A log audit monitoring method and a log audit monitoring system

Abstract

The present application discloses a log audit monitoring method and a log audit monitoring system. The system has a real-time embedded end-to-end architecture, including an agent program deployed at multiple key log production nodes, and a log audit monitoring model. The agent program collects buried data to reduce the risk of log data being tampered with during audit operations, and the audit monitoring results have higher authenticity and effectiveness. The model is based on the DeepLog architecture and is trained in an unsupervised learning manner, which reduces the cost of manual labeling and avoids the problem of poor audit monitoring accuracy caused by model overfitting or poor generalization ability due to problems with the number or quality of sample annotations. Data enhancement is achieved by utilizing the personnel information parameters of the log, so that the log audit monitoring model can not only have the function of abnormal behavior monitoring, but also the function of personnel authorization monitoring. The log audit monitoring model can gain insight into log operations that violate permissions and effectively audit and monitor security risks.

Description

Technical Field

[0001] The present application relates to the technical field of log audit monitoring, and in particular to a log audit monitoring method and a log audit monitoring system. Background Art

[0002] IT audit refers to information systems auditing. Specifically, it encompasses the evaluation, oversight, and standardized inspection of the audit department's internal information systems, network security, production and maintenance, data flows, and electronic signatures. IT audits primarily encompass inspections of system development, system applications, production and maintenance, security, and risk management. These audits typically involve monitoring the logs generated during these processes, enabling effective oversight and resolution of any anomalies discovered during log audits.

[0003] There are several main problems with performing IT audits using traditional technologies:

[0004] First, there's the risk of data tampering. Traditionally, logs generated in business production systems are exported or manually organized before audit monitoring. This process can lead to the risk of log data being tampered with, making it impossible to truly reflect issues with log production through audit operations.

[0005] Second, labeling samples requires significant manual effort or algorithmic models, resulting in a high workload and limited accuracy. Traditionally, log auditing and monitoring is typically performed using supervised algorithms. This approach requires extensive upfront labeling work, resulting in high costs and difficulty. Traditional approaches, due to the limited quantity and quality of manually and model-labeled samples, result in insufficient training data or high sample homogeneity, leading to overfitting in model training. Furthermore, these supervised models struggle to identify anomalies outside of the training sample and exhibit poor generalization capabilities.

[0006] Third, security vulnerabilities arise from limitations in audit monitoring capabilities. Existing technologies often operate independently from monitoring and operation platforms and company organizational and personnel information systems. This prevents the operation and maintenance platform from timely capturing changes in personnel information (such as resignation, retirement, or job transfer), creating security risks. For example, existing audit monitoring models typically only monitor operational anomalies at the operation and maintenance level and lack real-time insight into log operations by users with unauthorized permissions. Summary of the Invention

[0007] Based on the above problems, this application provides a log audit monitoring method and a log audit monitoring system, the purpose of which is to reduce the risk of log data tampering and the cost of manual labeling, accurately and effectively realize log audit monitoring, and more comprehensively identify user authority security vulnerabilities in the audit process.

[0008] The embodiments of this application disclose the following technical solutions:

[0009] In a first aspect, the present application provides a log audit monitoring method, which is applied to a log audit monitoring system; the log audit monitoring system has a real-time embedded end-to-end architecture, and the log audit monitoring system includes at least: an agent program deployed at multiple key log production nodes, and a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the log audit monitoring model is a deep learning model based on the DeepLog architecture;

[0010] The method includes:

[0011] Collecting the original log data generated at the key log production node through the agent program;

[0012] The log audit monitoring model performs data parsing based on the original log data to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data; the log key sequence is a sequence in which the log keys of each log in the original log data are arranged in the order of log timestamps; the basic parameter value vector sequence is a sequence in which the basic parameter value vectors of each log in the original log data are arranged in the order of log timestamps;

[0013] The log audit monitoring model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data;

[0014] The log audit monitoring model obtains a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log;

[0015] The log audit monitoring model constructs a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence;

[0016] The log template sequence is analyzed through the log audit monitoring model to obtain a first abnormality monitoring result and a second abnormality monitoring result; the first abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority.

[0017] In an optional implementation, the existing personnel information data set includes multiple personnel information entries; each personnel information entry includes employee information, user information, and permission information; the employee information includes at least: employee status, which is one of: employed, resigned, transferred, or retired; the permission information includes: user role permissions and authorization period information;

[0018] The log audit monitoring model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data, including:

[0019] The log audit monitoring model is used to match the operating user information of each log in the original log data with the existing personnel information data set to see whether there is a personnel information entry corresponding to the user information;

[0020] If a personnel information entry corresponding to the user information is determined to exist from the existing personnel information data set, extracting part or all of the information in the personnel information entry as personnel information parameters of the corresponding log in the original log data; wherein the part of the information includes at least the employee status and the authority information;

[0021] If it is determined from the matching of the existing personnel information data set that there is no personnel information entry corresponding to the user information, the corresponding personnel information parameter in the original log data is set to empty.

[0022] In an optional implementation, the log audit monitoring model obtains a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log, including:

[0023] The log audit monitoring model, based on each basic parameter value vector of the basic parameter value vector sequence and the obtained personnel information parameters of each log, performs splicing of the basic parameter value vector and the personnel information parameters log by log to obtain a new parameter value vector for each log in the original log data;

[0024] The new parameter value vectors of each log obtained are arranged in the order of the log timestamps to form a new parameter value vector sequence.

[0025] In an optional implementation, analyzing the log template sequence by the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result includes:

[0026] The log audit monitoring model extracts the log key sequence to be analyzed w={m t-h,…,m t-2 ,m t-1}, based on the log key sequence to be analyzed w={m t-h ,…,m t-2 ,m t-1}Analyze the next log key m t Is there an exception? Get the log key m t The log key exception analysis result of the corresponding log;

[0027] The log audit monitoring model extracts a new parameter value vector corresponding to each log key from the log template sequence, and based on the new parameter value vector corresponding to each log key, predicts whether the parameter value of the corresponding next log entry is abnormal, and obtains a parameter value abnormality analysis result for each log entry; the parameter value abnormality analysis result is used to indicate whether the basic parameter value and the personnel authority information are abnormal.

[0028] If the log key anomaly analysis result of the same log indicates an anomaly and / or the parameter value anomaly analysis result indicates that the basic parameter value is anomaly, then a first anomaly monitoring result indicating that the generation of the log is triggered by an abnormal behavior pattern is obtained; if the log key anomaly analysis result of the same log indicates that there is no anomaly, and the parameter value anomaly analysis result indicates that there is no anomaly in the basic parameter value, then a first anomaly monitoring result indicating that the generation of the log is triggered by a normal behavior pattern is obtained;

[0029] If the parameter value abnormality analysis result indicates that there is an abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of this log is triggered by a person with abnormal authority; if the parameter value abnormality analysis result indicates that there is no abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of this log is triggered by a person with normal authority.

[0030] In an optional implementation, the log key sequence w={m t-h ,…,m t-2 ,m t-1}Analyze the next log key m t Is there an exception? Get the log key m t The corresponding log key exception analysis results for the log include:

[0031] Based on the log key sequence w={m t-h ,…,m t-2 ,m t-1}Predict the next log key m t The conditional probability distribution is used to characterize the next log key m t the possibility of multiple candidate scenarios;

[0032] If the next log key m t If the actual value of is within the first g candidate cases in the conditional probability distribution, the log key abnormality analysis result of the log is determined to be normal; if the next log key m t If the actual value of is not within the first g candidate cases in the conditional probability distribution, the log key anomaly analysis result of the log is determined to be abnormal.

[0033] In an optional implementation, the method of predicting whether the parameter value of the corresponding next log entry is abnormal based on the new parameter value vector corresponding to each log key and obtaining the parameter value abnormality analysis result of each log entry includes:

[0034] Based on the new parameter value vector corresponding to each log key, predict the first predicted distribution and second predicted distribution of the corresponding next log; the first predicted distribution is the predicted distribution of the basic parameter value for abnormal behavior monitoring, and the second predicted distribution is the predicted distribution of the personnel information parameter for personnel authorization monitoring;

[0035] Calculating a first confidence interval of the basic parameter value of the next log according to the first predicted distribution; if the actual value of the basic parameter value of the next log is within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is normal; if the actual value of the basic parameter value of the next log is not within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is abnormal;

[0036] A second confidence interval of the personnel information parameter of the next log is calculated based on the second predicted distribution. If the actual value of the personnel information parameter of the next log is within the second confidence interval, the parameter value abnormality analysis result of the next log indicates that the generation of the next log is triggered by a person with normal authority; if the actual value of the personnel information parameter of the next log is not within the second confidence interval, the parameter value abnormality analysis result of the next log indicates that the generation of the next log is triggered by a person with abnormal authority.

