A multi-source log association fusion method, system, device and medium based on security behavior semantic analysis

Abstract

This invention provides a method, system, device, and medium for multi-source log association and fusion based on security behavior semantic analysis. The method includes: using acquired original multi-source host logs as input to a pre-built BERT basic model to obtain attributes corresponding to each log text; constructing a preliminary association graph corresponding to the original multi-source host log texts; mapping the original multi-source host log texts using custom log semantic descriptive attributes to obtain a deep semantic attribute space; constructing a deep semantic information association graph using the obtained preliminary association graph and deep semantic attribute space; performing cluster analysis on the obtained deep semantic information association graph to obtain multiple sub-communities; and performing semantic fusion feature analysis on the obtained sub-communities to obtain a security event description corresponding to the original multi-source host logs. This invention not only effectively solves the problems of information loss and semantic understanding difficulties in multi-source heterogeneous logs but also significantly improves the log association analysis capability.

Description

Technical Field

[0001] This invention belongs to the field of multi-source log correlation analysis in the industrial internet, and specifically relates to a multi-source log correlation and fusion method, system, device and medium based on security behavior semantic analysis. Background Technology

[0002] With the rapid development of informatization and intelligentization, the internet has deeply penetrated all aspects of social production and life, bringing convenience to people while also posing significant security risks. For example, the MOVEitTransfer data breach in 2023 resulted in ransomware attacks on 2,706 organizations and the leakage of personal data from over 93 million people, exposing the inadequacies of current cybersecurity protection.

[0003] To enhance the security capabilities of information systems, enterprise networks commonly deploy security devices such as firewalls, intrusion detection systems, and intrusion prevention systems. They also utilize network security situational awareness platforms to aggregate massive amounts of security logs, enabling real-time security situational awareness and protection of the system network. However, with the increasing complexity of network scenarios and the diversification of security devices, security logs exhibit the following characteristics: massive data volume, wide range of sources, high heterogeneity, and high false positive rate. This makes it extremely difficult to quickly discover hidden real security threats from the logs.

[0004] To address this issue, numerous studies have attempted to automate log analysis using machine learning and deep learning techniques, primarily focusing on log parsing, anomaly detection, and log compression. However, existing methods still face two major challenges:

[0005] 1. Missing and difficult-to-understand log information: Alarm logs generated by security devices usually depend on specific network environments and levels, lack contextual information, and do not provide a comprehensive description of network events, making it difficult for staff to accurately assess threats and resulting in poor interpretability.

[0006] 2. Large volume of logs makes it difficult to extract useful information: During security incident analysis and attribution, staff need to perform correlation analysis on multi-source, heterogeneous security logs. However, the log types are numerous and their semantic differences are significant. Even experienced engineers need to spend a lot of time filtering out useful logs and completing correlation analysis.

[0007] Therefore, there is an urgent need to study a fusion representation method for multi-source heterogeneous security logs to improve the semantic association analysis capability of massive log data, achieve accurate source tracing and rapid response to security events, and thus further enhance the security protection capability of the system. Summary of the Invention

[0008] The purpose of this invention is to provide a method, system, device, and medium for multi-source log association and fusion based on security behavior semantic analysis, which solves the shortcomings of existing network security protection, such as missing log information, difficulty in understanding, and large number of logs, making it difficult to extract effective information.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] This invention provides a multi-source log association and fusion method based on security behavior semantic analysis, comprising the following steps:

[0011] Step 1: Use the obtained raw multi-source host logs as input to the pre-built BERT base model to obtain the attributes corresponding to each log text;

[0012] Step 2: Use custom log basic attributes to perform preliminary association of the original multi-source host logs to construct a preliminary association graph corresponding to the original multi-source host log text;

[0013] By using custom log semantic descriptive attributes, the original multi-source host log text is mapped to obtain a deep semantic attribute space;

[0014] Step 3: Construct a deep semantic information association graph using the obtained preliminary association graph and deep semantic attribute space;

[0015] Step 4: Perform cluster analysis on the obtained deep semantic information association graph to obtain multiple sub-communities;

[0016] Step 5: Semantic fusion features are performed on the obtained sub-communities to obtain the security event descriptions corresponding to the original multi-source host logs.

