Configuration file auditing method, device and equipment based on multiple manufacturers

Abstract

The invention provides a configuration file auditing method, device and equipment based on multiple manufacturers, and the method comprises the steps: analyzing configuration files of different manufacturers, and converting the configuration files into a unified text format; using the command parameter regular expression dictionary to extract command lines in the command block as command line keywords and command line parameters; characterizing the command line keyword into a feature vector in a digital form, inputting the feature vector into a deep learning network, and performing model training to obtain a detection model; and carrying out anomaly detection on the to-be-predicted configuration file by using the detection model, and giving a correct command line configuration option. In this way, common command block and command line rules can be automatically extracted, abnormal redundancy is reduced, the parameter detection accuracy is improved, a correct value is predicted, and the time and energy of manual analysis and error rectification are greatly shortened.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the field of computer security technology, and more particularly to a configuration file auditing method, apparatus and device based on multiple vendors. Background Art

[0002] Since the configuration file formats of different manufacturers are different, it takes a lot of time and effort to analyze the configuration files. At the same time, there are also various types of configuration file anomalies, such as incorrect settings, malicious modifications, etc. Traditional configuration file checks use manual detection to detect errors in the configuration files by checking the configuration commands in the configuration files one by one. Existing detection technologies can achieve automatic low-cost large-scale detection, which reduces the workload of manual inspection and the missed detection rate of incorrect configurations. However, after the detection is completed, manual review and rectification are still required. Therefore, there is an urgent need for a detection method that can complete the configuration error detection of the configuration file and modify the incorrect configuration at the same time, so as to improve the efficiency of the entire process of configuration file detection and configuration file modification.

[0003] For example, the patent: "Configuration file inspection method and device (application number: CN202110219207.8)": obtain a statement set from the configuration file to be checked, and the metadata information of each statement in the statement set; the statement set includes all the statements of the configuration file to be checked, and the statement includes at least one word; adopt a preset semantic feature extraction method to obtain the representation vector of each statement; detect the abnormal representation vector in the representation vector; mark the metadata information of the target sentence, and the target sentence corresponds to the abnormal representation vector. This solution can analyze a large number of configuration files at the same time, mark the files and line numbers that may contain errors, and realize automatic low-cost large-scale detection. While reducing the workload of manual inspection, it reduces the missed detection rate of incorrect configurations, but it does not reduce the labor cost after detection, and manual modification of incorrect configurations is still required. Summary of the invention

[0004] To solve the above problems, the present invention performs regular matching on a large number of configuration files, can automatically extract common command block command line rules, and train the classification model of the command block rules through deep learning, thereby improving the accuracy of the model. The global check used in parameter anomaly detection is combined with the machine learning method of self-association mining to reduce abnormal redundancy, improve parameter detection accuracy and predict the correct value, which greatly reduces the time and effort of manual analysis and error rectification.

[0005] According to an embodiment of the present invention, a method, apparatus and device for auditing configuration files based on multiple vendors are provided.

[0006] In a first aspect of the present invention, a method for auditing configuration files based on multiple vendors is provided.

[0007] The method includes:

[0008] S01: parsing configuration files of different manufacturers and converting the configuration files into a unified text format: using a script to process the configuration files of each manufacturer and converting the configuration files into a command block, wherein the command block includes one or more command lines;

[0009] S02: extracting the command line in the command block into command line keywords and command line parameters using a command parameter regular expression dictionary;

[0010] S03: Characterize the command line keywords into feature vectors in digital form and input them into the deep learning network to perform model training to obtain a detection model;

[0011] S04: Use the detection model to perform anomaly detection on the configuration file to be predicted, and provide correct command line configuration options, wherein the anomaly detection includes: command line keyword detection and command line parameter detection, and the command line parameter detection includes global variable detection and parameter association detection.

[0012] Furthermore, the steps of model training described in S03 are:

[0013] S031: Given a training file, i.e., a large number of normal command line keyword sequences, use a layer containing h LSTM blocks to predict the output of an input sequence w, and add each command line keyword of w to the LSTM block corresponding to the layer;

[0014] S032: Use multiple hidden layers and use the hidden state of the previous layer as the input of each corresponding LSTM block in the next layer to turn the model into a deep LSTM neural network;

[0015] S033: The input layer encodes n commands from all command line keyword types K into one-hot vectors;

[0016] S034: The output layer uses a standard polynomial logic function to convert the output into a probability distribution function. When the model predicts that the command line keywords are significantly different from the actual command line keywords, exceeding the defined threshold, the command configuration is considered abnormal.