[0037] In an optional implementation, the log audit monitoring model is pre-trained using a sample data set of a normal log template sequence in an unsupervised learning manner;

[0038] The sample data set of the normal log template sequence includes a plurality of normal log template sequence samples;

[0039] Each of the normal log template sequence samples includes a plurality of log template samples of historical normal logs with a time stamp sequence relationship;

[0040] The normal log template sequence sample is constructed based on the log key sequence samples of the plurality of historical normal logs having a chronological relationship of timestamps and the new parameter value vector sequence sample;

[0041] The new parameter value vector sequence sample is obtained by fusing the basic parameter value vector sequences of the multiple historical normal logs with a chronological relationship of timestamps and the personnel information parameters of each historical normal log.

[0042] In an optional implementation, the log audit monitoring system is further configured with an information display and feedback mechanism;

[0043] After analyzing the log template sequence by the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result, the method further includes:

[0044] If the first abnormality monitoring result indicates an abnormality and / or the second abnormality monitoring result indicates an abnormality, generating risk warning information and pushing the risk warning information to the audit end;

[0045] If the risk misjudgment information fed back by the audit end based on the risk warning information is received, the log audit monitoring model is further studied and optimized using the risk misjudgment information.

[0046] In an optional implementation, the log audit monitoring system further includes: a data integration module and a data storage module; the data storage module is configured with a Kafka stream database; wherein the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system;

[0047] After collecting the original log data generated at the key log production node through the agent program, the method further includes:

[0048] The data integration module uses ETL technology to automatically extract, clean, filter, convert and standardize log data from the original log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database; the Kafka stream database provides the log audit monitoring model with the log data to be analyzed that has been processed by the ETL technology.

[0049] A second aspect of the present application provides a log audit monitoring system having a real-time embedded end-to-end architecture, wherein the log audit monitoring system comprises at least: a data acquisition module and a model prediction module;

[0050] The data collection module is implemented by an agent program deployed at multiple key log production nodes;

[0051] The model prediction module is implemented through a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the log audit monitoring model is a deep learning model based on the DeepLog architecture;

[0052] The data collection module is used to collect the original log data generated at the key log production node through the agent program;

[0053] The model prediction module is used to perform data analysis based on the original log data through the log audit monitoring model to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data; the log key sequence is a sequence in which the log keys of each log in the original log data are arranged in the order of log timestamps; the basic parameter value vector sequence is a sequence in which the basic parameter value vectors of each log in the original log data are arranged in the order of log timestamps;

[0054] The model prediction module is further configured to obtain personnel information parameters of each log in the original log data by matching the operating user information of each log in the original log data with the existing personnel information data set by the log audit monitoring model;

[0055] The model prediction module is further configured to obtain a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log by the log audit monitoring model;

[0056] The model prediction module is further configured to construct, by the log audit monitoring model, a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence;

[0057] The model prediction module is also used to analyze the log template sequence through the log audit monitoring model to obtain a first abnormality monitoring result and a second abnormality monitoring result; the first abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority.

[0058] In an optional implementation, the system is further configured with a display feedback module, which is used to implement an information display and feedback mechanism; the display feedback module is connected to the model prediction module;

[0059] The display feedback module is specifically used to:

[0060] If the first abnormality monitoring result indicates an abnormality and / or the second abnormality monitoring result indicates an abnormality, receiving the risk warning information generated by the model prediction module, and pushing the risk warning information to the audit end for display;

[0061] If the audit end receives risk misjudgment information based on the risk warning information, the risk misjudgment information is fed back to the model prediction module so that the model prediction module can continue to learn and optimize the log audit monitoring model using the risk misjudgment information.

[0062] In an optional implementation, the system further includes: a data integration module and a data storage module; the data storage module is configured with a Kafka stream database; wherein the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system;

[0063] The data integration module is used to use ETL technology to automatically extract, clean, filter, convert and standardize log data from the original log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database;

[0064] The data storage module is used to provide the log data to be analyzed processed by the ETL technology to the log audit monitoring model through the Kafka stream database.

[0065] Compared with the existing technology, this application has the following beneficial effects:

[0066] The log audit monitoring method provided by the technical solution of the present application is applied to the log audit monitoring system. The system has a real-time embedded end-to-end architecture, which at least includes an agent program deployed at multiple key nodes of log production, and a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the model is a deep learning model based on the DeepLog architecture. Since the method uses an agent program deployed at key nodes of log production to collect buried data and directly processes the collected data through the model, it avoids the link of log data export or personnel data collation. The collected data is used as the source data for model processing, which reduces the risk of log data being tampered with during audit operations, making the audit monitoring results more authentic and effective. Since the model is a deep learning model based on the DeepLog architecture, it is trained in an unsupervised learning manner and can identify anomalies without a large amount of labeling work, which greatly reduces the cost of manual labeling. At the same time, it also avoids the problem of poor audit monitoring accuracy caused by model overfitting or poor generalization ability due to sample labeling.

[0067] In the method, the model performs data parsing based on the original log data to obtain the log key sequence and basic parameter value vector sequence corresponding to the original log data; the model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data; the model obtains a new parameter value vector sequence based on the basic parameter value vector sequence and the personnel information parameters of each log by fusion; the model constructs a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence; the model analyzes the log template sequence to obtain the first anomaly monitoring result and the second anomaly monitoring result. Among them, the first anomaly monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second anomaly monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority. Since in the technical solution of the present application, the personnel information parameters of the log are used to achieve data enhancement on the basis of the original basic parameter values, and a new parameter value vector sequence is constructed by fusion, the log audit monitoring model can also realize the personnel authorization monitoring function on the basis of having the abnormal behavior monitoring function. It can be seen that the log audit monitoring model adopted in the technical solution of this application breaks the independent audit monitoring barriers between the monitoring operation and maintenance platform and the personnel information system, can provide insights into the log operations of users who violate permissions, and more effectively audit and monitor related security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0069] Figure 1 An architectural diagram of a log audit monitoring system provided in an embodiment of the present application;

[0070] Figure 2 A flow chart of a log audit monitoring method provided in an embodiment of the present application;

[0071] Figure 3 An architectural diagram of a method for implementing dual anomaly monitoring through a log audit monitoring model provided in an embodiment of the present application;

[0072] Figure 4 This is the DeepLog architecture diagram;

[0073] Figure 5 An example flow chart of implementing dual anomaly monitoring through a log audit detection model provided in an embodiment of the present application;

[0074] Figure 6 A flow chart of another log audit monitoring method provided in an embodiment of the present application;

[0075] Figure 7 A schematic diagram of the structure of a log audit monitoring system provided in an embodiment of the present application;

[0076] Figure 8 A structural diagram of another log audit monitoring system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] Before formally introducing the specific implementation of the technical solution of this application, we first introduce the three current mainstream log audit monitoring technologies.

[0078] Technology 1: An IT audit method and device. In this method, an audit workflow corresponding to the software development architecture is initiated; corresponding data is obtained from the software development architecture according to the audit workflow; the corresponding data is automatically audited according to the audit workflow; and an audit report is output. Technology 1 utilizes the audit workflow to automatically process and analyze audit data, eliminating the tedious process of manually extracting, organizing, and searching for information and extracting data.

[0079] Technology 2: A method, system, device, and medium for fusion risk analysis of multi-source security logs. The method of Technology 2 includes: obtaining security logs from multiple data sources, performing structured parsing, machine learning annotation, and standardization on the security logs to generate standardized logs; cleaning, deduplication, screening, and preprocessing the standardized logs; storing the standardized logs in a distributed database, performing asset identification based on the standardized logs, and using a deep reinforcement learning model to identify risks based on the asset identification results, identifying risk logs and processing them; feeding the processing results of the risk logs back to the deep reinforcement learning model for continuous training and adjusting the judgment conditions of the risk logs. It can automatically process security logs from multiple sources, and achieve log formatting, cleaning, asset identification, and risk identification through machine learning and other technologies, thereby improving the automation level and defense capabilities of the data security platform.