[0017] Preferably, the method for constructing the BERT base model is as follows:

[0018] Build the initial BERT base model;

[0019] The obtained raw multi-source host logs are segmented and labeled to obtain a labeled dataset;

[0020] The initial BERT base model was optimized using the obtained labeled dataset to obtain the optimized BERT base model.

[0021] Preferably, the obtained raw multi-source host logs are segmented and labeled to obtain a labeled dataset. The specific method is as follows:

[0022] Each log text in the obtained raw multi-source host logs is segmented into words based on spaces;

[0023] Each word segment obtained is labeled using the BIO labeling format. The labeling categories include template static words and variable parameters. Variable parameters include object ID, location identifier, object name, type identifier, switch indicator, action duration, computing resources, number of objects, status code, and others. The location identifier includes source IP, source port, destination IP, destination port, and file path. The object name is the username.

[0024] The original words of the template static words and the category names of the variable parameters are combined to obtain the labeled dataset.

[0025] Preferably, custom log base attributes are used to initially associate the original multi-source host logs, constructing a preliminary association graph corresponding to the original multi-source host logs. The specific method is as follows:

[0026] The custom-obtained log basic attributes are core fields used to identify and describe key information in the logs during security behavior analysis. These attributes are unique identifiers and can reflect the basic characteristics of log records.

[0027] By utilizing the intersection of basic security behavior attributes among logs, a preliminary association is made between the original multi-source host logs to obtain a preliminary association graph corresponding to the original multi-source host logs.

[0028] Preferably, the original multi-source host log text is mapped using custom log semantic descriptive attributes to obtain a deep semantic attribute space. Specifically, the method is as follows:

[0029] The custom-obtained log semantic descriptive attributes are attributes with natural language features in the original multi-source host logs, and the description of the same event varies depending on the source of the original multi-source host logs.

[0030] Based on custom semantic description attributes, the original multi-source security logs are mapped to obtain a deep semantic attribute space.

[0031] Preferably, the nodes of the deep semantic information association graph are sets of log texts with the same log semantic descriptive attributes in the deep semantic attribute space; the edges of the deep semantic information association graph are the basic attribute associations between log texts contained in two deep semantic nodes, and the weight of the edge of the deep semantic information association graph is the number of basic attribute associations.

[0032] Preferably, the obtained multiple sub-communities are semantically fused to obtain the security event descriptions corresponding to the original multi-source host logs. Specifically, the method is as follows:

[0033] The suggestion design method based on the ICIO framework performs semantic fusion features on the obtained multiple sub-communities to obtain the result of the original multi-source host log association fusion and the corresponding security event description.

[0034] A multi-source log association and fusion system based on security behavior semantic analysis includes:

[0035] The log attribute acquisition unit is used to take the acquired raw multi-source host logs as input to the pre-built BERT base model and obtain the attributes corresponding to each log text.

[0036] The association graph construction unit is used to perform preliminary association of the original multi-source host logs using custom log basic attributes, and to construct a preliminary association graph corresponding to the original multi-source host log text.

[0037] At the same time, it is used to map the original multi-source host log text using custom log semantic descriptive attributes to obtain a deep semantic attribute space;

[0038] The association graph construction unit is used to construct a deep semantic information association graph using the obtained preliminary association graph and deep semantic attribute space;

[0039] The clustering analysis unit is used to perform clustering analysis on the obtained deep semantic information association graph to obtain multiple sub-communities;

[0040] The semantic fusion unit is used to perform semantic fusion features on the obtained multiple sub-communities to obtain the security event descriptions corresponding to the original multi-source host logs.

[0041] A computer-readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the method.

[0042] A computing device, comprising:

[0043] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include steps for performing the method.

[0044] Compared with the prior art, the beneficial effects of the present invention are:

[0045] This invention provides a multi-source log association and fusion method based on security behavior semantic analysis. It obtains key attributes corresponding to each log text in the original multi-source host logs using the BERT basic model. Then, it processes the original multi-source host logs by combining custom log basic attributes and log semantic descriptive attributes with the attributes corresponding to each log text, constructing the association relationship between the original multi-source host log items and mining deep semantic associations. This solves the problem of missing log information in existing network security protection. The resulting multiple sub-communities are semantically fused to generate a log fusion representation describing the same security behavior, addressing the shortcomings of existing network security protection methods, such as difficulty in understanding the logs, large log volumes, and difficulty in extracting effective information. This invention not only effectively solves the problems of missing information and difficult semantic understanding in multi-source heterogeneous logs but also significantly improves the log association analysis capability, helping staff quickly discover potential security threats, accurately trace incidents, and greatly improve the efficiency of detecting and judging complex network attacks. Attached Figure Description