[0017] S035: using a statistical algorithm to count the parameters in the same position of the same command line keyword in the training file that appear in all configuration files;

[0018] S036: Use the GPApriori algorithm to train an association rule model based on the rules of frequently co-occurring parameters in the training file.

[0019] Furthermore, the training steps of the association rule model described in S036 are:

[0020] Different command lines and their parameters are represented as a transaction set. Each transaction contains a set of items. If the parameters are the same, it is considered that the parameters of the two or more command lines must be consistent or consistent with a certain probability. Otherwise, a parameter anomaly will be detected.

[0021] Treat each item as a candidate 1-item set and count its support;

[0022] Based on the pruning strategy, candidate k-itemsets are generated, their support is calculated, and frequent k-itemsets are further screened out according to the support count table. This process is repeated until no frequent itemsets can be generated.

[0023] For each frequent item set, generate all possible non-empty subsets as the antecedents of the rule; for each rule antecedent, calculate its corresponding consequent item set, and then calculate the confidence of the rule;

[0024] Filter out association rules that meet the conditions based on the minimum confidence threshold.

[0025] Furthermore, the input described in S031 to S034 is a command sequence, and the output is the command line keyword value immediately following the command sequence. Both the input and output use the gradient descent method to find the minimum loss to update the parameter weights. The loss function used by the command line keyword is the classification cross entropy loss, and the parameter uses the mean square loss to measure the error.

[0026] Furthermore, the command line keyword detection in S04 is used to determine whether the command line keyword corresponding to a command line in a certain line of the new configuration file is normal or abnormal, and if it is abnormal, the most likely normal command line keyword is given.

[0027] Furthermore, the global variable detection described in S04 is used to count the parameters in the same position of the same command line keyword in the training file that appear in all configuration files, so as to detect abnormal parameters and provide correct parameter configuration.

[0028] Furthermore, the parameter association detection described in S04 is used to train an association rule model based on the rules of parameters that frequently co-occur in the training file, and use the association rule model to detect abnormally associated parameters in the configuration file to be predicted, and provide correct parameter configuration.

[0029] Furthermore, when using the detection model described in S04 to perform anomaly detection on the configuration file to be predicted, the adjacent command lines are input into the detection model, and the detection model gives a probability distribution of command line keywords corresponding to a command line, so that it can automatically detect whether the configured command line is abnormal. If it is classified as abnormal, the detection model further detects whether the various parameters corresponding to its command line keywords are abnormal. If abnormal, the detection model predicts the predicted parameters that are closest to the correct parameters.

[0030] In a second aspect of the present invention, a device for auditing configuration files based on multiple vendors is provided.

[0031] The device includes:

[0032] File conversion module: used to parse configuration files of different manufacturers and convert the configuration files into a unified text format: use scripts to process the configuration files of each manufacturer and convert the configuration files into command blocks, wherein the command blocks contain one or more command lines;

[0033] Parameter extraction module: used to extract the command line in the command block into command line keywords and command line parameters using the command parameter regular expression dictionary;

[0034] Model training module: used to characterize command line keywords into digital feature vectors and input them into the deep learning network to perform model training to obtain the detection model;

[0035] Anomaly detection module: used to use the detection model to perform anomaly detection on the configuration file to be predicted and provide the correct command line configuration options. The anomaly detection includes: command line keyword detection and command line parameter detection. The command line parameter detection includes global variable detection and parameter association detection.

[0036] In a third aspect of the present invention, an electronic device is provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method according to the first aspect of the present invention is implemented.

[0037] In a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method according to the first aspect of the present invention is implemented.

[0038] The meanings of the above mentioned English abbreviations:

[0039] LSTM: Long Short-Term Memory, long short-term memory network

[0040] GPApriori: GPU Association Rules, Frequent Item Mining Using GPU

[0041] The present invention performs regular matching on a large number of configuration files, can automatically extract common command block command line rules, and trains a classification model for the command block rules through deep learning, thereby improving the accuracy of the model. From the perspective of parameter anomaly detection, the global check combined with the machine learning method of self-association mining is used to reduce abnormal redundancy, improve parameter detection accuracy and predict correct values, greatly reducing the time and effort of manual analysis and error rectification.

