Document tracking method and device based on log, computer equipment and storage medium

Abstract

The invention belongs to the field of data processing, and relates to a log-based document tracking method and device, computer equipment and a storage medium, the method comprises the following steps: obtaining a document operation log, the operation log comprising field information; according to the field information, an identifier easy to derive is set for the operation log, and a field easy to derive and calculate is established; synchronizing the operation log which is provided with the identification easy to derive and establishes the field easy to derive and calculate; performing document derivation according to the synchronized operation log; storing derivative information of the document; and performing derivative analysis on the document according to the derivative information. Synchronous cleaning, operation derivative tree generation and derivative hierarchy calculation of terminal operation logs can be automatically completed, multi-dimensional log query and analysis on the same derivative tree or the same derivative link can be achieved based on the generated operation log derivative tree, query is more visual, the analysis range breadth is higher, and user experience is improved. And more information can be provided for monitoring and analyzing terminal document operation behaviors.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly to a log-based document tracking method, apparatus, computer device, and storage medium. Background Art

[0002] With the full digitalization of various industries, the data scale has increased exponentially, and data security issues have become increasingly prominent. Leakage incidents occurring within enterprises are also becoming more frequent. Internal threats generally come from two aspects. One is that employees unconsciously upload important internal files to the network disk or host code on the public network during the work process, resulting in data leakage; the other is that employees take risks driven by data interests and steal data. There are also some employees who plan to leave the company. When leaving, they take away important secrets or even maliciously damage data. The existing document tracking mode can only query based on single operation logs, which is not conducive to tracking the ins and outs of documents, and the security of data is greatly threatened. Summary of the Invention

[0003] To solve the above technical problems, the present invention provides a log-based document tracking method, which adopts the following technical solutions, including: Obtain the document operation logs, where the operation logs include field information; According to the field information, set an identifier that is easy to derive for the operation logs, and establish a field that is easy to derive and calculate; Synchronize the operation logs after setting the identifier that is easy to derive and establishing the field that is easy to derive and calculate; Perform document derivation according to the synchronized operation logs; Store the derived information of the document; Perform derivative analysis on the document according to the derived information.

[0004] Preferably, the step of obtaining the document operation logs, where the operation logs include field information specifically includes: Obtain the collection requirements, and select a log collection tool or collection program; Configure the collection parameters and rules, where the collection parameters include the field information included in the operation logs; Deploy the collection tool or collection program to the terminal device; Monitor the log collection process and perform exception handling.

[0005] Preferably, the step of setting an identifier that is easy to derive for the operation logs and establishing a field that is easy to derive and calculate according to the field information specifically includes: Determine the type of identifier to be set according to the field information; Set and apply the identification rules according to the type of identifier; Set an identifier that is easy to derive for the operation log according to the said identification rule; Establish a field that is easy to derive and calculate.

[0006] Preferably, the step of synchronizing the operation log with the set identifier that is easy to derive and the established field that is easy to derive and calculate specifically includes: Receive the operation log and cache the operation log; Read the cached log content and parse it according to the predefined log format; Execute data synchronization operations according to the parsed log information.

[0007] Preferably, the step of performing document derivation according to the synchronized operation log specifically includes: Create a derived information table, and create a separate data table in the database to record the derived information of each document; Identify the derived source data, and find the derived source data in the document operation log that has been synchronized in the database; According to the log record, apply the source path tracking algorithm to track the derivation process of the file; Construct a derived hierarchy list for each derived source. According to the source path and target path, mark the belonging level, parent node id, and source log id of each log. After all logs are traversed, write the constructed derived hierarchy list into the derived table to complete document derivation; Dynamically update the derived hierarchy information.

[0008] Preferably, the step of storing the derived information of the document specifically includes: Set the data table structure according to the type and function of the derived information. The data table structure includes metadata fields and version history fields; Store metadata through the metadata field. The metadata is information used to describe the attributes and characteristics of the document; Store the version history information of the document through the version history field; Set permissions and access control for the document.

[0009] Preferably, the step of performing derivative analysis on the document according to the derived information specifically includes: Query the source log according to the derived information; Through the identifier recursive algorithm, query all derived operation trees of all derived source files; Query and display the derived link of the document.