[0046] Figure 1 This is an overall flowchart of the multi-source log association and fusion method based on security behavior semantic analysis of the present invention;

[0047] Figure 2 This is the annotation result of the original multi-source host logs, taking the auth log as an example. Detailed Implementation

[0048] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0049] Example 1

[0050] Figure 1 This is a flowchart illustrating the overall process of the multi-source log association and fusion method based on security behavior semantic analysis proposed in this embodiment, demonstrating the basic framework of this method for multi-source log association analysis in the industrial internet scenario.

[0051] This embodiment provides a multi-source log association and fusion method based on security behavior semantic analysis, including the following steps:

[0052] Step 1: Perform word segmentation and annotation on the obtained raw multi-source host logs to obtain an annotated dataset;

[0053] To train a model capable of recognizing word segmentation categories in raw multi-source host logs (including template static words and various types of variable parameters), the raw multi-source host log data first needs to be segmented and labeled. The purpose of word segmentation is to divide the log text into multiple independent words based on spaces, preparing for subsequent labeling.

[0054] After word segmentation, the results need to be labeled. The goal of labeling is to classify the segmented log words according to their semantic categories, including template static words and various types of variable parameters. Template static words represent fixed structural parts of the log, while variable parameters represent dynamically changing information. By labeling the log content, a high-quality labeled dataset can be generated for subsequent model training.

[0055] To achieve accurate annotation, this embodiment references the definition of variable parameter types in "Did We Miss Something Important? Studying and Exploring Variable-Aware Log Abstraction" (in this embodiment, variable parameters are divided into 10 categories, including object ID, location identifier, object name, type identifier, switch indicator, duration of action, computing resources, number of objects, status code, and others). Furthermore, based on the analysis requirements of network attack and defense scenarios and combined with the security behavior semantic information in the original multi-source host logs, the original type definitions have been adjusted. Unlike the original category division, this embodiment re-divides two categories, "location indicator" and "object name," into 6 subcategories, as detailed in the table below:

[0056] Table 1 Classification of Variable Parameters in Original Multi-Source Host Logs

[0057]

[0058] Based on the above log segmentation type definition, the category of each segment is labeled using the BIO format. For example... Figure 2 As shown, taking the auth log "Disconnected from username Jerrold.reddick 10.0.254.202 port 37198" as an example, the type of each word segment is labeled:

[0059] Username Jerrold.reddick, categorized as B- <username>;

[0060] IP address 10.0.254.202 is classified as B- <sip>(Source IP);

[0061] Port number 37198 is labeled as category B- <sport>(Source port).

[0062] The remaining word segmentation tagging categories are <o>(Template static words).

[0063] Based on the above annotation rules, the log content is further converted into a log template by combining the original words of the template static words and the category name of the variable parameters: Disconnected from username B- <username> B- <sip>port B- <sport>This resulted in an accurate labeled dataset.

[0064] Step 2: Use the obtained raw multi-source host logs as input to the pre-built BERT base model to obtain the attributes corresponding to each log text.

[0065] Construct an initial BERT base model; optimize the initial BERT base model using the labeled dataset obtained in step 1 to obtain the optimized BERT base model, specifically:

[0066] Model Architecture: The core structure of this initial BERT base model consists of a multi-layer Transformer encoder, capable of capturing the contextual semantic features of the input text. A linear classifier layer is added on top of this to label characters or words at each position, adapting to named entity recognition tasks. This architecture can efficiently identify static words and variable parameter types from log text, supporting subsequent behavioral semantic analysis.

[0067] Loss Function and Optimizer: To evaluate the difference between the model's predictions and the true labels, the cross-entropy loss function was chosen as the objective function during training. Cross-entropy loss effectively handles multi-class classification problems, ensuring the model's accuracy in predicting different class labels. Regarding the optimizer, this embodiment uses the AdamW optimizer, which incorporates a weight decay mechanism and is more suitable for training deep learning models compared to the traditional Adam optimizer. Furthermore, to improve the model's training performance, a learning rate scheduler is introduced to dynamically adjust the learning rate during training, accelerating model convergence and avoiding getting trapped in local optima.

