in step S110), and the vector similarity between each of the second log semantic vectors and the first log semantic vector is calculated respectively, such as cosine similarity, or other methods that can characterize the similarity between two semantic vectors.

[0057] Step S123: based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, at least one historical intrusion detection system log having similarity with the target intrusion detection system log is screened out from the historical log database.

[0058] In an embodiment of the present application, after obtaining the vector similarity between two semantic vectors, at least one historical intrusion detection system log having similarity to the target intrusion detection system log can be screened out in the historical log database based on the vector similarity between each of the second log semantic vectors and the first log semantic vector.

[0059] It can be understood that, in the above step S123, the specific method of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log in the historical log database is not limited. For example, in an alternative implementation, in order to avoid interference of some individual cases with real semantic information, so that the screened historical intrusion detection system log has a reliable auxiliary semantic representation function, the above step S123 may further include the following contents: First, based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, each second log semantic vector having a corresponding vector similarity greater than a preset similarity can be screened out in the historical log database to form a semantic vector candidate set; it can be understood that the value of the preset similarity can be configured according to actual needs, such as 0.5, 0.6, 0.7, etc., or can also be determined as a corresponding neural network during the training process; Secondly, based on the network intrusion identification data corresponding to each of the historical intrusion detection system logs, the semantic vector candidate set can be split to form a corresponding first subset and a second subset, wherein when the first subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the first subset is used to reflect that a network intrusion has been suffered, and when the second subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the second subset is used to reflect that a network intrusion has not been suffered; Then, the number of second log semantic vectors in the first subset and the second subset is counted respectively, and it is determined whether the difference between the two numbers is greater than a preset value; it can be understood that the specific value of the preset value can be configured according to actual needs, such as 10, 20, 50, etc.; Afterwards, if the difference between the two numbers is greater than the preset value, the historical intrusion detection system log corresponding to each second log semantic vector in the subset with a larger number is determined as a historical intrusion detection system log having similarity with the target intrusion detection system log; that is, when the two types are distributed extremely unevenly, it can be considered that the situation in the subset with a smaller number is accidental and has no auxiliary effect, and therefore can be discarded; Finally, if the difference between the two quantities is not greater than the preset value, the historical intrusion detection system log corresponding to each second log semantic vector in the semantic vector candidate set is determined as a historical intrusion detection system log that has similarity to the target intrusion detection system log; that is, when the two types are distributed relatively evenly, it can be considered that the situations in the two subsets are not accidental situations and have auxiliary effects, and therefore, both can be retained.

[0060] Thirdly, it should be noted that for step S130, the specific manner of performing the semantic enhancement operation on the first log semantic vector is not limited and can be selected according to actual needs.

[0061] For example, in an alternative implementation, in order to achieve reliable semantic enhancement of the first log semantic vector, the above-mentioned step S130 may further include step S131, step S132, step S133 and step S134, and the specific content of each step is described as follows.

[0062] Step S131 , performing word segmentation and embedding operations on the network intrusion identification data corresponding to each of the historical intrusion detection system logs, to form an intrusion identification semantic vector corresponding to each historical intrusion detection system.

[0063] In an embodiment of the present application, a word segmentation and embedding operation (such as implemented by a corresponding word embedding model) may be performed on the network intrusion identification data corresponding to each of the historical intrusion detection system logs to form an intrusion identification semantic vector corresponding to each historical intrusion detection system.

[0064] Step S132, for each of the historical intrusion detection system logs, based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation is performed on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log to form an enhanced log semantic vector corresponding to the historical intrusion detection system log.

[0065] In an embodiment of the present application, after obtaining the intrusion identification semantic vector, for each of the historical intrusion detection system logs, based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation is performed on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log to form an enhanced log semantic vector corresponding to the historical intrusion detection system log. In other words, since the intrusion identification semantic vector and the second log semantic vector are both historical intrusion detection system logs, the semantic enhancement operation is performed first so that the associated information therein can be captured. In addition, performing semantic enhancement operations on local log semantic vectors corresponding to different dimensions can also make the granularity of the semantic enhancement operation finer, thereby achieving a more precise semantic enhancement operation and avoiding interference of semantic information of different dimensions during the enhancement process, thereby making the semantic representation of the obtained enhanced log semantic vector more accurate.