[0010] To solve the above technical problems, the present invention also provides a log-based document tracking device, which adopts the following technical solutions, including: An acquisition module, configured to acquire the document operation log, and the operation log includes field information; A setting module, configured to set an easily derivable identifier for the operation log according to the field information, and establish fields for easy derivative calculation; A synchronization module, configured to synchronize the operation log with the easily derivable identifier set and the fields for easy derivative calculation established; A derivative module, configured to perform document derivation according to the synchronized operation log; A storage module, configured to store the derived information of the document; An analysis module, configured to perform derivative analysis on the document according to the derived information.

[0011] To solve the above technical problems, the present invention also provides a computer device, which adopts the following technical solutions, including a memory and a processor. Computer-readable instructions are stored in the memory, and when the processor executes the computer-readable instructions, the steps of the above log-based document tracking method are implemented.

[0012] To solve the above technical problems, the present invention also provides a computer-readable storage medium, which adopts the following technical solutions. Computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the steps of the above log-based document tracking method are implemented.

[0013] Compared with the prior art, the present invention mainly has the following beneficial effects: (1) By acquiring the document operation log containing detailed field information, it can ensure that every change to the document is recorded in detail, which helps to trace and verify the historical state of the document later and improves the transparency of document management; (2) Setting an easily derivable identifier for the operation log and establishing fields for easy derivative calculation simplifies the processing process of log data. The establishment of this identifier and fields makes the log data more structured, facilitating subsequent data analysis and processing; (3) Synchronizing the operation log with the identifier and fields established ensures the real-time and consistency of data, which helps to achieve seamless docking of log data in multiple nodes or multiple systems and improves the overall system's collaboration efficiency; (4) Performing document derivation according to the synchronized operation log can automatically generate multiple versions or variants of the document, meet diverse document requirements, greatly improve the automation degree of document generation, and reduce labor costs; (5) Storing the derivative information of documents and conducting derivative analysis helps to deeply explore the associations and differences between documents, providing a scientific basis for document management, not only improving the intelligent level of document management but also providing a strong basis for decision support; (6) It can automatically complete the synchronous cleaning of terminal operation logs, generate operation derivative trees, and calculate derivative levels. Based on the generated operation log derivative trees, multi-dimensional log query and analysis can be realized on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous one that could only query based on a single operation log, with a wider analysis scope, and can provide more information for monitoring and analyzing terminal document operation behaviors. Brief Description of the Drawings

[0014] To more clearly illustrate the solutions in the present invention, the following will briefly introduce the drawings required for describing the embodiments of the present invention. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0015] Figure 1 It is a flowchart of an embodiment of the log-based document tracking method of the present invention; Figure 2 It is a schematic diagram of the single tracking process of document operation logs used in the prior art; Figure 3 It is a flowchart of the specific implementation manner of document derivation used in the log-based document tracking method of the present invention; Figure 4 It is a schematic diagram of generating document derivation relationships used in the log-based document tracking method of the present invention; Figure 5 It is a schematic structural diagram of an embodiment of the log-based document tracking device of the present invention; Figure 6 It is a schematic structural diagram of an embodiment of the computer device of the present invention. Detailed Embodiments

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs; the terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above description of the drawings are intended to cover non-exclusive inclusion. The terms "first", "second", etc. in the specification and claims of the present invention or the above drawings are used to distinguish different objects and are not used to describe a specific order.

[0017] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments can be included in at least one embodiment of the invention. Appearing at various places in the specification, this phrase is not necessarily referring to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive of other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0018] To enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0019] It should be noted that the log-based document tracking method provided by the embodiments of the present invention is generally executed by a server / terminal device. Correspondingly, the log-based document tracking device is generally set in the server / terminal device.

[0020] It should be understood that the numbers of terminal devices, networks, and servers are merely illustrative. According to actual needs, there can be any number of terminal devices, networks, and servers.

[0021] Embodiment 1 Please refer to Figure 1 , which shows a flowchart of an embodiment of the log-based document tracking method of the present invention. The log-based document tracking method includes the following steps: Step S1, obtain a document operation log, and the operation log includes field information.

[0022] In this embodiment, the electronic device (such as a server / terminal device) on which the log-based document tracking method runs can receive a log-based document tracking request through a wired connection or a wireless connection. It should be noted that the above wireless connection methods can include but are not limited to 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAXX connections, Zigbee connections, UWB (ultra wideband) connections, and other currently known or future-developed wireless connection methods.