[0068] Model Training: During the model training phase, mini-batch gradient descent is used for efficient training on large-scale multi-source log data. To avoid gradient explosion, a gradient pruning strategy is introduced during training to limit the maximum norm of the gradient, thereby ensuring model stability. The specific training process is as follows:

[0069] Forward propagation: Batch multi-source log data is input into the model, and after passing through the BERT encoder and linear classifier, a predicted label for each location is generated.

[0070] Loss calculation: Calculate the cross-entropy loss function value based on the predicted label and the true label.

[0071] Backpropagation: Calculate the gradient using the loss function value and update the model parameters through backpropagation.

[0072] Parameter optimization: The AdamW optimizer is used to update the model weights, and the learning rate is dynamically adjusted through the learning rate scheduler.

[0073] Log Parsing and Structuring: The trained and fine-tuned model possesses the ability to efficiently parse log text. In the application phase, this model is used to parse the acquired raw multi-source host logs. The parsing results are shown in the table below, revealing the category of each word segment (i.e., source IP, source port, and username in the table). Then, the static template words and the categories of the variable parameters are combined to generate a log template. Each field in the table represents an attribute corresponding to each raw log text in the raw multi-source host logs.

[0074] Table 2 shows examples of results from parsing unstructured logs into structured data.

[0075]

[0076] This log parsing method based on behavioral semantic understanding not only automates the processing of complex log information but also provides unified structured data support for subsequent security behavior analysis.

[0077] Step 3: Use custom log basic attributes to perform preliminary association of the original multi-source host logs, and construct a preliminary association graph corresponding to the original multi-source host log text.

[0078] First, to establish relationships between multi-source logs, we define custom log basic attributes. These attributes are core fields used to identify and describe critical information in logs during security behavior analysis. These attributes include, but are not limited to, timestamps, hostnames, host IPs, process PIDs, service names, source IPs, destination IPs, source ports, and destination ports. These attributes are unique identifiers that reflect the basic characteristics of log records, providing fundamental support for the analysis and judgment of security behaviors.

[0079] Logs triggered by the same security event will necessarily have the same basic attributes. For example, an SSH connection failure may be recorded in multiple security logs, but the basic attributes of these logs (such as hostname, timestamp, source IP, source port, etc.) will definitely be the same.

[0080] Secondly, this embodiment first utilizes the intersection of the basic attributes of security behaviors between logs to perform preliminary association of the original multi-source host logs, thereby obtaining a preliminary association diagram corresponding to the original multi-source host logs.

[0081] Step 4: Construct a deep semantic information association graph using the obtained preliminary association graph and deep semantic attribute space.

[0082] First, we define custom log semantic descriptive attributes. These attributes refer to natural language-like properties in the original multi-source host logs, such as log templates and attack types. Unlike basic log attributes, these attributes can describe the same event significantly differently depending on the original log source. Although these attributes are valuable for human log analysis, their semantic complexity and diversity make them difficult for machines to understand directly. Therefore, we define these attributes, which are crucial for log analysis but difficult for machines to process, as deep semantic information.

[0083] In order to accurately identify security events and achieve efficient source tracing, this embodiment maps the original multi-source security logs based on custom semantic description attributes to obtain a deep semantic attribute space.

[0084] A deep semantic information association graph is constructed using a deep semantic attribute space and a preliminary association graph. In this graph, the nodes represent the set of log texts with the same log semantic descriptive attributes in the deep semantic attribute space, the edges represent the basic attribute associations between the log texts contained in two deep semantic nodes, and the weight of the edges represents the number of basic attribute associations, which is used to measure the strength of the association between different deep semantic information.

[0085] Based on the construction of a deep semantic information association graph, the Louvain graph clustering algorithm was used to cluster and divide the graph, resulting in multiple sub-communities. This algorithm groups highly correlated deep semantic information into the same community, identifying log sets describing the same type of security behavior. For example, in an SSH scan, the network alert log might record "suspected port scan behavior," while the original multi-source host log might record "multiple SSH login failures." By constructing a deep semantic association graph and performing cluster analysis, when these events are grouped into the same sub-community, it can be inferred that the attacker's behavior at this time is an SSH port scan combined with a brute-force attack.