[0066] Step S133, for each of the historical intrusion detection system logs, based on each local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation is performed on each local log semantic vector in the first log semantic vector to form a first enhanced log semantic vector corresponding to the historical intrusion detection system log.

[0067] In the embodiment of the present application, after obtaining the enhanced log semantic vector, for each of the historical intrusion detection system logs, based on each local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation can be performed on each local log semantic vector in the first log semantic vector to form the first enhanced log semantic vector corresponding to the historical intrusion detection system log, which can be enhanced based on a one-to-one correspondence of dimensions. In this way, the reliability of semantic enhancement can be improved and interference of semantic information of different dimensions can be avoided.

[0068] Step S134: based on the first enhanced log semantic vector corresponding to each of the historical intrusion detection system logs, determine a target log semantic vector corresponding to the first log semantic vector.

[0069] In an embodiment of the present application, after obtaining the first enhanced log semantic vector, the target log semantic vector corresponding to the first log semantic vector can be determined based on the first enhanced log semantic vector corresponding to each of the historical intrusion detection system logs. Exemplarily, the first enhanced log semantic vectors corresponding to each of the historical intrusion detection system logs can be spliced ​​to obtain the corresponding target log semantic vector; or, convolution, self-attention operations, etc. can be performed after splicing to capture more important semantic information.

[0070] It can be understood that, in the above step S132, the specific manner of performing the semantic enhancement operation on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log is not limited. For example, in an alternative implementation, in order to be able to capture the associated information therein during the semantic enhancement operation to achieve the capture and attention of important semantic information, the above step S132 may further include the following contents: First, for each of the historical intrusion detection system logs, a dot product operation can be performed on the transposed result of the intrusion identification semantic vector corresponding to the historical intrusion detection system log and any one of the local log semantic vectors in the second log semantic vector corresponding to the historical intrusion detection system log to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the intrusion identification semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the intrusion identification semantic vector and the local log semantic vector; Secondly, for each row matrix parameter in the dot product matrix, based on the row matrix parameter, the local log semantic vector can be weighted summed to obtain a weighted value corresponding to the row matrix parameter. For example, the row matrix parameter is (a1, a2, a3), and the local log semantic vector is (b1, b2, b3). In this way, the corresponding weighted value is equal to a1*b1+a2*b2+a3*b3. Then, the weighted values ​​corresponding to each row matrix parameter in the dot product matrix may be combined to form a column vector to obtain a corresponding local enhanced log semantic vector; Finally, after each of the local log semantic vectors is enhanced based on the intrusion identification semantic vector to form a corresponding local enhanced log semantic vector, the formed local enhanced log semantic vectors are concatenated to form a corresponding enhanced log semantic vector.

[0071] It can be understood that, in the above step S133, the specific manner of performing the semantic enhancement operation on each local log semantic vector in the first log semantic vector is not limited. For example, in an alternative implementation, in order to capture the associated information therein during the semantic enhancement operation to achieve the capture and attention of important semantic information, the above step S133 may further include the following contents: First, for each of the historical intrusion detection system logs, a dot product operation can be performed on any local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log and a transposed result of a local log semantic vector of a corresponding dimension (i.e., the same dimension, such as both scanning IP ranges) in the first log semantic vector to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the local enhanced log semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the local enhanced log semantic vector and the local log semantic vector; Secondly, for each row matrix parameter in the dot product matrix, based on the row matrix parameter, the local log semantic vector is weighted summed to obtain a weighted value corresponding to the row matrix parameter. The specific calculation process is as described above. Then, the weighted values ​​corresponding to each row matrix parameter in the dot product matrix may be combined to form a column vector to obtain a corresponding local enhancement vector; Finally, after a local log semantic vector of a corresponding dimension is enhanced based on each local enhanced log semantic vector to form a corresponding local enhanced vector, the formed local enhanced vectors are concatenated to form a corresponding first enhanced log semantic vector.

[0072] Combination Figure 3 The embodiment of the present application also provides an artificial intelligence-based government and enterprise gateway log analysis device that can be applied to the above electronic device. The artificial intelligence-based government and enterprise gateway log analysis device can include a semantic mining module, a log screening module, a semantic enhancement module, and an intrusion analysis module.