[0023] The operation log is an important tool for recording various operation events in a system or application program, and it contains rich information. According to actual needs, the operation log content includes multiple field information. The field information includes but is not limited to: Log ID: uniquely identifies each log record for easy tracking and querying; Terminal ID: identifies the terminal device that executes the operation, which helps to locate the problem device or user; Document name: the name of the document being operated, which is one of the key information in the log; Operation type: including operations such as creation, upload, copy, move, delete, etc., reflecting the specific actions of the user on the document; Source path of document operation: The storage location before the document operation, which helps to understand the source of the document; Source device of document operation: The type of storage device before the document operation, such as local disk, network disk, removable disk, etc.; Target path of document operation: The storage location after the document operation, reflecting the final destination of the document; Target device of document operation: The type of storage device after the document operation, which is equally important; Document category: Distinguish files or folders, which helps to classify operations more meticulously; Operation time: Record the timestamp when the operation occurs, which is convenient for time series analysis; Operation terminal: Information of the terminal device that executes the operation, such as operating system, IP address, etc., which helps with security auditing.

[0024] In this embodiment, in step S1, obtain the document operation log, and the operation log includes field information, which specifically may include the following steps: S11, obtain the collection requirements and select a log collection tool or program.

[0025] Clarify the collection requirements. The document types, operation types, and storage period of the logs to be collected can be obtained through a configuration file.

[0026] According to the operating system type of the terminal device (such as Windows, Linux, macOS, etc.), select a suitable log collection tool or program. The tool or program should be able to monitor and capture specified document operation events in real time.

[0027] Through step S11, real-time collection of logs can be achieved, ensuring the integrity and accuracy of log data. At the same time, the selection of the tool or program should consider the compatibility and stability of the system.

[0028] S12, configure the collection parameters and rules. The collection parameters include the field information included in the operation log.

[0029] According to the collection requirements, configure the parameters and rules of the collection tool or program, such as log format, collection frequency, storage path, etc. Ensure that the collected log data conforms to the predetermined format and requirements, facilitating subsequent processing and analysis.

[0030] S13, deploy the collection tool or program to the terminal device.

[0031] Deploy the configured collection tool or program to the specified terminal device and conduct necessary tests to ensure its normal operation.

[0032] In specific implementation, the log collection tool of this embodiment adopts the IP-guard system. The IP-guard system, namely the enterprise information supervision system, is a comprehensive intranet security management and data protection software. It applies the system management concept and integrates technical means such as operation auditing, permission control, and document encryption, aiming to comprehensively solve the three major intranet security problems of information security, application efficiency, and system management. With its powerful data classification and encryption functions, strict access control, and detailed auditing and compliance functions, the IP-guard system provides comprehensive data security protection for enterprises. This system supports multi-terminal and multi-level management. The IP-guard system collects document operation logs from terminal devices every day, and the log content includes log id, terminal id, document name, operation type (such as create, upload, copy, move, delete, etc.), source path of document operation, source device of document operation (such as local disk, network disk, removable disk), target path of document operation, target device of document operation, document category (file, folder), operation time, operation terminal, etc.

[0033] Through step S13, real-time collection and transmission of log data can be achieved, providing basic data for subsequent analysis and processing. It should be noted that during the deployment process, attention should be paid to the impact on the performance of terminal devices to ensure the normal operation of the system.

[0034] S14, monitor the log collection process and exception handling.

[0035] Real-time monitor the log collection process, promptly discover and handle collection exceptions, such as collection interruption, data loss, etc. At the same time, establish an exception handling mechanism to ensure the continuity and stability of the collection work.

[0036] Through step S14, the integrity and accuracy of log data can be guaranteed, avoiding data loss or errors caused by collection exceptions. The establishment of the exception handling mechanism helps to improve the reliability and stability of the system.

[0037] Step S2, set an identifier that is easy to derive for the operation log according to the field information, and establish a field that is easy to derive and calculate.

[0038] In this embodiment, step S2, setting an identifier that is easy to derive for the operation log according to the field information and establishing a field that is easy to derive and calculate can specifically include the steps: S21, determine the type of identifier to be set according to the field information.

[0039] These identifiers are used for classifying, filtering, and aggregating operation logs, etc. For example, identifier types include but are not limited to: operation type identifier: set according to the operation category, used to distinguish different types of operations; disk type identifier: set according to the source disk type and the target disk type, used to distinguish operations on different storage devices; time identifier: set according to the operation time, used for classifying and filtering operation logs in terms of time dimension, etc.