[0086] In this way, this embodiment achieves the correlation and unified modeling of heterogeneous security logs from different sources at a deep semantic level. This cross-semantic correlation reveals the underlying behavioral logic behind security events, helping to understand complex security events more comprehensively. For example, the combination of network layer logs and host layer logs can completely reconstruct the attacker's behavioral chain, while the joint analysis of multi-source logs improves the accuracy and efficiency of abnormal behavior identification, thus providing strong support for the detection and tracing of complex network security events.

[0087] Step 5: Perform semantic fusion feature analysis on the obtained multiple sub-communities to obtain the result of original multi-source host log association fusion and the corresponding security event description.

[0088] Building upon log association, this embodiment employs a prompt design method based on the ICIO framework to achieve deep semantic fusion of associated logs and generate unified security event descriptions. This method effectively generates high-quality, task-oriented results through clear task guidance and structured input / output requirements. The specific prompt content is as follows:

[0089] Instruction: Design a comprehensive label for a set of cross-source log data, ensuring that the label is concise and accurately summarizes the nature of the security event they collectively indicate.

[0090] Background Information: In the field of security operations, integrating and analyzing diverse log data from network alerts and host activity records plays a crucial role in the timely identification of potential threats and the standardization of incident descriptions. Through comprehensive assessment, extracting concise yet accurate incident tags can significantly improve the speed and accuracy of security response, ensuring a rapid understanding and effective handling of complex security situations.

[0091] Supplementary data: A series of related log datasets, covering network alerts, raw multi-source host logs, and user operation records. Specific examples include, but are not limited to, specific alert signatures such as "ET POLICY Reserved Internal IPTraffic" and raw multi-source host log templates such as "pam_unix(cron:session): session opened for user". <obn>by (uid=0)".

[0092] Output format: Simplicity: The generated tags should be concise, with the number of characters limited to 10 to 15; Accuracy: Ensure that the tags accurately reflect the core security events and behavioral characteristics revealed by the log collection; Event-oriented: The tags should directly point to the event characteristics, such as "abnormal traffic monitoring", "probing activity" or "potential data breach", so as to clearly convey the nature of the security event.

[0093] This embodiment achieves deep semantic fusion of multi-source logs through this ICIO-based prompt design method, successfully generating accurate and unified security event descriptions. This approach not only improves the efficiency of security event analysis but also enhances the accuracy of security event tracing and response.

[0094] Example 2

[0095] This embodiment provides a multi-source log association and fusion system based on security behavior semantic analysis, including:

[0096] The log attribute acquisition unit is used to take the acquired raw multi-source host logs as input to the pre-built BERT base model and obtain the attributes corresponding to each log text.

[0097] The association graph construction unit is used to perform preliminary association of the original multi-source host logs using custom log basic attributes, and to construct a preliminary association graph corresponding to the original multi-source host log text.

[0098] At the same time, it is used to map the original multi-source host log text using custom log semantic descriptive attributes to obtain a deep semantic attribute space;

[0099] The association graph construction unit is used to construct a deep semantic information association graph using the obtained preliminary association graph and deep semantic attribute space;

[0100] The clustering analysis unit is used to perform clustering analysis on the obtained deep semantic information association graph to obtain multiple sub-communities;

[0101] The semantic fusion unit is used to perform semantic fusion features on the obtained multiple sub-communities to obtain the security event descriptions corresponding to the original multi-source host logs.

[0102] Example 3

[0103] This embodiment also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device.

[0104] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the method in the above embodiments; one or more instructions in the computer-readable storage medium are loaded and executed by a processor to implement the method.

[0105] Example 4

[0106] This embodiment provides a computing device, which includes a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, and is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement a corresponding method flow or corresponding function. The processor described in this embodiment can be used for the operation of the method.