[0080] Technology 3: A log audit monitoring method and device. Technology 3 includes: collecting and parsing host logs; processing log data using feature extraction; training and establishing a decision model using the LSTM algorithm and continuously optimizing it; and automatically auditing host logs to determine risk levels and take appropriate action. By using a deep learning algorithm to establish a decision model, records that do not conform to expected behavior are identified and automatically processed. By using the Spell method to parse logs and using the LSTM algorithm to train and establish a decision model, this method focuses on the processing and use of log features, shielding against log heterogeneity and making it suitable for anomaly detection in multiple system log types.

[0081] The inventors have found through analysis that the three technologies introduced above have some shortcomings, which are summarized as follows:

[0082] Disadvantage 1: Existing technologies are generally based on audit data submitted by the audited personnel and cannot obtain the most original and authentic data from the source production and operation systems, resulting in the risk of tampering of audit data. Taking the above-mentioned technology 1 as an example, technology 1 directly uses the information submitted by each process node in the software development architecture as input data through a workflow. This data is input into the system after being sorted and processed by the audited personnel, which may deviate from the actual original data and pose a risk of tampering.

[0083] Disadvantage 2: Existing technologies generally require manual or model-based labeling of large numbers of training samples, increasing labor and computational costs. The accuracy of sample labeling is not always high, negatively impacting the accuracy of model predictions. Technique 2 uses a pre-trained neural network model to label assets with their sensitivity types and levels, classifying and grading data. However, this approach is often affected by varying datasets in practice. Furthermore, its reliance on manual experience and model accuracy results in low sample labeling accuracy. Furthermore, log data inherently exhibits a significant imbalance in the distribution of positive and negative samples. Using supervised training methods, selecting sampling methods and filtering negative samples present significant challenges, such as labeling and processing asset sensitivity types and levels in Technique 2. This imbalance often leads to excessive focus on majority class samples during model training, neglecting minority class samples, which impacts model generalization and accuracy. It also complicates model evaluation and increases computing resource consumption, among other issues.

[0084] Current models for risk detection in log data generally employ traditional machine learning and deep learning models, resulting in poor accuracy. The graph database and graph neural network models used in the second technique have limitations when processing sequential data such as log data. Graph algorithms store and process data using nodes and edges, excelling at handling complex, multi-layered data relationships. However, they lack the ability to express and learn features from sequential data. The third technique employs LSTM for model training. While the gating system effectively captures long-term dependencies in sequential data, the LSTM model requires a large amount of training data to learn log patterns and regularities. If the training data volume is too small, the model cannot fully learn the data's characteristics, resulting in low accuracy. Furthermore, LSTM requires high data quality; noise, missing values, or outliers in the input data can easily affect the model's accuracy.

[0085] Disadvantage 3: Existing technologies typically rely solely on host logs as input data. This means risk monitoring models can only identify behavioral risks inherent in the log data itself, failing to detect potential correlations between user permissions and behavioral risks. This can lead to difficult-to-identify security risks. For example, while Technique 2 obtains security logs containing IP addresses, ports, and URLs from multiple data sources, Technique 3 also collects only host log data.

[0086] In addition to the above shortcomings, the inventor believes that the existing technology also has problems such as poor audit timeliness, delayed risk warning, certain limitations and subjective biases, and difficulty in discovering relatively complex potential risks. The specific analysis is as follows:

[0087] Disadvantage 4: Existing technologies have poor timeliness for IT audits and a certain lag in risk warnings. Technology 2 involves a large amount of data preprocessing, and the graph database and graph neural network used are computationally complex, making real-time training and prediction difficult. On the one hand, Technology 2 involves a large amount of operations such as cleaning and deduplication of log data, and screening out standardized logs based on preset screening strategies, resulting in a long preprocessing process. The deduplication operations involved often require a full or partial traversal of the data set, which is itself a time-consuming and resource-intensive process. Especially when the amount of data is too large, the calculation time will increase significantly. On the other hand, Technology 2 uses graph databases and graph deep neural networks to store and calculate data in the form of graphs, which contain nodes and edges. This data structure requires complex traversal operations when querying. As the amount of log data processed increases, the time complexity of the traversal will increase significantly, and I / O overhead and memory usage will also increase significantly.

[0088] Disadvantage 5: Existing technologies generally rely on manual experience to extract audit elements, construct audit features, and select data sets. This has certain limitations and subjective biases, and makes it difficult to detect more complex potential risks. In the second technique, the key log fields manually selected are information such as the target IP address, port number, and log time. Other elements are missing, and the complete information and time series of the log data cannot be reflected. In the data set selection, only standardized logs with specific feature keys are retained, which also has biases in sample selection.

[0089] On the basis of the defects of the existing technology, the inventor has conducted research and proposed a targeted solution for IT audit scenarios and the actual needs of this scenario, and provided a log audit monitoring method and a log audit monitoring system. The log audit monitoring method is also based on the operation of the log audit monitoring system. In order to enable people in this technical field to better understand the solution of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0090] See also Figure 1 , which is an architectural diagram of a log audit monitoring system provided by an embodiment of the present application. Figure 1 As shown, the architecture of the log audit monitoring system includes: an agent program and a log audit monitoring model. In the technical solution of this application, the above-mentioned agent program needs to be deployed in multiple key log production nodes, for example, on the production operation and maintenance platform, bastion host, jump server, host, MySQL database, etc.

[0091] In an example scenario, if it is necessary to audit and monitor the logs of each branch, the agent program can specifically be the multiple key log production nodes deployed in each branch. In another example scenario, if it is necessary to audit and monitor the logs of each subsidiary, the agent program can specifically be the multiple key log production nodes deployed in each subsidiary. It is understandable that for different actual audit scenarios, the number and type of key log production nodes may vary, and the number and type of multiple key log production nodes are not specifically limited here. Figure 1 In the system architecture shown in the figure, only the deployment of agent programs on three key log production nodes is used as an example.

[0092] The agents mentioned above can be referred to as "agents" in English. These agents monitor and capture log streams generated by key log production nodes in real time. Deploying agents at these key log production nodes facilitates the real-time collection of raw log data generated by operations and maintenance personnel during production changes. This data collected by agents at these key log production nodes is also known as embedded data.

[0093] The log audit detection model in the log audit monitoring system provided in the embodiment of the present application is a deep learning model based on the DeepLog architecture, which is trained using an unsupervised learning method. Different from the conventional DeepLog architecture model, the log audit monitoring model in this application has a dual function. On the one hand, the model has the function of monitoring abnormal behavior in the log, and on the other hand, it also has the function of monitoring personnel authorization. The operating principle of the model will be introduced in detail in the embodiments below.

[0094] Figure 2 This is a flow chart of a log audit monitoring method provided by an embodiment of the present application. Figure 2 As shown, the method includes:

[0095] S201. Collect original log data generated at key log production nodes through an agent program.

[0096] The agent program can directly send the collected raw log data to the log audit monitoring model using a predetermined format and protocol. In other possible implementations, the agent program can also send the collected raw log data to a data processing module, which then performs preliminary processing before providing it to the log audit monitoring model. Based on actual needs, the functions of the data processing module may be diverse, and the method of preliminary processing is not limited here.

[0097] In a possible implementation, the agent program may also provide the device identifier of the key node producing the log, or other identifiers used to refer to the data source, when providing the original log data. The identifier can be used to distinguish the data source.

[0098] S202: Perform data analysis based on the original log data through the log audit monitoring model to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data.

[0099] Although log data is unstructured text, it is generated by programs with strict logic and control flow, making it essentially similar to natural language. Therefore, when the log audit monitoring model receives raw log data (or data generated after data processing of raw log data), it can parse the data and convert it into a structured representation.

[0100] In this application, when parsing log data, it is necessary to combine the timestamp of the log to construct a sequence that can serve the purpose of audit monitoring.

[0101] Specifically, the log audit monitoring model can parse each log in the original log data into two parts: a log key and a parameter value vector. In order to distinguish it from the concepts introduced later, the parameter value vector in the two parts directly parsed here is called a basic parameter value vector. Among them, the log key represents the category or type of the log, and the log key is the constant part of the log content. The basic parameter value vector represents the specific parameter information of the log, such as timestamp, IP address, process ID, version number, etc. The basic parameter value vector is the variable part of the log content. Parsing the log into log keys and parameter value vectors can be achieved through regular expressions, that is, through regular expressions, each piece of original log data is parsed into a data format that can be recognized by the log audit monitoring model. For ease of understanding, Table 1 shows the effects before parsing of several pieces of original log data, and Table 2 shows the effects of parsing several pieces of original log data to obtain log keys and basic parameter value vectors.