[0042] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings.

[0044] Figure 1 A flow chart of a method for configuration file audit based on multiple vendors according to an embodiment of the present invention is shown;

[0045] Figure 2 A block diagram of a device for multi-vendor configuration file auditing according to an embodiment of the present invention is shown;

[0046] Figure 3 A schematic diagram of a device based on multi-vendor configuration file audit according to an embodiment of the present invention is shown;

[0047] Figure 4 A schematic diagram of a model architecture for anomaly detection based on LSTM according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] According to the implementation mode of the present invention, a method, device and equipment based on multi-vendor configuration file audit are proposed. Regular matching is performed on a large number of configuration files, and common command block command line rules can be automatically extracted. The classification model of the command block rules is trained by deep learning, which improves the accuracy of the model. The global check used in parameter anomaly detection is combined with the machine learning method of self-association mining to reduce abnormal redundancy, improve the accuracy of parameter detection and predict the correct value, which greatly reduces the time and effort of manual analysis and error rectification.

[0050] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0051] Figure 1 1 is a flow chart of a method for auditing configuration files of multiple vendors according to an embodiment of the present invention. The method comprises:

[0052] S01: parsing configuration files of different manufacturers and converting the configuration files into a unified text format: using a script to process the configuration files of each manufacturer and converting the configuration files into a command block, wherein the command block includes one or more command lines;

[0053] S02: extracting the command line in the command block into command line keywords and command line parameters using a command parameter regular expression dictionary;

[0054] S03: Characterize the command line keywords into feature vectors in digital form and input them into the deep learning network to perform model training to obtain a detection model;

[0055] S04: Use the detection model to perform anomaly detection on the configuration file to be predicted, and provide correct command line configuration options, wherein the anomaly detection includes: command line keyword detection and command line parameter detection, and the command line parameter detection includes global variable detection and parameter association detection.

[0056] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0057] In order to explain the above-mentioned method based on multi-vendor configuration file auditing more clearly, a specific embodiment is described below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0058] The following is a specific example to further explain the method of multi-vendor configuration file auditing in more detail:

[0059] S01: Get configuration files from different manufacturers. For Huawei configuration files:

[0060] !cfgFileCrc:1ba06be6

[0061] ! software Version V800R11C10SPC100

[0062] ! Last configuration was updated at 2021-09-1410:43:06UTC

[0063] ! Last configuration was saved at 2021-09-1802:25:09UTC by A

[0064] ! PdtPrivateInfo=System current forwarding-mode:compatible

[0065] !MKHash 0000000000000000

[0066] #

[0067] vpls-pruning-mode tm-switch enable

[0068] #

[0069] clock timezone BeiJing add 08:00:00

[0070] #

[0071] sysname LNSY-MA-CMNET-BAS12-XMME60X

[0072] #

[0073] undo FTp server-source all-interface

[0074] undo FTp ipv6 server-source all-interface

[0075] #

[0076] FTP client-source-a 111.45.128.74

[0077] #

[0078] The configuration file of the烽火 is as follows:

[0079] !

[0080] info-center default log source all

[0081] info-center default trap source all

[0082] info-center source default channel 0 log level errors trap state on level alerts info-center source default channel 1 log level errors trap level alerts

[0083] info-center source default channel 2 log state on level informational trap level alerts

[0084] info-center source default channel 3 log level informational trap state on level alerts

[0085] info-center source default channel 4 log state on trap level alerts

[0086] info-center source default channel 5 trap state on level alerts

[0087] info-center source default channel 6 trap level alerts

[0088] info-center source default channel 7 trap level alerts

[0089] It should be noted that "烽火" here is a specific name in Chinese, and if it has a more accurate English equivalent in the relevant context, it should be replaced accordingly.info-center source default channel 8trap level alerts

[0090] info-center source default channel 9log state on trap level alerts

[0091] info-center console

[0092] info-center snmp

[0093] !

[0094] The configuration files of H3C vendor are as follows:

[0095] #

[0096] ip vpn-instance DCN-ITMS

[0097] route-distinguisher 17633:111

[0098] description DCN-ITMS

[0099] routing-table limit 3000080

[0100] vpn-target 17633:11100import-extcommunity

[0101] vpn-target 17633:11100export-extcommunity

[0102] #

[0103] address-family ipv4

[0104] #

[0105] telnet server enable

[0106] telnet server acl 2999

[0107] telnet server ipv6 acl ipv62999

[0108] #

[0109] Use a script to process each vendor's configuration file and convert it into command blocks.