[0107] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.< / obn> < / sport> < / sip> < / username> < / o> < / sport> < / sip> < / username>

Claims

1. A method for multi-source log correlation fusion based on security behavior semantic analysis, characterized in that, The method comprises the following steps: Step 1, taking the obtained original multi-source host log as an input of a pre-constructed BERT base model to obtain attributes corresponding to each log text; Step 2, performing preliminary association on the original multi-source host log by using a self-defined log basic attribute to construct a preliminary association graph corresponding to the original multi-source host log text; Performing mapping processing on the original multi-source host log text by using a self-defined log semantic descriptive attribute to obtain a deep semantic attribute space; Step 3, constructing a deep semantic information association graph by using the obtained preliminary association graph and deep semantic attribute space; Step 4, performing clustering analysis on the obtained deep semantic information association graph to obtain a plurality of sub-communities; Step 5, performing semantic fusion features on the obtained plurality of sub-communities to obtain a security event description corresponding to the original multi-source host log; Performing preliminary association on the original multi-source host log by using a self-defined log basic attribute to construct a preliminary association graph corresponding to the original multi-source host log, and the specific method is: The self-defined log basic attribute is a core field used for identifying and describing key information in the log in the security behavior analysis, and the attribute has a unique identification and can reflect the basic characteristics of the log record; Performing preliminary association on the original multi-source host log by using the intersection of the security behavior basic attributes between logs to obtain a preliminary association graph corresponding to the original multi-source host log; Performing mapping processing on the original multi-source host log text by using a self-defined log semantic descriptive attribute to obtain a deep semantic attribute space, and the specific method is: The self-defined log semantic descriptive attribute is an attribute with natural language characteristics in the original multi-source host log, and the attribute has differences in the description of the same event due to different sources of the original multi-source host log; Performing mapping processing on the original multi-source security log based on the self-defined semantic descriptive attribute to obtain a deep semantic attribute space; The node of the deep semantic information association graph is a log text set with the same log semantic descriptive attribute in the deep semantic attribute space; the edge of the deep semantic information association graph is a basic attribute association relationship between the log texts contained in two deep semantic nodes, and the weight of the edge of the deep semantic information association graph is the number of the basic attribute association relationship; Performing semantic fusion features on the obtained plurality of sub-communities to obtain a security event description corresponding to the original multi-source host log, and the specific method is: Based on the prompt design method of the ICIO framework, the obtained plurality of sub-communities are subjected to semantic fusion features to obtain a result of association and fusion of the original multi-source host log and a corresponding security event description.

2. The multi-source log correlation fusion method based on security behavior semantic analysis according to claim 1, characterized in that, The construction method of the BERT base model: Constructing an initial BERT base model; Performing word segmentation and labeling on the obtained original multi-source host log to obtain a labeled data set; Optimizing the initial BERT base model by using the obtained labeled data set to obtain an optimized BERT base model.

3. The method of claim 1, wherein, Performing word segmentation and labeling on the obtained original multi-source host log to obtain a labeled data set, and the specific method is: Performing word segmentation on each log text in the obtained original multi-source host log according to spaces; The obtained each word segmentation is marked in BIO mark format, wherein, the marked categories include template static words and variable parameters, the variable parameters include object ID, position identifier, object name, type identifier, switch indicator, action duration, computing resource, object quantity, status code and other, the position identifier includes source IP, source port, destination IP, destination port and file path, and the object name is username; The original word of the template static word and the category name of the variable parameter are combined to obtain a marked data set.

4. A multi-source log correlation fusion system based on security behavior semantic analysis, characterized in that, The fusion method based on claim 1, the system comprises: The log attribute acquisition unit takes the obtained original multi-source host log as the input of the pre-constructed BERT base model to obtain the attribute corresponding to each log text; The association graph construction unit uses the custom log basic attribute to preliminarily associate the original multi-source host log to construct a preliminary association graph corresponding to the original multi-source host log text; At the same time, the original multi-source host log text is mapped by using the custom log semantic descriptive attribute to obtain a deep semantic attribute space; The association graph construction unit uses the obtained preliminary association graph and deep semantic attribute space to construct a deep semantic information association graph; The clustering analysis unit performs clustering analysis on the obtained deep semantic information association graph to obtain a plurality of sub-communities; The semantic fusion unit performs semantic fusion on the obtained plurality of sub-communities to obtain a security event description corresponding to the original multi-source host log.

5. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions that when executed by a computer cause the computer to perform a method comprising: The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform the method of any one of claims 1-3.

6. A computing device, comprising: Comprise: One or more processors, memory and one or more programs, wherein one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprise steps for executing the method of any one of claims 1-3.

Images