[0073] In detail, the semantic mining module is used to obtain the target intrusion detection system log of the target government and enterprise gateway, and perform multi-dimensional semantic mining operations on the target intrusion detection system log to obtain the corresponding first log semantic vector, wherein the first log semantic vector includes local log semantic vectors corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution and scanning IP range. In the embodiment of the present application, the semantic mining module can be used to perform Figure 2 As shown in step S110, the relevant contents of the semantic mining module can refer to the above description of step S110.

[0074] In detail, the log screening module is used to screen out at least one historical intrusion detection system log that is similar to the target intrusion detection system log based on the first log semantic vector, wherein each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log has suffered a network intrusion. In the embodiment of the present application, the log screening module can be used to perform Figure 2 As shown in step S120, for the relevant content of the log screening module, reference may be made to the above description of step S120.

[0075] In detail, the semantic enhancement module is used to perform a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, and output a target log semantic vector corresponding to the first log semantic vector, wherein the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions. In the embodiment of the present application, the semantic enhancement module can be used to perform Figure 2 As shown in step S130, the relevant contents of the semantic enhancement module can refer to the above description of step S130.

[0076] In detail, the intrusion analysis module is used to analyze the network intrusion analysis data corresponding to the target intrusion detection system log based on the target log semantic vector, wherein the network intrusion analysis data is used to reflect whether the target government and enterprise gateway has been subjected to network intrusion. Figure 2As shown in step S140, the relevant contents of the intrusion analysis module can refer to the above description of step S140.

[0077] In an embodiment of the present application, corresponding to the above-mentioned artificial intelligence-based government and enterprise gateway log analysis method applied to the electronic device, a computer-readable storage medium is also provided, in which a computer program is stored, and when the computer program is run, each step of the artificial intelligence-based government and enterprise gateway log analysis method is executed.

[0078] Among them, the steps executed when the aforementioned computer program is running will not be described here one by one. Please refer to the previous explanation of the artificial intelligence-based government and enterprise gateway log analysis method.

[0079] In summary, the artificial intelligence-based government and enterprise gateway log analysis method, device and equipment provided by the present application, first, perform multi-dimensional semantic mining operations on the target intrusion detection system log to obtain a first log semantic vector; secondly, based on the first log semantic vector, screen out at least one historical intrusion detection system log that is similar to the target intrusion detection system log; then, based on the second log semantic vector and network intrusion identification data corresponding to each historical intrusion detection system log, perform semantic enhancement operations on the first log semantic vector, and output the target log semantic vector; finally, based on the target log semantic vector, analyze the network intrusion analysis data corresponding to the target intrusion detection system log. Based on the above content, on the one hand, artificial intelligence technology can be used to replace manual detection, so that efficiency can be improved. On the other hand, artificial intelligence technology can be used to perform multi-dimensional semantic mining on the target intrusion detection system log, and potential semantic information in multiple dimensions can be mined, and further enhanced by screening similar historical intrusion detection system logs, so that the semantic representation accuracy of the formed target log semantic vector can be higher, therefore, the reliability of the analysis can be improved, thereby improving the problem that the reliability of government and enterprise gateway log analysis in the prior art is relatively low.

[0080] In several embodiments provided in the embodiments of the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device and method embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0081] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0082] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code. It should be noted that in this article, the term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, article or device. Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0083] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A government and enterprise gateway log analysis method based on artificial intelligence, characterized in that: include: Obtain a target intrusion detection system log of a target government and enterprise gateway, and perform a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector, wherein the first log semantic vector includes local log semantic vectors corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution, and scanning IP range; Based on the first log semantic vector, at least one historical intrusion detection system log having similarity with the target intrusion detection system log is screened out, wherein each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log has suffered a network intrusion, and the judgment condition of having similarity includes whether the similarity between the corresponding semantic vectors meets a preset condition; Based on the second log semantic vector and the network intrusion identification data corresponding to each of the historical intrusion detection system logs, a semantic enhancement operation is performed on the first log semantic vector, and a target log semantic vector corresponding to the first log semantic vector is output, wherein the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions; Based on the target log semantic vector, the network intrusion analysis data corresponding to the target intrusion detection system log is analyzed, wherein the network intrusion analysis data is used to reflect whether the target government and enterprise gateway has suffered a network intrusion.