[0110] Huawei's configuration files are converted to the following format:

[0111] [[! CfgFileCrc:1ba06be6,! Software Version V800R011C10SPC100,! Lastconfiguration was updated at 2021-09-1410:43:06UTC,! Last configuration was saved at 2021-09-1802:25:09UTC by mengqingkaisy,! PdtPrivateInfo=Systemcurrent forwarding-mode:compatible,! MKHash 0000000000000000],

[0112] [vpls-pruning-mode tm-switch enable],

[0113] [clock timezone BeiJing add 08:00:00],

[0114] [sysname LNSY-MA-CMNET-BAS12-XMME60X],

[0115] [undo FTP server-source all-interface,undo FTP ipv6 server-sourceall-interface],

[0116] [FTP client-source-a 111.45.128.74]].

[0117] The configuration file of Fenghuo is converted to the following format:

[0118] [[info-center default log source all,

[0119] info-center default trap source all,

[0120] info-center source default channel 0log level errors trap state onlevel alerts,info-center source default channel 1log level errors trap levelalerts,

[0121] info-center source default channel 2log state on level informationaltrap level alerts,

[0122] info-center source default channel 3log level informational trapstate on level alerts,

[0123] info-center source default channel 4log state on trap level alerts,

[0124] info-center source default channel 5trap state on level alerts,

[0125] info-center source default channel 6trap level alerts,

[0126] info-center source default channel 7trap level alerts,

[0127] info-center source default channel 8trap level alerts,

[0128] info-center source default channel 9log state on trap level alerts,

[0129] info-center console,

[0130] info-center snmp]]

[0131] The configuration file of H3C manufacturer is converted to the following format:

[0132] [[ip vpn-instance DCN-ITMS,

[0133] route-distinguisher 17633:111,

[0134] description DCN-ITMS,

[0135] routing-table limit 3000080,

[0136] vpn-target 17633:11100import-extcommunity,

[0137] vpn-target 17633:11100export-extcommunity,

[0138] address-family ipv4,

[0139] telnet server enable,

[0140] telnet server acl 2999,

[0141] telnet server ipv6 acl ipv62999, ]]

[0143] S02: Use the regular expression provided by the expert to extract parameters from the original command line:

[0144] The regular expression provided by the expert is as follows:

[0145] {"{MARK}":"[^\\s]*[A-Z]+[^\\s]*","{NUM}":"(?<=\\s)\\d*(?=\\s)","{tailNUM}":"(?<=\\s)\\d*\\d$","{IP-IPV4}":"[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}","{HTTP}":"http[^\\s]*","{EthTrunk}": "Eth-Trunk[^\\s]*","{ADDRESS}":"(?=\\w*\\d)[^\\s]{4}-(?=\\w*\\d)[^\\s]{4}-(?=\\w*\\d)[^\\s]{4}", "{DAY}":"[0-9]{4}(-[0-9]{2}){2}","{TIME}":"[0-9]{2}(:[0-9]{2}){2}","{ZONE}":"(?<=\\+)[0-9]{2}:[0-9]{2}","{NAME}":"(?<=by\\s)[^\\s]*","{PORT}":"\\d{5}:\\d*", "{DESCRIP}": "(?<=description\\s).*", "{LIMIT}":"(?<=\\s)[^\\s]*\\d+[m|M]$", "{fivePORT}":"[^\\s]{1,4}:[^\\s]{1,4}:[^\\s]{1,4}:[^\\s]{1,4}::[^\\s]*", "{DEV}":"[^\\s]*-\\d+(?=\\s)", "{IP-IPV6}":"^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.<h2 style=";text-align:left;direction:ltr">(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}( ((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0- 4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1, 4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){ 3}))|:))|(:((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2 [0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?\\s*$","{CHAR} ":"[^\\s]*\\d{2,}[^\\s]*|(?=\\w*?[!@#$%^&* / _])[^\\s]{2,}"}.<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0146] After regular expression matching, command line keywords are extracted. Each line is regarded as a command line keyword. The command line keywords and command line parameters obtained after Huawei configuration file extraction are as follows:

[0147] ip vpn-instance{MARK},

[0148] ipv4-family,

[0149] route-distinguisher{PORT},

[0150] apply-label per-instance,

[0151] vpn-target{PORT}export-extcommunity,

[0152] vpn-target{PORT}import-extcommunity

[0153] It is transformed into a feature vector in the form of numbers: [1,3,5,2,10.11]

[0154] The command line keywords and command line parameters obtained after extracting the Fenghuo configuration file are as follows:

[0155] info-center default log source all,

[0156] info-center default trap source all,

[0157] info-center source default channel{NUM}log level errors trap state onlevel alerts,

[0158] info-center source default channel{NUM}log level errors trap levelalerts,

[0159] info-center source default channel{NUM}log state on levelinformational trap level alerts,

[0160] info-center source default channel{NUM}log level informational trapstate on level alerts,

[0161] info-center source default channel{NUM}log state on trap levelalerts,

[0162] info-center source default channel{NUM}trap state on level alerts,

[0163] info-center source default channel{NUM}trap level alerts,

[0164] info-center source default channel{NUM}trap level alerts,

[0165] info-center source default channel{NUM}trap level alerts,

[0166] info-center source default channel{NUM}log state on trap levelalerts,

[0167] info-center console,

[0168] info-center snmp

[0169] It is featurized into a feature vector in the form of numbers: [10,8,14,7,11,13,18,20,21,37,36,32,30,21]

[0170] The command line keywords and command line parameters obtained after extracting the configuration file of the H3C manufacturer are as follows:

[0171] ip vpn-instance{MARK},

[0172] route-distinguisher{MARK},

[0173] description{MARK},

[0174] routing-table limit{NUM}{tailNUM},

[0175] vpn-target{MARK}import-extcommunity,

[0176] vpn-target{MARK}export-extcommunity,

[0177] address-family ipv4,

[0178] telnet server enable,

[0179] telnet server acl{tailNUM},

[0180] telnet server ipv6 acl ipv6{tailNUM}

[0181] It is featurized into a feature vector in the form of numbers: [1,5,4,9,10,13,18,20,21,33]

[0182] S03: Use deep learning to train the learned command keyword rules:

[0183] First, a large number of normal command line keyword sequences are given and then input into the LSTM model for training. A detection model is obtained. When detecting a new configuration file, a command line keyword sequence is obtained after command parsing and feature extraction. Then the LSTM model is used to predict the possibility of the next command line keyword in the sequence. If the next command in the actual situation has a higher probability in the possibility distribution, then this command is considered to be a normal command. Otherwise, it is judged as abnormal and a command with a high probability is given.

[0184] During the training phase, the model needs to find the appropriate weight distribution so that the final output of the LSTM sequence produces the required label and is output together with the input in the training dataset. During the training process, each input and output uses the gradient descent method to find the minimum loss to update these parameter weights. The input is a command sequence, and the output is the command line keyword value immediately following this command sequence. During training, the loss function used by the command line keyword is the classification cross entropy loss, and the parameter uses the mean square loss to measure the error.

[0185] In the detection phase, a layer containing h LSTM blocks is used to predict the output of an input sequence w, and each command line keyword of w is added to the LSTM block corresponding to the layer. Multiple hidden layers are used, and the hidden state of the previous layer is used as the input of each corresponding LSTM block in the next layer, turning the model into a deep LSTM neural network. The input layer encodes n commands from all command line keyword types K into one-hot vectors. The output layer uses a standard multinomial logistic function to convert the output into a probability distribution function. When the model predicts a large difference between the command line keyword and the actual command line keyword, exceeding the defined threshold, it is determined that the command configuration is abnormal.

[0186] The model architecture for anomaly detection based on LSTM is shown in the figure above. The top of the figure shows an LSTM module, and repeated LSTM blocks make up the entire architecture. Each LSTM module records a state as a vector of fixed dimension. The state of the LSTM module from the previous time step and its external input mt-i will be used as the input of the next LSTM module to calculate the new state and output. This method ensures that the command information in the command sequence can be passed to the next LSTM block.