[0040] S22. Set and apply identifier rules according to the identifier type.

[0041] It should be noted that these identifier rules should ensure the uniqueness, readability, and usability of the identifiers. For example, for the operation type identifier rule: the abbreviation or code of the operation category can be used as the identifier; for the disk type identifier rule: the English abbreviation or numerical code of the disk type can be used as the identifier; for the time identifier rule: the formatted string of the timestamp can be used as the identifier, such as "YYYY-MM-DD HH:MM:SS".

[0042] S23. Set easily derivable identifiers for the operation logs according to the identifier rules.

[0043] After setting the identifier rules, set easily derivable identifiers for the operation logs.

[0044] It should be noted that the criteria for easy derivation can be set according to actual needs, and no restrictions are imposed here. In specific implementation, according to the identifier rules, easily derivable identifiers can be added to fields such as the operation category, source disk type, and target disk type. The derived identifiers include the derivation source and the derived composition. In specific implementation, the data with the derivation source identifier can be: created on the local disk, downloaded to the local disk, copied, moved, compressed, or decompressed from a non-local disk to the local disk. The data with the derived composition identifier can be all operations where the source device of the document operation is the local disk. In addition, the source path array and the target path array can be calculated based on the source path and the target path of the operation log. For example, when synchronizing an operation log collected by the IP-guard system that copies a file from C:\A\B\1.txt to D:\E\1.txt, first extract the source path C:\A\B and the target path D:\E of the file, and then cut out the source path array ['C:', 'A', 'B'] and the target path array ['D:', 'E'] according to the path separator. The advantage of adding the source path array and the target path array is to facilitate the search for the derivation of the folder.

[0045] In addition, inaccurate collected logs can be excluded, merged, and supplemented to make them into normal logs that can be derived. For example, when using the WinRAR compression software to open a compressed package, instead of directly decompressing it, the files in the compressed package are dragged to the specified directory. At this time, due to the operating mechanism of the WinRAR compression software, the IP-guard terminal will not collect a standard log from the source path where the compressed package is located to the target path of the decompression directory, but will collect two logs. One is the log of decompressing to the system temporary directory, and the other is the log of creating the decompression directory. At this time, the two logs need to be concatenated and merged into a standard derived log through the operation time and file name. S24. Establish fields that are easy to derive and calculate.

[0046] Based on the field information of the operation logs and business requirements, the calculation fields that need to be established can be determined. These fields are used for more in-depth analysis and statistics of the operation logs. For example, the calculation fields include but are not limited to: Operation success rate, which calculates the proportion of successful operations within a specified time period.

[0047] Average operation time, which calculates the average time consumed for operations within a specified time period.

[0048] Disk type operation distribution, which counts the number and proportion of operations on different disk types.

[0049] Error code distribution, which counts the number and proportion of occurrences of different error codes.

[0050] After determining the calculation field requirements, specific calculation field formulas need to be designed. These formulas should be able to accurately reflect the data in the operation logs and business requirements. For example: Operation success rate formula: Operation success rate = Number of successful operations / Total number of operations × 100%.

[0051] Average operation time formula: Average operation time = Total operation time / Total number of operations.

[0052] Disk type operation distribution formula: Count the number of operations on each disk type and calculate its proportion in the total number of operations.

[0053] Error code distribution formula: Count the number of occurrences of each error code and calculate its proportion in the total number of error occurrences.

[0054] After designing the calculation field formulas, these fields need to be implemented. This involves parsing the operation logs, data processing, and calculation. The methods for implementing the calculation fields may vary depending on the system or application, and may include the following steps: Data extraction: Extract the required data fields from the operation logs.

[0055] Data processing: Clean, transform, and format the extracted data to ensure it meets the requirements of the calculation field formula.

[0056] Calculation implementation: Perform calculations according to the calculation field formula and generate calculation results.

[0057] Result storage: Store the calculation results in a specified location or database for subsequent analysis and use.

[0058] In specific implementation, identify fields such as operation category, source disk type, and target disk type with easily derivable identifiers. Correspondingly, establish fields for easily derivable calculations for operation category, source disk type, and target disk type respectively.

[0059] Step S3: Synchronize the operation logs that have been set with easily derivable identifiers and have had fields for easily derivable calculations established.