[0102] In Table 1, taking the first log as an example, [2023-04-01 09:05:00] represents the timestamp, and INFO: Starting new application version 2.3.1. represents the log information.

[0103] Table 1

[0104]

[0105]

[0106] In the log information shown in Table 2, the timestamps of the log entries are simply represented by t1, t2, etc. Taking the first log entry shown in Table 2 as an example, "Starting new application version" is the constant portion of the log, represented by the log key log key = k1. The set of log keys is finite. Taking the first log entry shown in Table 2 as an example, 2.3.1. is the variable portion of the log, which needs to be represented by a basic parameter value vector. In addition, the basic parameter value vector also stores the time difference between the current log entry and the previous log entry, for example, t1-t0, where t1 is the timestamp of the current log entry and t0 represents the timestamp of the previous log entry.

[0107] Table 2

[0108]

[0109] Based on the results of the above analysis, the log key of each log can be arranged in sequence in combination with the timestamp of the log to form a sequence. In addition, the basic parameter value vector of each log can also be arranged in sequence in combination with the timestamp of the log to form a sequence. In the embodiment of the present application, the log key sequence refers to the sequence formed by arranging the log key of each log in the original log data in the order of the log timestamp; the basic parameter value vector sequence refers to the sequence formed by arranging the basic parameter value vector of each log in the original log data in the order of the log timestamp.

[0110] S203: The log audit monitoring model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data.

[0111] In the technical solution of the present application, while collecting the original log data, the agent program also obtains the log-related operating user information. By correlating with the existing personnel information data set, the personnel information parameters corresponding to each log are determined. In an optional implementation method, the existing personnel information data set includes multiple personnel information entries; each personnel information entry includes employee information, user information and permission information; employee information includes at least: employee status, which can be one of: employed, resigned, transferred or retired; permission information includes: user role permissions and authorization period information.

[0112] For example, a subsidiary's personnel information dataset (perhaps in the form of a data table) contains information such as username, user role permissions, employee status, and department. However, if the operating user isn't listed in the subsidiary's personnel information dataset, that user won't be found in the dataset. Furthermore, by matching against the personnel information dataset, specific information such as the employee's status and whether their permissions have expired can be determined, making it easier for the model to identify whether the personnel information corresponding to the log contains any abnormal permissions.

[0113] During the specific implementation of this step, the log audit monitoring model matches the operating user information of each log in the original log data to see whether there is a personnel information entry corresponding to the user information from the existing personnel information data set; if it is determined from the matching of the existing personnel information data set that there is a personnel information entry corresponding to the user information, then part or all of the information in the personnel information entry is extracted as the personnel information parameter of the corresponding log in the original log data; wherein, the part of the information includes at least employee status and authority information; if it is determined from the matching of the existing personnel information data set that there is no personnel information entry corresponding to the user information, then the corresponding personnel information parameter in the original log data is set to empty.

[0114] Table 2 shows the effect of parsing several pieces of original log data to obtain log keys and new parameter value vectors. The first column of Table 3, different from the first column of Table 2, shows the personnel information parameters of each log in the original log data obtained through this step. It should be noted that the step of obtaining personnel information parameters described in this step can be implemented by the log audit monitoring model, or it can be completed by the agent program in combination with the personnel information data set matching. In general, by identifying personnel information parameters, data enhancement of the log information of inherent concern is achieved, so that the personnel information parameters can be parsed during parsing and a new parameter value vector that is different from the basic parameter value vector is constructed. Table 3 only refers to "personnel information parameters". In fact, the personnel information parameters included in the log information and the new parameter value vector may include employee ID, employee name, department, employee status (employed, resigned, transferred, retired), user name, authority information, etc. Table 3 is only a formal example and is not a limitation on the specific content.

[0115] Table 3

[0116]

[0117] S204: The log audit monitoring model obtains a new parameter value vector sequence based on the basic parameter value vector sequence and the personnel information parameters of each log.

[0118] In an optional implementation method, this step includes: the log audit monitoring model, based on each basic parameter value vector of the basic parameter value vector sequence and the personnel information parameters of each log obtained, splices the basic parameter value vectors and the personnel information parameters log by log to obtain a new parameter value vector for each log in the original log data; and arranges the new parameter value vectors of each log obtained in the order of the log timestamps to form a new parameter value vector sequence.

[0119] Combining the differences between the third column of Table 3 and the third column of Table 2, it can be seen that the difference between the new parameter value vector shown in the third column of Table 3 and the basic parameter value vector shown in the third column of Table 2 lies in the personnel information parameters contained in the vector. In this application, based on each basic parameter value vector in the basic parameter value vector sequence obtained after step S202 is executed, combined with the personnel information parameters of each log, the new parameter value vector obtained after parsing each log can be finally obtained. Based on the log timestamps, a new parameter value vector sequence can still be constructed in the order of the timestamps from the earliest to the latest.

[0120] S205 : The log audit monitoring model constructs a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence.

[0121] In this application, by identifying the constant part and the variable part in the log, a log template representing a type of system time can be constructed. The constant part here can be understood as the log key, and the variable part can be understood as the new parameter value vector, in which the basic parameter value and the personnel information parameter are all variables. Since the log audit monitoring model is a model based on the DeepLog architecture, the model requires the input to be a set of log sequences. Therefore, in this step, it is necessary to construct a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence, so as to facilitate the subsequent use as the input of the log audit monitoring model.

[0122] It is understandable that the log template sequence corresponding to the original log data in this application includes the log templates of each log arranged in order of timestamps from earliest to latest.

[0123] S206: Analyze the log template sequence through the log audit monitoring model to obtain a first abnormality monitoring result and a second abnormality monitoring result.

[0124] Figure 3 This is an architecture diagram for implementing dual anomaly monitoring through a log audit monitoring model provided in an embodiment of the present application. Figure 3 In the example, the left side of the log audit monitoring model shows the process of gradually constructing a log template sequence from the original log data. In the embodiment of the present application, after the log audit monitoring model receives the log template sequence input into the model, it will perform the following analysis on the log template sequence, with the aim of ultimately obtaining the first anomaly monitoring result and the second anomaly monitoring result.

[0125] The first abnormality monitoring result is used to indicate whether the generation of a log in the original log data is triggered by an abnormal behavior pattern. The second abnormality monitoring result is used to indicate whether the generation of a log in the original log data is triggered by a person with abnormal authority.

[0126] In the embodiment of the present application, the log audit monitoring model used is obtained by learning and training through normal log templates. This means that the log audit monitoring model can identify isolated data that deviates from normal behavior, thereby detecting abnormal behavior or abnormal permissions.

[0127] Abnormal behavior includes frequent operations, operations during unusual time periods, malicious attacks, etc. The following describes three examples.

[0128] (1) For frequent operation behaviors, the model pre-models the log template sequence through the long short-term memory network (LSTM) and learns the time interval and frequency distribution of normal operation and maintenance operations. Therefore, when a new log stream is input, the model can calculate the operation frequency of the current operation and maintenance personnel in the log stream and compare it with the learned normal log pattern. If the operation frequency and interval are found to deviate from the normal pattern, it can be determined that the operation is frequent and then further trigger a risk warning. At this time, the first abnormal monitoring result indicates that the log is triggered by an abnormal behavior pattern and can specifically reveal that the abnormal behavior is a frequent operation behavior. In this way, the log audit monitoring model can realize real-time monitoring of the operation behavior of the operation and maintenance personnel. If a large number of excessively frequent operations by a certain operation and maintenance personnel are detected in a short period of time, an early warning is triggered and can be further displayed and fed back to the auditor.

[0129] (2) For operations in abnormal time periods, the model can pre-learn the time pattern of normal operation and maintenance operations, and can even learn the time window that conforms to the normal operation and maintenance operation pattern. In addition, it can also learn the operating habits of each operation and maintenance personnel in different time periods. Then, when a new log stream is input into the model, the model can determine whether the current operation deviates from the normal time period. If the judgment result is yes, it is identified as an operation behavior in an abnormal time period and triggers an early warning. In this way, the model can identify the operation and maintenance operations performed by the operation and maintenance personnel during non-working time periods (such as late at night, holidays, etc.). Generally, such time periods are considered abnormal time periods, but in combination with the differences in the company's business situation, the span range of the abnormal time period can also be set separately. When such operations are detected, the model can issue an early warning to indicate that there may be unauthorized operation risks.