[0187] A series of LSTM blocks form an unfolded form of the recurrent pattern in a layer, such as Figure 4 Each cell keeps a hidden vector Ht-i and a cell state vector Ct-i, both of which are passed to the next block to initialize its state. For each command line keyword in the input sequence w, one LSTM block is used. Therefore, a single layer consists of h unfolded LSTM blocks. In a single LSTM block, the input mt-i and the output Ht-i-1 of the previous block can determine:

[0188] (1) The degree to which the previous cell state Ct-i-1 is retained in state Ct-i

[0189] (2) How to use current input and previous output to affect the state

[0190] (3) How to construct the output Ht-i

[0191] LSTM is determined using a set of gate functions that determine the state by controlling the state retained by the previous LSTM block and the output information in the previous block and the input information flow of the current block. Each gate function is parameterized by a set of weights to be learned.

[0192] Through data verification, it is generally concluded that selecting h=10, num_layers=2 and hidden_size=64 as the benchmark parameters can achieve better performance. Different manufacturers can adjust these parameters according to actual conditions to obtain better results.

[0193] After the model is trained for each manufacturer, in the prediction stage, the model will be used to determine whether the command line key corresponding to a certain line of command line in the new configuration file is normal or abnormal. If it is abnormal, the most likely normal command line keyword will be given. Therefore, the model can detect abnormal command line keywords.

[0194] After the command line keyword detection is completed, the accumulation of command parameter rules in the historical configuration files is used to determine whether it is a global variable. Through data analysis, it is found that the command line parameters of the configuration file will vary greatly depending on the device configuration file. Therefore, most of the parameters in the configuration file cannot be detected by training a model based on the configuration file parameters. The previous method only identified parameter anomalies through statistics of historical configuration file parameters, which would result in a large number of detected parameter anomalies and cause confusion to users. Therefore, configuration file parameter detection can be detected from two angles:

[0195] Global variable detection: Count the parameters in the same position of the same command line keyword in the training file that appear in all configuration files to detect abnormal parameters and give the correct parameter configuration.

[0196] Parameter association detection: train an association rule model based on the rules of parameters that frequently co-occur in training files.

[0197] For global variable detection, statistical methods are used, and for parameter association detection, the GPApriori algorithm is used. This algorithm is an association rule mining method, which is an improvement and optimization of the classic Apriori algorithm. Association rule mining is to find frequent occurrence patterns between items in large-scale data sets, usually in the fields of data mining. The principle and usage of the GPApriori algorithm are as follows:

[0198] Principle: The GPApriori algorithm has been improved in two main aspects: pruning strategy and counting strategy. These improvements are aimed at reducing the generation and comparison of candidate item sets, thereby improving the efficiency of the algorithm.

[0199] Pruning strategy: The GPApriori algorithm uses a more sophisticated pruning strategy. In the traditional Apriori algorithm, the support count of the item set is calculated separately in each iteration, resulting in a large amount of redundant calculations. The GPApriori algorithm introduces a global support count table, and in each iteration, only counts the items whose support may be greater than or equal to the minimum support threshold. This can greatly reduce the amount of calculation.

[0200] Counting strategy: The GPApriori algorithm uses a bitmap-based counting strategy that maps each item and each transaction into a bitmap. In this way, support can be efficiently counted through bit operations. This counting strategy can reduce memory consumption and computational overhead.

[0201] The general steps for using the GPApriori algorithm for association rule mining are as follows:

[0202] Data preparation: The data set is represented as a set of transactions, each transaction contains a set of items. The data set in this scenario is different command lines and their parameters. If the parameters are the same, the parameters of the two or more command lines of the task must be consistent or consistent with a certain probability, otherwise parameter anomalies will be detected.

[0203] Set algorithm parameters: determine the minimum support threshold and the minimum confidence threshold. These thresholds will be used to filter out frequent item sets and generate association rules.

[0204] Phase 1: Frequent Itemset Mining:

[0205] Initialization: treat each item as a candidate 1-item set and count its support;

[0206] Iteration: Based on the pruning strategy, generate candidate k-item sets and calculate their support. According to the support count table, further filter out frequent k-item sets. Repeat this process until no more frequent item sets can be generated.

[0207] Phase 2: Association rule generation:

[0208] For each frequent item set, generate all possible non-empty subsets of it as the antecedents of the rule;

[0209] For each rule antecedent, calculate its corresponding consequent item set, and then calculate the confidence of the rule;

[0210] Filter out association rules that meet the conditions based on the minimum confidence threshold.