[0060] After receiving the log file on the target host, log parsing and data synchronization operations need to be performed.

[0061] In this embodiment, step S3 for synchronizing the operation logs that have been set with easily derivable identifiers and have had fields for easily derivable calculations established can specifically include the following steps: S31: Receive the operation logs and cache them.

[0062] A dedicated log receiving area can be set on the target host to receive log files or records from the source host. The received logs can be cached in the local memory buffer or a temporary file first, waiting for subsequent parsing and processing. This can avoid log loss problems caused by the log processing speed not keeping up with the log generation speed.

[0063] S32: Read the cached log content and parse it according to the predefined log format.

[0064] Read the cached log content and parse it according to the predefined log format. The parsing process includes extracting key information such as operation type, operation time, operation object, and operation data. This information will be used for subsequent data synchronization operations.

[0065] To ensure the accuracy and efficiency of log parsing, tools such as regular expressions, XML parsers, or JSON parsers can be used to match and extract the log content. At the same time, the parsed log information can be formatted and verified to ensure the integrity and accuracy of the information.

[0066] S33: Perform data synchronization operations according to the parsed log information.

[0067] Based on the parsed log information, the target host will perform corresponding data synchronization operations. These operations can include inserting new data, updating existing data, or deleting data that is no longer needed, etc.

[0068] Insert operation: When the parsed log information indicates that new data needs to be inserted into the target database, the target host will perform the insert operation and write the new data into the specified database table.

[0069] Update operation: When the parsed log information indicates that existing data in the target database needs to be updated, the target host will perform the update operation, find the corresponding records and update the data.

[0070] Delete operation: When the parsed log information indicates that certain data in the target database needs to be deleted, the target host will perform the delete operation and delete the corresponding data records.

[0071] To ensure the accuracy and efficiency of data synchronization, a transaction processing mechanism can be adopted to ensure data consistency; at the same time, technologies such as batch processing can also be used to improve the efficiency of data synchronization.

[0072] In specific implementation, for the first time, the document operation logs within a specified number of days will be synchronously retrieved from the IP-guard system for full synchronization. After the full synchronization, incremental synchronization will be performed on a daily basis. Affected by the number of terminals, there may be thousands or tens of thousands of terminal objects collecting logs on the same IP-guard system. The large amount of logs within the specified number of days results in a long synchronization process. It is possible to customize the efficient and stable synchronization of logs for the specified number of days according to actual requirements.

[0073] In specific implementation, the specified number of days for synchronization can be dynamically segmented, and dynamic thread tasks can be started to alternately complete the log synchronization for different days. For example, when synchronizing the logs from March 1st to March 31st, through a trade-off algorithm and according to device performance, the data is divided into two groups for synchronization processing. Task A completes the synchronization of the odd-numbered days from March 1st to March 31st, and Task B completes the synchronization of the even-numbered days from March 1st to March 31st. The advantage of this segmentation compared to cutting from the 16th in the middle is that it avoids the situation where the logs in the first half or the second half of a month are significantly less than those in the other half due to long holidays such as May Day, National Day, and Spring Festival.

[0074] The weighing algorithm will automatically split the data into several equal sizes according to the size of the data volume and the performance of the machine, and then perform multi-task processing on the data. In this way, through the intelligent task execution, the dynamic thread task combined with the weighing algorithm greatly shortens the time of full-scale synchronization. In addition, the log analysis system will monitor the memory occupancy of the source system database, and intelligently adjust the amount of logs read from the source system database at one time according to the memory occupancy, avoiding the source system database crashing due to excessive memory occupancy and ensuring the stability of the service.

[0075] In some alternative implementation manners of this embodiment, considering that various errors may occur during log parsing and data synchronization, such as log format errors, data operation failures, etc. To handle these errors, the target host can establish corresponding error handling and recovery mechanisms.

[0076] Log format error handling: When a log format error is encountered, this log record can be skipped and the error information can be recorded, and then the next log can be parsed. This can avoid the entire log synchronization process failing due to individual log format errors.

[0077] Data operation failure handling: When a data operation fails, the operation can be tried again or corresponding solutions can be taken according to the error type. For example, when a database deadlock error is encountered, the operation can be tried again after waiting for a period of time; when a database connection failure error is encountered, the database connection configuration can be checked and the database can be reconnected, etc.