2. According to the artificial intelligence-based government and enterprise gateway log analysis method of claim 1, it is characterized in that: The step of obtaining a target intrusion detection system log of a target government and enterprise gateway, and performing a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector includes: Obtain a target intrusion detection system log of a target government and enterprise gateway, wherein the target intrusion detection system log includes a first local system log, a second local system log, a third local system log, a fourth local system log, and a fifth local system log corresponding to a scanning speed, a scanning mode, a data packet size, a traffic distribution, and a scanning IP range, respectively; Perform word segmentation and embedding operations on the first local system log, the second local system log, the third local system log, the fourth local system log, and the fifth local system log, respectively, and output corresponding first local log embedding vectors, second local log embedding vectors, third local log embedding vectors, fourth local log embedding vectors, and fifth local log embedding vectors; Based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector and the fifth local log embedding vector, a corresponding first log semantic vector is determined.

3. According to the artificial intelligence-based government and enterprise gateway log analysis method of claim 2, it is characterized in that: The step of determining a corresponding first log semantic vector based on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector, and the fifth local log embedding vector comprises: performing self-attention operations on the first local log embedding vector, the second local log embedding vector, the third local log embedding vector, the fourth local log embedding vector, and the fifth local log embedding vector respectively to form corresponding first local log vectors, second local log vectors, third local log vectors, fourth local log vectors, and fifth local log vectors; The first local log vector, the second local log vector, the third local log vector, the fourth local log vector and the fifth local log vector are concatenated to form a corresponding first log semantic vector.

4. According to the artificial intelligence-based government and enterprise gateway log analysis method of claim 1, it is characterized in that: The step of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log based on the first log semantic vector comprises: Determine a historical log database, wherein the historical log database includes each historical intrusion detection system log generated in the history of the target government and enterprise gateway and other government and enterprise gateways; Determine a second log semantic vector corresponding to each historical intrusion detection system log in the historical log database, and respectively calculate a vector similarity between each second log semantic vector and the first log semantic vector; Based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, at least one historical intrusion detection system log having similarity to the target intrusion detection system log is screened out in the historical log database.

5. According to the artificial intelligence-based government and enterprise gateway log analysis method of claim 4, it is characterized in that: The step of screening out at least one historical intrusion detection system log having similarity with the target intrusion detection system log in the historical log database based on the vector similarity between each of the second log semantic vectors and the first log semantic vector comprises: Based on the vector similarity between each of the second log semantic vectors and the first log semantic vector, each second log semantic vector having a corresponding vector similarity greater than a preset similarity is screened out in the historical log database to form a semantic vector candidate set; Based on the network intrusion identification data corresponding to each of the historical intrusion detection system logs, the semantic vector candidate set is split to form a corresponding first subset and a second subset, wherein when the first subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the first subset is used to reflect that a network intrusion has been suffered, and when the second subset does not belong to an empty set, the network intrusion identification data corresponding to the historical intrusion detection system log corresponding to each second log semantic vector included in the second subset is used to reflect that a network intrusion has not been suffered; Counting the number of second log semantic vectors in the first subset and the second subset respectively, and determining whether a difference between the two numbers is greater than a preset value; If the difference between the two numbers is greater than the preset value, determining the historical intrusion detection system log corresponding to each second log semantic vector in a subset with a larger number as a historical intrusion detection system log having similarity with the target intrusion detection system log; If the difference between the two quantities is not greater than the preset value, the historical intrusion detection system log corresponding to each second log semantic vector in the semantic vector candidate set is determined as a historical intrusion detection system log having similarity with the target intrusion detection system log.

6. The artificial intelligence-based government and enterprise gateway log analysis method according to claim 1 is characterized in that: The step of performing a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and the network intrusion identification data corresponding to each of the historical intrusion detection system logs, and outputting a target log semantic vector corresponding to the first log semantic vector, comprises: Performing word segmentation and embedding operations on the network intrusion identification data corresponding to each of the historical intrusion detection system logs to form an intrusion identification semantic vector corresponding to each historical intrusion detection system; For each of the historical intrusion detection system logs, based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log, a semantic enhancement operation is performed on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log to form an enhanced log semantic vector corresponding to the historical intrusion detection system log; For each of the historical intrusion detection system logs, based on each local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log, respectively perform a semantic enhancement operation on each local log semantic vector in the first log semantic vector to form a first enhanced log semantic vector corresponding to the historical intrusion detection system log; Based on the first enhanced log semantic vector corresponding to each of the historical intrusion detection system logs, a target log semantic vector corresponding to the first log semantic vector is determined.