[0130] (3) For malicious attack behaviors, the model learns the characteristics and patterns of normal log data. When new log stream data is input, the model compares it with the learned normal pattern. If the current log data summary has characteristics or patterns that are significantly different from the normal pattern (such as abnormal network requests, abnormal database operations), it is judged as a malicious attack behavior and triggers an early warning. In this way, the model can identify potential malicious attack behaviors such as SQL injections and DDoS attacks in the log. These malicious attack behaviors are usually prone to cause system anomalies or data leakage and other serious security incidents. The log audit monitoring model introduced in this solution can effectively warn of such problems.

[0131] For the monitoring of personnel authority, the technical solution of the present application enhances the expression of data by combining personnel information parameters with operation and maintenance data. Therefore, in the model training stage, by constructing the above-mentioned data-enhanced training data, the model can learn relevant information about the authorization of operation and maintenance operators. By comparing the logs of normal operation and maintenance operation behaviors of users within normal authority, the model can identify user operations with abnormal permissions that are biased against normal patterns. In this way, the log audit monitoring model has a risk warning function in terms of user authorization. Through the log audit monitoring model, it is possible to identify unauthorized operations of personnel who have resigned, retired, transferred, etc. who are still performing operation and maintenance operations. In addition, it is also possible to identify abnormal situations such as an employee frequently modifying permission settings in a short period of time, or performing sensitive operations, or sudden activities of users who have not logged in for a long time.

[0132] The log audit monitoring method provided by the technical solution of the present application is applied to the log audit monitoring system. The system has a real-time embedded end-to-end architecture, which at least includes an agent program deployed at multiple key nodes of log production, and a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the model is a deep learning model based on the DeepLog architecture. Since the method uses an agent program deployed at key nodes of log production to collect buried data and directly processes the collected data through the model, it avoids the link of log data export or personnel data collation. The collected data is used as the source data for model processing, which reduces the risk of log data being tampered with during audit operations, making the audit monitoring results more authentic and effective. Since the model is a deep learning model based on the DeepLog architecture, it is trained in an unsupervised learning manner and can identify anomalies without a large amount of labeling work, which greatly reduces the cost of manual labeling. At the same time, it also avoids the problem of poor audit monitoring accuracy caused by model overfitting or poor generalization ability due to sample labeling.

[0133] In the method, the model is used to perform data parsing based on the original log data to obtain the log key sequence and basic parameter value vector sequence corresponding to the original log data; the model is used to match the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data; the model is used to fuse the basic parameter value vector sequence and the personnel information parameters of each log to obtain a new parameter value vector sequence; the model is used to construct a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence; the log template sequence is analyzed by the model to obtain the first abnormal monitoring result and the second abnormal monitoring result. Since in the technical solution of the present application, the personnel information parameters of the log are used to achieve data enhancement on the basis of the original basic parameter values, and a new parameter value vector sequence is constructed by fusion, the log audit monitoring model can not only have the abnormal behavior monitoring function, but also the personnel authorization monitoring function. It can be seen that the log audit monitoring model adopted in the technical solution of the present application breaks the independent audit monitoring barriers between the monitoring operation and maintenance platform and the personnel information system, can gain insight into the log operations of users with unauthorized permissions, and more effectively audit and monitor related security risks.

[0134] To facilitate understanding of the working mode of the log audit monitoring model, the following is a brief introduction to the DeepLog architecture. Figure 4 The DeepLog architecture diagram shows that the architecture includes an input layer, an embedding layer, an LSTM layer, a fully connected layer, and an output layer, which are connected sequentially from input to output.

[0135] DeepLog is actually a conditional probability model. In the technical solution of this application, the log audit monitoring model based on the DeepLog architecture can output a probability distribution of prediction results based on the input log template sequence. Among them, the prediction result with the highest probability represents the most likely log template. During the model training process, the backpropagation algorithm continuously adjusts the model weights to ensure that the predicted value and the true value are as close as possible. Figure 4 middle represents the predicted value, y represents the true value, P represents the probability distribution, and [] represents the input sequence. The subscript T distinguishes different times. Figure 4 In the architecture shown in Figure 1, the Embedding layer converts each log template sequence from a scalar to a vector. The LSTM layer learns the long-span dependencies in the log data through a gating system. After the softmax activation function of the fully connected layer, the model obtains the final prediction result.

[0136] In an optional implementation, the log audit monitoring model is pre-trained using an unsupervised learning method using a sample data set of a normal log template sequence; the sample data set of the normal log template sequence includes multiple normal log template sequence samples; each normal log template sequence sample includes multiple log template samples of historical normal logs with a timestamp sequence relationship; the normal log template sequence sample is constructed based on multiple log key sequence samples of historical normal logs with a timestamp sequence relationship and new parameter value vector sequence samples; the new parameter value vector sequence sample is obtained by fusing a basic parameter value vector sequence based on multiple historical normal logs with a timestamp sequence relationship and the personnel information parameters of each historical normal log.

[0137] During the training phase, as a possible implementation, cross entropy is used as the loss function for detecting log key anomalies, and mean squared error (MSE) is used as the loss function for detecting parameter value anomalies. By minimizing these loss functions, the log audit monitoring model gradually learns normal log patterns, thus achieving dual anomaly detection capabilities and achieving effective and accurate audit monitoring of logs.

[0138] To facilitate understanding of the implementation of step S206 in the above embodiment, please refer to Figure 5 , which shows an example process of realizing dual anomaly monitoring through a log audit detection model in an embodiment of the present application. Figure 5 As shown in , in an optional implementation, analyzing the log template sequence by the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result may include the following steps:

[0139] S2061. The log audit monitoring model extracts the log key sequence to be analyzed w={m t-h ,…,m t-2 ,m t-1}, based on the log key sequence to be analyzed w={m t-h ,…,m t-2 ,m t-1}Analyze the next log key m t Check if there is an exception and get the log key m t The log key exception analysis result of the corresponding log.

[0140] Still see Figure 3In the technical solution of this application, the log audit detection model needs to analyze the abnormality of the log key sequence of the current log stream, and the analysis result is called the log key abnormality analysis result. In the analysis mechanism, if it is necessary to identify the abnormality of the log key of a certain log, it is necessary to analyze the log keys of the h logs before the log, that is, the log key sequence w={m t-h ,…,m t-2 ,m t-1}.

[0141] Specifically, the log audit monitoring model is based on the log key sequence w={m t-h ,…,m t-2 ,m t-1}Predict the next log key m t The conditional probability distribution of the next log key m t The possibility of multiple candidate situations. If the next log key m t If the actual value of is within the first g candidate cases in the conditional probability distribution, the log key abnormality analysis result of the log is determined to be normal; if the next log key m t If the actual value of is not within the first g candidate cases in the conditional probability distribution, the log key anomaly analysis result of the log is determined to be abnormal. Here, the first g candidate cases correspond to normal candidate cases. In this application, g is a positive integer.

[0142] In this embodiment of the present application, analysis of abnormal operational behavior is based not only on the log key anomaly analysis results, but also on the parameter value anomaly analysis results. In some cases, the log key anomaly analysis results indicate normal operation, but the parameter value anomaly analysis results indicate a problem, which also requires attention to the risk. S2062 below will specifically describe the analysis process for parameter value anomalies based on the new parameter value vector.

[0143] S2062. The log audit monitoring model extracts the new parameter value vector corresponding to each log key from the log template sequence, and based on the new parameter value vector corresponding to each log key, predicts whether there is an abnormality in the parameter value of the corresponding next log, and obtains the parameter value abnormality analysis result of each log.

[0144] The parameter value anomaly analysis results are used to indicate whether there are anomalies in the basic parameter values ​​and whether there are anomalies in the personnel authority information. As mentioned earlier, on the basis of the basic parameter value vector, data enhancement was carried out in combination with the personnel information parameters to form a new parameter value vector. When analyzing this vector, two levels of analysis results can be obtained, one is whether there are anomalies in the basic parameter values ​​(such as version numbers, etc.), and the other is whether there are anomalies in the personnel authority information. The former level is to assist in combining with the log key anomaly analysis results to determine the first anomaly monitoring result; the latter level is used to determine the second anomaly monitoring result. When this step is implemented specifically, it can be:

[0145] First, based on the new parameter value vector corresponding to each log key, the first predicted distribution and second predicted distribution of the corresponding next log are predicted. The first predicted distribution is the predicted distribution of the basic parameter value for abnormal behavior monitoring, and the second predicted distribution is the predicted distribution of the personnel information parameter for personnel authorization monitoring.