[0078] At the same time, in order to ensure the reliability of data synchronization, a log backup and recovery mechanism can also be adopted. During the log synchronization process, the log files can be backed up to a specified storage location regularly; when the data synchronization fails, the log files can be restored from the backup and the synchronization operation can be performed again.

[0079] Step S4, perform document derivation according to the synchronized operation logs.

[0080] In this embodiment, step S4, performing document derivation according to the synchronized operation logs can specifically include the steps: S41, create a derived information table, and create a separate data table in the database to record the derived information of each document.

[0081] The derived table can include fields: operation log details, parent node id, belonging level, source log id, etc. The source log id represents that this type of file is derived from the same source file.

[0082] The derived table can be created by executing SQL statements in the database. Whenever a document changes or new derived information is generated, relevant information is captured through a logging mechanism and inserted into the derived information table. This method can systematically track and record the derived information of documents, facilitating subsequent queries and analyses, and improving the efficiency and accuracy of document management.

[0083] Through step S41, the derived information can be recorded. The derived table is used to store the key information in the derivation process of each document, including the detailed content of the operation log, which helps with subsequent traceability and auditing.

[0084] Through step S41, the derivation hierarchy can also be managed: through the parent node id and the affiliated hierarchy field, the positions of different file operations in their respective derivation chains can be clearly represented, which is crucial for understanding and managing complex derivation relationships.

[0085] Through step S41, the source can also be identified: the source log id is used to identify the source of the derivation of the same type of files, ensuring that the same type of files can be accurately traced back to their original files.

[0086] S42. Identify the derived source data. In the document operation log that has been synchronized in the database, find the derived source data.

[0087] The source data includes the real source and the virtual source. Filter the log entries for which the database synchronization is complete, paying attention to the operation type, timestamp, and associated document ID in the records. Through the operation chain in the log, trace back inversely to the log entry that initially triggered the change, which is the real source. For the virtual source, it is necessary to analyze whether there are identifiers for proxy operations or system tasks in the log, and these identifiers can point to the non-direct user entities that triggered the change. Integrate the log information to construct a source data graph, clarify the real and virtual sources, and ensure accurate data traceability.

[0088] Through step S42, the starting point can be determined: identifying the derived source is the starting point of the document derivation process. Only by determining the source can subsequent derivation operations be accurately carried out; the source type can also be distinguished: the real source usually refers to the actually existing files or data, while the virtual source may refer to the temporary or intermediate data generated by certain operations. Distinguishing between the two helps to adopt different strategies in subsequent processing.

[0089] S43. According to the log records, apply the source path tracking algorithm to track the derivation process of the file.

[0090] The source path tracking algorithm first finds out which source the operated file belongs to, and then adds the new target path to the list of that source. If the target path already appears in the list of another source, it is considered that its ownership has changed and it will be deleted from the original source to ensure that each file path belongs to only one source. Finally, keep all source mappings up-to-date and accurate. If the corresponding log target path exists in the set of other source target paths, since the operation logs are traversed in time order, the target path in the set of other source targets needs to be removed.

[0091] Figure 2 is a schematic diagram of the single tracking process of document operation logs used in the prior art. As Figure 2 shown, each step of the derivative tree is a separate document operation log. Before the system automatically constructs this derivative tree, the system can only perform one-dimensional queries on a certain operation behavior. For example, to query the upload operation behavior, the two upload logs in Figure 2 can be retrieved. To query the operation behavior of changing the file suffix, the log of changing the file suffix in Figure 2 can be retrieved, but it is impossible to query the files that first change the suffix and then upload, nor can it be known what the source file for the upload operation is, whether it is an important code file, etc.

[0092] Through Figure 2 the information provided by the derivative tree shown, it can be regarded as capable of performing multi-dimensional queries. The log of any operation behavior can be traced back to its source file, and it can also be intuitively seen what the entire derivative trajectory of the source file of concern is and where multiple copies are retained. However, the prior art ignores the multi-dimensional tracking of documents, resulting in a huge waste of information.