[0211] Analyze the generated association rules, identify valuable rules based on indicators such as confidence and support, and use these rules to detect abnormal parameters associated with the configuration files to be predicted, and give the correct parameter configuration.

[0212] S04: Use this model to detect anomalies in the command line in the command block of the new configuration file. Here we take the configuration file of Huawei as an example:

[0213] Some sample contents of Huawei normal configuration file:

[0214] #

[0215] sysname GD-CZ-CA-MSE-1.MAN.NE40E

[0216] #

[0217] load-balance unequal-cost enable

[0218] Some sample contents of Huawei abnormal configuration file:

[0219] #

[0220] load-balance unequal-cost enable

[0221] load-balance unequal-cost abc

[0222] #

[0223] The following anomalies can be detected:

[0224] <begin>

[0225] <row_num>[(19,20)]

[0226] <correct_paragraph>[load-balance unequal-cost enable']

[0227] <current_paragraph>[load-balance unequal-cost enable','load-balanceunequal-cost abc']

[0228] <error_reason>['Different keywords']

[0229] <error_info>['load-balance unequal-cost abc']

[0230] <end>

[0231] <begin>

[0232] <row_num>[(-1,-1)]

[0233] <correct_paragraph>No matching items

[0234] <current_paragraph>[]

[0235] <error_reason>['Missing Command Block']

[0236] <error_info>[]

[0237] <end>

[0238] Each of these <begin>and <end>Indicates a detected exception, which can be a command block exception, command line exception, or parameter exception.<row_num> Indicates the line number of the error,<correct_paragraph> To configure the file line correctly,<current_paragraph> is the current configuration file line,<error_reason> Indicates the error type.<error_info> Indicates error details.

[0239] Based on the same inventive concept, the present invention also proposes a device for auditing configuration files of multiple vendors. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. Figure 2 As shown, the device 100 includes:

[0240] File conversion module 101: used to parse configuration files of different manufacturers and convert the configuration files into a unified text format: use scripts to process the configuration files of each manufacturer and convert the configuration files into command blocks, wherein the command blocks contain one or more command lines;

[0241] Parameter extraction module 102: used to extract the command line in the command block into command line keywords and command line parameters using the command parameter regular expression dictionary;

[0242] Model training module 103: used to characterize the command line keywords into feature vectors in digital form and input them into the deep learning network to perform model training to obtain a detection model;

[0243] Anomaly detection module 104: used to use the detection model to perform anomaly detection on the configuration file to be predicted and provide the correct command line configuration options. The anomaly detection includes: command line keyword detection and command line parameter detection. The command line parameter detection includes global variable detection and parameter association detection.

[0244] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0245] like Figure 3 As shown, the device includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for the operation of the device can also be stored. The CPU, ROM and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0246] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0247] The processing unit performs the various methods and processes described above, such as methods S01 to S04. For example, in some embodiments, methods S01 to S04 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of methods S01 to S04 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to perform methods S01 to S04 in any other appropriate manner (e.g., by means of firmware).

[0248] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip systems (SOCs), load programmable logic devices (CPLDs), and the like.

[0249] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0250] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0251] In addition, although each operation is described in a specific order, this should be understood as requiring such operation to be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations should be performed to obtain desired results. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present invention. Some features described in the context of a separate embodiment can also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation can also be implemented in multiple implementations individually or in any suitable sub-combination mode.

[0252] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.< / end> < / begin> < / end> < / begin> < / end> < / begin>

Claims

1. A method for auditing configuration files of multiple vendors, characterized in that: The method includes: S01: parsing configuration files of different manufacturers and converting the configuration files into a unified text format: using a script to process the configuration files of each manufacturer and converting the configuration files into a command block, wherein the command block includes one or more command lines; S02: extracting the command line in the command block into command line keywords and command line parameters using a command parameter regular expression dictionary; S03: Characterize the command line keywords into feature vectors in digital form and input them into the deep learning network to perform model training to obtain a detection model; S04: Use the detection model to perform anomaly detection on the configuration file to be predicted, and provide correct command line configuration options, wherein the anomaly detection includes: command line keyword detection and command line parameter detection, and the command line parameter detection includes global variable detection and parameter association detection.