[0146] Next, the first confidence interval of the basic parameter value of the next log is calculated according to the first predicted distribution. If the actual value of the basic parameter value of the next log is within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is normal; if the actual value of the basic parameter value of the next log is not within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is abnormal.

[0147] Among them, the first confidence interval refers to the normal range of the basic parameter value.

[0148] In addition, a second confidence interval of the personnel information parameter of the next log is calculated based on the second predicted distribution. If the actual value of the personnel information parameter of the next log is within the second confidence interval, the abnormal analysis result of the parameter value of the next log indicates that the generation of the next log is triggered by a person with normal authority; if the actual value of the personnel information parameter of the next log is not within the second confidence interval, the abnormal analysis result of the parameter value of the next log indicates that the generation of the next log is triggered by a person with abnormal authority.

[0149] Among them, the second confidence interval refers to the normal range of personnel information parameters.

[0150] S2063. If the log key exception analysis result of the same log indicates an exception and / or the parameter value exception analysis result indicates that there is an exception in the basic parameter value, then a first exception monitoring result is obtained indicating that the generation of the log is triggered by an abnormal behavior pattern; if the log key exception analysis result of the same log indicates that there is no exception, and the parameter value exception analysis result indicates that there is no exception in the basic parameter value, then a first exception monitoring result is obtained indicating that the generation of the log is triggered by a normal behavior pattern.

[0151] S2064. If the parameter value abnormality analysis result indicates that there is an abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of the log is triggered by a person with abnormal authority; if the parameter value abnormality analysis result indicates that there is no abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of the log is triggered by a person with normal authority.

[0152] In an optional implementation, the log audit monitoring system is also configured with an information display and feedback mechanism. Figure 6 This is a flow chart of another log audit monitoring method provided by the embodiment of this application. Figure 6 As shown, different from Figure 2 In a corresponding embodiment, in this embodiment, after S206 analyzes the log template sequence through the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result, the log audit monitoring method further includes:

[0153] S207: If the first abnormality monitoring result indicates an abnormality and / or the second abnormality monitoring result indicates an abnormality, risk warning information is generated and pushed to the audit end.

[0154] In this way, users on the audit side or audit-related systems can receive risk warning information about abnormal situations in a timely manner. The risk warning information can not only indicate whether the first abnormal monitoring result indicates an abnormality or the second abnormal monitoring result indicates an abnormality. It can also further display the specific abnormal behavior type predicted by the model in the risk warning information. For example, the first abnormal monitoring result indicates an abnormality, and the model infers one of the abnormal behaviors: frequent operation behavior, operation behavior during abnormal time period, and malicious attack behavior. In addition, the risk warning information can also provide relevant log information, which carries information about the operating user, thereby facilitating further analysis and risk confirmation on the audit side.

[0155] The model can push risk warning information to the audit side through email, SMS, API, etc. Furthermore, the push method can be customized by the user, making it easier for the audit side to promptly understand risk warnings and take appropriate countermeasures, thus achieving the goal of effective risk monitoring.

[0156] S208: If the risk misjudgment information based on the risk warning information feedback from the audit end is received, the log audit monitoring model is further studied and optimized using the risk misjudgment information.

[0157] In actual applications, users or related systems on the audit side can further analyze and judge based on the risk warning information pushed by the model. For example, the audit side can analyze whether the model reasoning results are wrong. In the case of errors, the audit side needs to feedback risk misjudgment information to the log audit monitoring system. These risk misjudgment information can be effectively applied. For example, if a normal log entry is mistakenly classified as an anomaly, the log audit monitoring model can dynamically adjust the model weight based on the feedback of such risk misjudgment information, or re-input the model as a training sample, thereby reducing the probability of subsequent misjudgment of normal as abnormal after learning and optimizing the model. At the same time, it also avoids the interference of erroneous push conclusions on the work efficiency of the audit side. In other words, the parameter weights of the log audit monitoring model used in the technical solution of the present application can be adjusted and updated in real time based on actual feedback, thereby ensuring the user's actual monitoring experience.

[0158] In an optional implementation, the log audit monitoring system also includes: a data integration module and a data storage module; the data storage module is configured with a Kafka stream database; wherein, the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system. As a distributed stream processing platform, Kafka can receive, store and forward data streams in real time, and can also act as a buffer for data streams. The Kafka-based stream database facilitates model training and instant prediction. The Kafka stream database can not only provide the log audit monitoring model with training data, but also serve to provide the log audit monitoring model with real-time log streams that need to be monitored in order to perform substantive monitoring.

[0159] Kafka offers high performance, high throughput, and low latency, making it ideally suited as the access layer for real-time data sources. As mentioned previously, the fourth drawback is that existing technologies lack timely effectiveness for IT audits and experience a certain lag in risk warnings. To address the real-time demands, the Kafka streaming database effectively addresses this lag. Furthermore, the configuration of the data integration and data storage modules makes the log audit and monitoring system more comprehensive and powerful.

[0160] In the technical solution of the present application, after collecting the original log data generated at the key log production nodes through the agent program, the method further includes:

[0161] The data integration module uses ETL technology to automatically extract, clean, filter, convert and standardize the original log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database; the Kafka stream database provides the log audit monitoring model with the log data to be analyzed that has been processed by ETL technology.

[0162] Based on the log audit monitoring method described above, this application also provides a log audit monitoring system. The specific implementation of this system will be described below with reference to the accompanying drawings.

[0163] like Figure 7 As shown, the log audit monitoring system in this application includes: a data acquisition module 71 and a model prediction module 72. The log audit monitoring system has a real-time embedded end-to-end architecture.

[0164] The data collection module 71 is implemented by an agent program deployed at multiple key log production nodes;

[0165] The model prediction module 72 is implemented by a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the log audit monitoring model is a deep learning model based on the DeepLog architecture;

[0166] The data collection module 71 is used to collect the original log data generated at the key nodes of log production through the agent program;

[0167] Model prediction module 72 is used to perform data analysis based on the original log data through the log audit monitoring model to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data; the log key sequence is a sequence of log keys for each log in the original log data arranged in the order of log timestamps; the basic parameter value vector sequence is a sequence of basic parameter value vectors for each log in the original log data arranged in the order of log timestamps;

[0168] The model prediction module 72 is further configured to match the operating user information of each log in the original log data with the existing personnel information dataset based on the log audit monitoring model to obtain the personnel information parameters of each log in the original log data;

[0169] The model prediction module 72 is further configured to obtain a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log by the log audit monitoring model;

[0170] The model prediction module 72 is further configured to construct a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence by the log audit monitoring model;

[0171] The model prediction module 72 is also used to analyze the log template sequence through the log audit monitoring model to obtain a first abnormal monitoring result and a second abnormal monitoring result; the first abnormal monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second abnormal monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority.

[0172] Figure 8 This shows another structural effect of the log audit monitoring system. Figure 8 As shown, different from Figure 7 As shown, in an optional implementation, the log audit monitoring system is further configured with a display feedback module 73 , a data integration module 74 and a data storage module 75 .

[0173] The display and feedback module 73 is used to implement the information display and feedback mechanism; the display and feedback module 73 is connected to the model prediction module 72;

[0174] The display feedback module 73 is specifically used for:

[0175] If the first abnormality monitoring result indicates abnormality and / or the second abnormality monitoring result indicates abnormality, the risk warning information generated by the model prediction module 72 is received and pushed to the audit terminal for display. Figure 8 You can see the words “Risk Warning Display” in the display feedback module 73, which means that the module has this display function.

[0176] If the audit end receives risk misjudgment information based on risk warning information feedback, the risk misjudgment information is fed back to the model prediction module 72 so that the model prediction module 72 can continue to learn and optimize the log audit monitoring model using the risk misjudgment information. Figure 8 It can be seen that the words “Risk Misjudgment Feedback Display” are displayed in the feedback display module 73, indicating that the module also has the function of displaying feedback information on whether the result identified by the model is confirmed to be abnormal, thereby facilitating user viewing.

[0177] like Figure 8 In an optional implementation, the system further includes: a data integration module 74 and a data storage module 75. The data storage module 75 is configured with a Kafka stream database; wherein the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system.

[0178] The data integration module 74 is used to use ETL technology to automatically extract, clean, filter, convert and standardize log data from raw log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database;

[0179] The data storage module 75 is used to provide the log data to be analyzed that has been processed by ETL technology to the log audit monitoring model through the Kafka stream database.