[0093] Figure 3 is a flowchart of the specific implementation of document derivation used in the log-based document tracking method of the present invention. As Figure 3As shown, for example: map(source A) = "C:\Test1\1.txt|C:\Test1\2.txt", map(source B) = "C:\Test2\1.txt|C:\Test2\2.txt". When traversing a log of copying from C:\Test1\1.txt to C:\Test3\1.txt at 12:00:00 on January 5, 2025, map(source A) is updated to map(source A) = "C:\Test1\1.txt|C:\Test1\2.txt|C:\Test3\1.txt". When continuing to traverse a log of copying from C:\Test2\1.txt to C:\Test1\1.txt at 12:01:00 on January 5, 2025, map(source B) is updated to map(source B) = "C:\Test2\1.txt|C:\Test2\2.txt|C:\Test1\1.txt", and at the same time map(source A) is updated to map(source A) = "C:\Test1\2.txt|C:\Test3\1.txt".

[0094] The source path tracking algorithm is a log - based file path attribution tracking and mapping update mechanism that maintains a mapping from source identifiers to sets of file paths (using Map<String, Set <string>> representation) and a log list (List) containing the source path, target path, and timestamp <logentry>), to implement the dynamic update function. The core process is to traverse the log sequence. After extracting the source path and target path for each log entry, the operation starting point is determined by finding the source containing the source path (with the help of the findSourceContaining function). If found, the target path is added to the set of the corresponding source. Subsequently, the findSourceContainingExcluding function is used to detect whether the target path already exists in the sets of other sources. If so, it is removed from them to ensure the uniqueness of ownership. Finally, the updated mapping is returned. The overall implementation relies on set operations to complete the addition and removal of paths, with a time complexity of O(k * n * m) (k is the number of logs, n is the number of sources, and m is the average set size).

[0095] Through step S43, the uniqueness of paths can be ensured: Through the source path tracking algorithm, it can be ensured that each file path belongs to only one source, avoiding confusion and conflicts in file ownership; it can also maintain the source mapping: The algorithm dynamically updates the source list to keep all source mappings up-to-date and accurate, which is crucial for subsequent file management and operations.

[0096] S44, construct a derivative level list for each derivative source. Mark the belonging level, parent node id, and source log id of each log according to the source path and target path. After all logs are traversed, write the constructed derivative level list into the derivative table to complete document derivation.

[0097] S44, dynamically update the derivative level information.

[0098] As the file derivation process progresses, it is necessary to dynamically update the derivative level information. This includes updating the parent node id and the belonging level field to reflect the position of the current file in the derivation link.

[0099] Through step S44, the derivation relationship can be reflected: By dynamically updating the derivative level information, the derivation relationship between files can be clearly reflected, which helps to understand and manage complex document systems; it can also support file searching: Accurate derivative level information helps to quickly locate the target file and improve the efficiency of file searching.

[0100] Figure 4 is a schematic diagram of the generation of document derivation relationships used in the log-based document tracking method of the present invention. As Figure 4 As shown in the figure, in specific implementation, the IP-guard system collects terminal document operation logs daily and saves them to the database table doc_log_year-month-day, which is created daily. The system then synchronizes the logs within a specified number of days to the single database table doc_log. During synchronization, the system first uses the cache relationship algorithm in the doc_log table to find the derived source data and writes it to the derived table doc_trace. It then traverses each operation log and maps it to the corresponding source, annotating the hierarchy and parent node. After constructing a list of derived components, the data is written back to the derived table doc_trace to complete the generation of the derived relationship.

[0101] In specific implementations, document derivation can be done by first identifying the source and then finding the derived components. All logs marked with the specified derived source during the synchronization process are first written to the derived table. This data is explicitly recorded and synchronized by IP-guard at its source. Some data may not be collected by the system because the logs synchronized within the specified number of days have not yet reached the date of their source generation, or because their source had already been generated when the IP-guard system began collecting logs. Within this type of data marked as derived components, the earliest operation log is found based on the same terminal and file source path and written to the derived table as a virtual source. Unlike the real source, the virtual source also requires a secondary node to be written. The secondary node is an operation log whose file source path is the same as the virtual node file source path, and there is no operation log whose directory path is equal to the secondary node source path between the virtual node and the secondary node. Once the secondary nodes of the real source and the virtual source are written to the derived table, the operation logs can be traversed in the system to search for derived components.

[0102] It targets scenarios that arise during the derivation process, including simple file derivation, file compression into compressed package derivation, compressed package decompression into multiple files, and complex scenarios such as how files find folders, how folders find files, how folders find folders, etc.