2. The method for auditing configuration files based on multiple vendors according to claim 1, characterized in that: The specific steps of model training described in S03 are: S031: Given a training file, i.e., a large number of normal command line keyword sequences, use a layer containing h LSTM blocks to predict the output of an input sequence w, and add each command line keyword of w to the LSTM block corresponding to the layer; S032: Use multiple hidden layers and use the hidden state of the previous layer as the input of each corresponding LSTM block in the next layer to turn the model into a deep LSTM neural network; S033: The input layer encodes n commands from all command line keyword types K into one-hot vectors; S034: The output layer uses a standard polynomial logic function to convert the output into a probability distribution function. When the model predicts that the command line keywords are significantly different from the actual command line keywords, exceeding the defined threshold, the command configuration is considered abnormal. S035: using a statistical algorithm to count the parameters in the same position of the same command line keyword in the training file that appear in all configuration files; S036: Use the GPApriori algorithm to train an association rule model based on the rules of frequently co-occurring parameters in the training file.

3. The method for auditing configuration files based on multiple vendors according to claim 2, characterized in that: The training steps of the association rule model described in S036 are: Different command lines and their parameters are represented as a transaction set. Each transaction contains a set of items. If the parameters are the same, it is considered that the parameters of the two or more command lines must be consistent or consistent with a certain probability. Otherwise, a parameter anomaly will be detected. Treat each item as a candidate 1-item set and count its support; Based on the pruning strategy, candidate k-itemsets are generated, their support is calculated, and frequent k-itemsets are further screened out according to the support count table. This process is repeated until no frequent itemsets can be generated. For each frequent item set, generate all possible non-empty subsets of it as the antecedents of the rule; For each rule antecedent, calculate its corresponding consequent item set, and then calculate the confidence of the rule; Filter out association rules that meet the conditions based on the minimum confidence threshold.

4. The method for auditing configuration files based on multiple vendors according to claim 2, characterized in that: The input described in S031~S034 is to characterize the command line keywords into feature vectors in digital form and input them into the deep learning network. The output is the digital value of the keyword of the command line following the command sequence. Both the input and output use the gradient descent method to find the minimum loss to update the parameter weights. The command line keywords use classification cross entropy loss to reduce the gap between the model's prediction results and the actual targets. The parameters use mean square loss to measure the error.

5. The method for auditing configuration files based on multiple vendors according to claim 1, characterized in that: The command line keyword detection described in S04 is used to determine whether the command line keyword corresponding to a command line in a certain line of the new configuration file is normal or abnormal. If it is abnormal, the most likely normal command line keyword is given.

6. The method for auditing configuration files based on multiple vendors according to claim 1, characterized in that: The global variable detection described in S04 is used to count the parameters in the same position of the same command line keyword in the training file that appear in all configuration files, so as to detect abnormal parameters and give correct parameter configuration.

7. The method for auditing configuration files based on multiple vendors according to claim 1, characterized in that: The parameter association detection described in S04 is used to train an association rule model based on the rules of parameters that frequently co-appear in the training file, and use the association rule model to detect abnormally associated parameters in the configuration file to be predicted, and give the correct parameter configuration.

8. The method for auditing configuration files based on multiple vendors according to claim 1, characterized in that: When using the detection model described in S04 to perform anomaly detection on the configuration file to be predicted, the adjacent command lines are input into the detection model, and the detection model gives a probability distribution of command line keywords corresponding to a command line, so that it can automatically detect whether the configured command line is abnormal. If it is classified as abnormal, the detection model further detects whether the various parameters corresponding to its command line keywords are abnormal. If abnormal, the detection model predicts the predicted parameters that are closest to the correct parameters.

9. A device for auditing configuration files of multiple vendors, characterized in that: The device includes: File conversion module: used to parse configuration files of different manufacturers and convert the configuration files into a unified text format: use scripts to process the configuration files of each manufacturer and convert the configuration files into command blocks, wherein the command blocks contain one or more command lines; Parameter extraction module: used to extract the command line in the command block into command line keywords and command line parameters using the command parameter regular expression dictionary; Model training module: used to characterize command line keywords into digital feature vectors and input them into the deep learning network to perform model training to obtain the detection model; Anomaly detection module: used to use the detection model to perform anomaly detection on the configuration file to be predicted and provide the correct command line configuration options. The anomaly detection includes: command line keyword detection and command line parameter detection. The command line parameter detection includes global variable detection and parameter association detection.

10. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images