[0180] It should be noted that, in the embodiment of the present application, the data collected by the data acquisition module 71 enters the data integration module 74 in the form of a message queue. After the data integration module 74 completes the ETL processing of the data, it provides it to the data storage module 75. The data storage module 75 can store data through online storage or Kafka stream database to provide data support to the model prediction module 72. If the model prediction module 72 detects an anomaly, the relevant data can be sent to the data storage module 75 to build a risk warning database to provide a data basis for subsequent risk analysis and event tracing. In addition, the model prediction module 72 sends the monitoring results to the display feedback module 73 for interaction with the audit end.

[0181] Compared with the existing technology, the technical solution of this application has the following advantages:

[0182] (1) In view of the problem that the data submitted by the audited personnel may be tampered with and distorted, this application is directly embedded in the business system, by deploying an agent at the log production end to collect embedded data in real time, and inputting the collected stream data into the optimized DeepLog model for real-time prediction. This effectively avoids the tampering risk that the audit data may face during the export stage and manual sorting stage; at the same time, the entire process is imperceptible to the business system, thereby achieving efficient and secure risk monitoring and early warning.

[0183] (2) In response to the shortcomings of existing technologies in terms of poor timeliness, this application uses real-time data collection and online model training and prediction to effectively improve the timeliness of the audit system, and can provide timely warnings and prevention of risks. This application collects log data in real time through embedded points and performs quasi-real-time processing through online storage and Kafaka stream database. The DeepLog model supports the input of streaming data and supports online incremental updates of the model, thereby achieving rapid risk monitoring and detection.

[0184] (3) In response to the limitations and subjective biases in the selection of audit samples and audit features, this application, based on a big data platform, can process massive amounts of data and conduct real-time processing and prediction of the full log data of the business system, thereby achieving full sample auditing. This application uses a unified log template to parse the original log data of various systems, which not only shields the heterogeneity of the logs but also retains the original information of the logs as completely as possible without the need for manual feature construction. By learning the original log information, the model can learn the complex correlation and temporal relationships between log entries, thereby achieving more comprehensive risk monitoring and effectively identifying potential risk information.

[0185] (4) In order to solve the problem of relying on labeled data, this application learns the characteristics and patterns of normal log data. When a new log data stream is input, the model compares it with the learned normal pattern and determines the data that deviates from the normal log pattern as risky and abnormal. Through this unsupervised approach, learning can be performed on a data set of unlabeled samples, which can effectively reduce the cost and difficulty of data labeling. It can well solve the problems in traditional practices where the number and quality of manual and model-labeled samples are limited, resulting in too small training data or high sample homogeneity, overfitting of model training, and the difficulty of such supervised models in identifying abnormal situations outside the training samples.

[0186] (5) To address the problem of extremely unbalanced distribution of positive and negative samples in log data, this application uses an unsupervised model called DeepLog. The core of this method is that it does not require a large number of labeled samples (i.e., positive and negative samples) for training, but rather trains the model based on a small number of normal logs. It builds a model by learning the log pattern during normal execution, and automatically detects anomalies when the log deviates from the normal pattern. This training method avoids a series of problems caused by the imbalanced distribution of positive and negative samples in log data.

[0187] (6) Unlike conventional machine learning and deep learning models, the DeepLog algorithm used in this application is an algorithm that processes log sequences based on an LSTM neural network. However, it combines the characteristics of system logs with IT audit requirements for targeted optimization, such as log template extraction, abnormal pattern detection, workflow modeling, and online incremental training. Furthermore, it only requires training on a small number of normal log training samples. In summary, the model in this application has higher accuracy and efficiency in risk detection of system logs.

[0188] (7) This application uses personnel information as an important input and associates it with the corresponding log data to achieve data enhancement of the log information. The enhanced data is input into the model to identify illegal unauthorized activities such as users who have left or changed positions still performing operation and maintenance operations, and employees who frequently modify permission settings or perform sensitive operations in a short period of time.

[0189] The model application layer for this patent application is not limited to the specific DeepLog model. It can also include models such as LogAnomaly, which are also based on LSTM and support real-time log anomaly prediction based on streaming data. Based on the algorithmic principles and the comparison of model performance, DeepLog is superior to a certain extent. The emergence of better algorithmic models at the model application layer is possible now or in the future. This application focuses on the design and implementation of a targeted system architecture for IT audit scenarios, covering data collection, data integration, data storage, model application, display and feedback. It also focuses on comparing the problems existing in existing risk monitoring models and proposes the use of the DeepLog model at the model application layer to achieve higher accuracy and better timeliness. Data enhancement is also performed based on personnel authorization information to optimize model effectiveness.

[0190] The log audit monitoring system provided by this application combines big data technology to conduct pre-emptive risk warnings, improving the real-time and accuracy of audits. Compared with traditional expert rule audits, it is more capable of discovering potential risks, and the detected risk points have more comprehensive coverage. Mainstream machine learning algorithms and deep learning algorithms have varying degrees of limitations when processing unstructured data such as log information; in addition, unsupervised algorithm models such as association rules and clustering are not very accurate; supervised algorithms require a lot of manpower for sample labeling; although large models have powerful computing power, the training process requires a lot of computing resources and large-scale training samples. After comprehensive comparative analysis, DeepLog has a significant advantage in detecting anomalies in log data. The results of the technology selection comparison are shown in Table 4.

[0191] Table 4

[0192]

[0193] The log audit monitoring system of the technical solution of this application achieves the purpose of risk monitoring by deploying an Agent on the log production end to collect embedded data in real time, and inputs the collected stream data into the improved DeepLog model for real-time prediction. This architectural design not only improves the timeliness of early warning, but also greatly improves the transparency of the audit process. By directly embedding it into the business system, the risk of tampering of audit data during the export stage is effectively avoided; at the same time, the entire process is imperceptible to the business system, thereby achieving efficient and secure risk monitoring and early warning.

[0194] At the same time, the architecture, based on the integration of deep learning and a big data platform, enables the system to process massive amounts of data, thus overcoming the limitations of traditional sampling audits and ushering in an era of full-sample audits. Furthermore, the automated audit system transforms the traditional "project-based" periodic audit model into a "monitoring-based" hybrid mechanism of daily oversight and real-time early warning. Furthermore, the online monitoring system can help audit operations shift from "on-site audits" to "remote audits." This shift will not only improve the efficiency and value of audit work, but also further strengthen enterprises' risk mitigation and prevention capabilities.

[0195] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0196] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A log audit monitoring method, characterized in that: The method is applied to a log audit monitoring system; The log audit monitoring system has a real-time, embedded, end-to-end architecture. The system includes at least: an agent program deployed at multiple key log production nodes, and a log audit monitoring model that has both abnormal behavior monitoring and personnel authorization monitoring functions for logs; the log audit monitoring model is a deep learning model based on the DeepLog architecture; The method comprises: Collecting the original log data generated at the key log production node through the agent program; The log audit monitoring model performs data parsing based on the original log data to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data; the log key sequence is a sequence in which the log keys of each log in the original log data are arranged in the order of log timestamps; the basic parameter value vector sequence is a sequence in which the basic parameter value vectors of each log in the original log data are arranged in the order of log timestamps; The log audit monitoring model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data; The log audit monitoring model obtains a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log; The log audit monitoring model constructs a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence; The log template sequence is analyzed through the log audit monitoring model to obtain a first abnormality monitoring result and a second abnormality monitoring result; the first abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority.

2. The method according to claim 1, characterized in that The existing personnel information dataset includes multiple personnel information entries; each personnel information entry includes employee information, user information, and permission information; the employee information includes at least: employee status, which is one of: employed, resigned, transferred, or retired; the permission information includes: user role permissions and authorization period information; The log audit monitoring model matches the operating user information of each log in the original log data with the existing personnel information data set to obtain the personnel information parameters of each log in the original log data, including: The log audit monitoring model is used to match the operating user information of each log in the original log data with the existing personnel information data set to see whether there is a personnel information entry corresponding to the user information; If a personnel information entry corresponding to the user information is determined to exist from the existing personnel information data set, extracting part or all of the information in the personnel information entry as personnel information parameters of the corresponding log in the original log data; wherein the part of the information includes at least the employee status and the authority information; If it is determined from the matching of the existing personnel information data set that there is no personnel information entry corresponding to the user information, the corresponding personnel information parameter in the original log data is set to empty.