7. According to claim 6, the artificial intelligence-based government and enterprise gateway log analysis method is characterized in that: The step of performing a semantic enhancement operation on each local log semantic vector in the second log semantic vector corresponding to the historical intrusion detection system log based on the intrusion identification semantic vector corresponding to the historical intrusion detection system log to form an enhanced log semantic vector corresponding to the historical intrusion detection system log includes: For each of the historical intrusion detection system logs, a dot product operation is performed on the transposed result of the intrusion identification semantic vector corresponding to the historical intrusion detection system log and any one of the local log semantic vectors in the second log semantic vector corresponding to the historical intrusion detection system log, so as to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the intrusion identification semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the intrusion identification semantic vector and the local log semantic vector; For each row matrix parameter in the dot product matrix, based on the row matrix parameter, performing a weighted sum calculation on the local log semantic vector to obtain a weighted value corresponding to the row matrix parameter; Combining the weighted values ​​corresponding to each row matrix parameter in the dot product matrix to form a column vector, and obtaining a corresponding local enhanced log semantic vector; After each of the local log semantic vectors is enhanced based on the intrusion identification semantic vector to form a corresponding local enhanced log semantic vector, the formed local enhanced log semantic vectors are concatenated to form a corresponding enhanced log semantic vector.

8. The artificial intelligence-based government and enterprise gateway log analysis method according to claim 6 is characterized in that: The step of performing semantic enhancement operation on each local log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log for each of the historical intrusion detection system logs to form a first enhanced log semantic vector corresponding to the historical intrusion detection system log includes: For each of the historical intrusion detection system logs, a dot product operation is performed on any local enhanced log semantic vector in the enhanced log semantic vector corresponding to the historical intrusion detection system log and a transposed result of a local log semantic vector of a corresponding dimension in the first log semantic vector to form a dot product matrix corresponding to the historical intrusion detection system log, wherein the local enhanced log semantic vector belongs to a column vector, the local log semantic vector belongs to a column vector, and the dot product matrix is ​​used to reflect the association relationship between the local enhanced log semantic vector and the local log semantic vector; For each row matrix parameter in the dot product matrix, based on the row matrix parameter, performing a weighted sum calculation on the local log semantic vector to obtain a weighted value corresponding to the row matrix parameter; Combining the weighted values ​​corresponding to each row matrix parameter in the dot product matrix to form a column vector, and obtaining a corresponding local enhancement vector; After a local log semantic vector of a corresponding dimension is enhanced based on each local enhanced log semantic vector to form a corresponding local enhanced vector, the formed local enhanced vectors are concatenated to form a corresponding first enhanced log semantic vector.

9. An artificial intelligence-based government and enterprise gateway log analysis device, characterized in that: include: A semantic mining module is used to obtain a target intrusion detection system log of a target government and enterprise gateway, and perform a multi-dimensional semantic mining operation on the target intrusion detection system log to obtain a corresponding first log semantic vector, wherein the first log semantic vector includes a local log semantic vector corresponding to multiple dimensions, and the multiple dimensions include scanning speed, scanning mode, data packet size, traffic distribution, and scanning IP range; A log screening module, used to screen out at least one historical intrusion detection system log having similarity with the target intrusion detection system log based on the first log semantic vector, wherein each of the historical intrusion detection system logs corresponds to network intrusion identification data, and the network intrusion identification data is used to reflect whether the government and enterprise gateway corresponding to the historical intrusion detection system log has suffered a network intrusion, and the judgment condition of having similarity includes whether the similarity between the corresponding semantic vectors meets a preset condition; A semantic enhancement module, configured to perform a semantic enhancement operation on the first log semantic vector based on the second log semantic vector and network intrusion identification data corresponding to each of the historical intrusion detection system logs, and output a target log semantic vector corresponding to the first log semantic vector, wherein the second log semantic vector includes local log semantic vectors corresponding to multiple dimensions; The intrusion analysis module is used to analyze the network intrusion analysis data corresponding to the target intrusion detection system log based on the target log semantic vector, wherein the network intrusion analysis data is used to reflect whether the target government and enterprise gateway has suffered a network intrusion.

10. An electronic device, characterized in that: include: Memory for storing computer programs; A processor connected to the memory is used to execute the computer program stored in the memory to implement the artificial intelligence-based government and enterprise gateway log analysis method described in any one of claims 1-8.

Images