3. The method according to claim 1, characterized in that The log audit monitoring model obtains a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log, including: The log audit monitoring model, based on each basic parameter value vector of the basic parameter value vector sequence and the obtained personnel information parameters of each log, performs splicing of the basic parameter value vector and the personnel information parameters log by log to obtain a new parameter value vector for each log in the original log data; The new parameter value vectors of each log obtained are arranged in the order of the log timestamps to form a new parameter value vector sequence.

4. The method according to claim 1, wherein The analyzing the log template sequence by the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result includes: The log audit monitoring model extracts the log key sequence to be analyzed w={m t-h ,…,m t-2 ,m t-1 }, based on the log key sequence to be analyzed w={m t-h ,…,m t-2 ,m t-1 }Analyze the next log key m t Is there an exception? Get the log key m t The log key exception analysis result of the corresponding log; The log audit monitoring model extracts a new parameter value vector corresponding to each log key from the log template sequence, and based on the new parameter value vector corresponding to each log key, predicts whether the parameter value of the corresponding next log entry is abnormal, and obtains a parameter value abnormality analysis result for each log entry; the parameter value abnormality analysis result is used to indicate whether the basic parameter value and the personnel authority information are abnormal. If the log key anomaly analysis result of the same log indicates an anomaly and / or the parameter value anomaly analysis result indicates that the basic parameter value is anomaly, then a first anomaly monitoring result indicating that the generation of the log is triggered by an abnormal behavior pattern is obtained; if the log key anomaly analysis result of the same log indicates that there is no anomaly, and the parameter value anomaly analysis result indicates that there is no anomaly in the basic parameter value, then a first anomaly monitoring result indicating that the generation of the log is triggered by a normal behavior pattern is obtained; If the parameter value abnormality analysis result indicates that there is an abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of this log is triggered by a person with abnormal authority; if the parameter value abnormality analysis result indicates that there is no abnormality in the personnel authority information, a second abnormality monitoring result is obtained, indicating that the generation of this log is triggered by a person with normal authority.

5. The method according to claim 4, characterized in that The log key sequence w={m t-h ,…,m t-2 ,m t-1 }Analyze the next log key m t Is there an exception? Get the log key m t The corresponding log key exception analysis results for the log include: Based on the log key sequence w={m t-h ,…,m t-2 ,m t-1 }Predict the next log key m t The conditional probability distribution is used to characterize the next log key m t the possibility of multiple candidate scenarios; If the next log key m t If the actual value of is within the first g candidate cases in the conditional probability distribution, the log key abnormality analysis result of the log is determined to be normal; if the next log key m t If the actual value of is not within the first g candidate cases in the conditional probability distribution, the log key anomaly analysis result of the log is determined to be abnormal.

6. The method according to claim 4, characterized in that The method of predicting whether the parameter value of the corresponding next log entry is abnormal based on the new parameter value vector corresponding to each log key and obtaining the parameter value abnormality analysis result of each log entry includes: Based on the new parameter value vector corresponding to each log key, predict the first predicted distribution and second predicted distribution of the corresponding next log; the first predicted distribution is the predicted distribution of the basic parameter value for abnormal behavior monitoring, and the second predicted distribution is the predicted distribution of the personnel information parameter for personnel authorization monitoring; Calculating a first confidence interval of the basic parameter value of the next log according to the first predicted distribution; if the actual value of the basic parameter value of the next log is within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is normal; if the actual value of the basic parameter value of the next log is not within the first confidence interval, the parameter value anomaly analysis result of the next log indicates that the basic parameter value is abnormal; A second confidence interval of the personnel information parameter of the next log is calculated based on the second predicted distribution. If the actual value of the personnel information parameter of the next log is within the second confidence interval, the parameter value abnormality analysis result of the next log indicates that the generation of the next log is triggered by a person with normal authority; if the actual value of the personnel information parameter of the next log is not within the second confidence interval, the parameter value abnormality analysis result of the next log indicates that the generation of the next log is triggered by a person with abnormal authority.

7. The method according to claim 1, characterized in that The log audit monitoring model is pre-trained using a sample data set of a normal log template sequence in an unsupervised learning manner; The sample data set of the normal log template sequence includes a plurality of normal log template sequence samples; Each of the normal log template sequence samples includes a plurality of log template samples of historical normal logs with a time stamp sequence relationship; The normal log template sequence sample is constructed based on the log key sequence samples of the plurality of historical normal logs having a chronological relationship of timestamps and the new parameter value vector sequence sample; The new parameter value vector sequence sample is obtained by fusing the basic parameter value vector sequences of the multiple historical normal logs with a chronological relationship of timestamps and the personnel information parameters of each historical normal log.

8. The method according to claim 1, characterized in that The log audit monitoring system is also equipped with an information display and feedback mechanism; After analyzing the log template sequence by the log audit monitoring model to obtain the first abnormality monitoring result and the second abnormality monitoring result, the method further includes: If the first abnormality monitoring result indicates an abnormality and / or the second abnormality monitoring result indicates an abnormality, generating risk warning information and pushing the risk warning information to the audit end; If the risk misjudgment information fed back by the audit end based on the risk warning information is received, the log audit monitoring model is further studied and optimized using the risk misjudgment information.

9. The method according to claim 1, characterized in that The log audit monitoring system further includes: a data integration module and a data storage module; the data storage module is configured with a Kafka stream database; wherein the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system; After collecting the original log data generated at the key log production node through the agent program, the method further includes: The data integration module uses ETL technology to automatically extract, clean, filter, convert and standardize log data from the original log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database; the Kafka stream database provides the log audit monitoring model with the log data to be analyzed that has been processed by the ETL technology.

10. A log audit monitoring system, characterized in that: The log audit monitoring system has a real-time embedded end-to-end architecture, and the log audit monitoring system includes at least: a data acquisition module and a model prediction module; The data collection module is implemented by an agent program deployed at multiple key log production nodes; The model prediction module is implemented through a log audit monitoring model that has both abnormal behavior monitoring functions and personnel authorization monitoring functions for logs; the log audit monitoring model is a deep learning model based on the DeepLog architecture; The data collection module is used to collect the original log data generated at the key log production node through the agent program; The model prediction module is used to perform data analysis based on the original log data through the log audit monitoring model to obtain a log key sequence and a basic parameter value vector sequence corresponding to the original log data; the log key sequence is a sequence in which the log keys of each log in the original log data are arranged in the order of log timestamps; the basic parameter value vector sequence is a sequence in which the basic parameter value vectors of each log in the original log data are arranged in the order of log timestamps; The model prediction module is further configured to obtain personnel information parameters of each log in the original log data by matching the operating user information of each log in the original log data with the existing personnel information data set by the log audit monitoring model; The model prediction module is further configured to obtain a new parameter value vector sequence by fusing the basic parameter value vector sequence and the personnel information parameter of each log by the log audit monitoring model; The model prediction module is further configured to construct, by the log audit monitoring model, a log template sequence corresponding to the original log data based on the log key sequence and the new parameter value vector sequence; The model prediction module is also used to analyze the log template sequence through the log audit monitoring model to obtain a first abnormality monitoring result and a second abnormality monitoring result; the first abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by an abnormal behavior pattern; the second abnormality monitoring result is used to indicate whether the generation of a certain log in the original log data is triggered by a person with abnormal authority.

11. The system according to claim 10, wherein: The system is further configured with a display feedback module, which is used to implement information display and feedback mechanism; the display feedback module is connected to the model prediction module; The display feedback module is specifically used to: If the first abnormality monitoring result indicates an abnormality and / or the second abnormality monitoring result indicates an abnormality, receiving the risk warning information generated by the model prediction module, and pushing the risk warning information to the audit end for display; If the audit end receives risk misjudgment information based on the risk warning information, the risk misjudgment information is fed back to the model prediction module so that the model prediction module can continue to learn and optimize the log audit monitoring model using the risk misjudgment information.

12. The system according to claim 10 or 11, characterized in that The system further comprises: a data integration module and a data storage module; the data storage module is configured with a Kafka stream database; wherein the Kafka stream database is selected based on the real-time requirements of the log audit monitoring system; The data integration module is used to use ETL technology to automatically extract, clean, filter, convert and standardize log data from the original log data in the audit scenario application of the log audit monitoring system, and load the processed data into the Kafka stream database; The data storage module is used to provide the log data to be analyzed processed by the ETL technology to the log audit monitoring model through the Kafka stream database.

Images