[0103] Simple file derivation. According to the rule that the target path of the upper-level operation log file is equal to the source path of the lower-level operation log file, there should not be an operation log whose file target path is equal to the file source path of the lower-level operation log between the operation time of the upper-level operation log and the operation time of the lower-level operation log. If there is, it means that such a log does not belong to the current level of writing and should be written at a later level. For example: create a new file C:\A\B\1.txt, move the file C:\A\B\1.txt to D:\1.txt, then move D:\1.txt to C:\A\B\1.txt, and finally move C:\A\B\1.txt to E:\1.txt. For these 4 logs, when writing the lower level based on the log of creating the new file C:\A\B\1.txt as the benchmark, according to the rule that the target path of the upper-level operation log file is equal to the source path of the lower-level operation log, two logs of moving C:\A\B\1.txt to D:\1.txt and moving C:\A\B\1.txt to E:\1.txt can be found. However, these two logs should not be all written to the lower level of the source data of creating the new file C:\A\B\1.txt, because the log of moving C:\A\B\1.txt to E:\1.txt should follow the log of moving D:\1.txt to C:\A\B\1.txt, rather than being directly derived from the source file.

[0104] Derivation of compressing files into a compressed package. At this time, the operations on the compressed package need to coexist in the respective derivation tracks of all compressed files.

[0105] Decompressing the compressed package into multiple files. At this time, the decompressed files only need to correspond to the file tracks during compression.

[0106] In complex scenarios such as how to find a folder for a file, how to find a file in a folder, and how to find a folder in a folder, it can be simply understood that a folder is actually a carrier for files. Each operation on a folder (copying, moving, renaming) is actually an operation on the files inside. Each time an operation is performed on a folder, record how this operation affects the files, and then use the affected files to search for derivatives. This simplifies the problem to finding a folder for a file. Finding a folder for a file can be accomplished using the custom algorithm hasSubstr. The meaning of this algorithm is to efficiently find if array A completely contains the elements of array B and in the same order. If so, return true; otherwise, return false. For example, hasSubstr([1, 2, 3], [1, 2]) returns true, hasSubstr([1, 2, 3], [2, 1]) returns false, and hasSubstr([1, 2, 3], [1, 2, 3, 4]) returns false. Applying this algorithm to files and folders, for file 1 with path C:\A\B\1.txt, the folder operation paths it can find must be C:\A or C:\A\B. At this time, hasSubstr([’C:’, ’A’, ’B’], [’C:’, ’A’]) or hasSubstr([’C:’, ’A’, ’B’], [’C:’, ’A’, ’B’]) are both true, but it will definitely not be C:\A\B\C. At this time, hasSubstr([’C:’, ’A’, ’B’], [’C:’, ’A’, ’B’, ’C’]) is false. Using this function, the derivatives of the folder can be found. Therefore, when building the table, an array field needs to be added to the file path to facilitate the derivation of the folder. The derivation of a folder is different from that of a file. For the derivation of a file, only the data where the source file path of the next level is the same as the target file path of the previous level needs to be found (in some scenarios such as deletion, restoration, and when the new target path is empty, it is filled with the source file path). In addition, the situation of the source file path of the previous level does not need to be concerned about. However, for the derivation of a folder, in the scenario where the source file path disappears, the source file path of the previous level is not concerned about. However, when the source file does not disappear, a folder derivation also needs to be performed on the source file path. To summarize, in the scenarios of moving, renaming, and deleting, the source file folder derivation is not performed, and in other scenarios, it needs to be performed.

[0107] For example, when deriving an operation log such as copying C:\A\B\1.txt to D:\A\B\1.txt, in addition to finding the next-level file operations for the target file path D:\A\B\1.txt, it is also necessary to perform folder operations on the folder that fully contains the file path D:\A\B. In addition, since the source file C:\A\B\1.txt has not disappeared after the copy operation, it is also necessary to perform a folder derivation on the source file to find the folder operations that fully contain the C:\A\B path; when deriving an operation log such as renaming C:\A\B\1.txt to C:\A\B\2.txt, only the next-level files and folders need to be found according to the C:\A\B\2.txt file, because the source file C:\A\B\1.txt has disappeared through renaming and there is no need for a separate folder derivation. Therefore, each log record is written into the derivative trace table, and an identifier is written according to whether the source file has disappeared based on the operation type. Whether to perform a separate folder derivation on the source file is determined according to this identifier.

[0108] In some alternative implementation manners of this embodiment, to improve the efficiency of the document derivation process, the database query can also be optimized, including creating appropriate indexes, optimizing query statements, etc.

[0109] By optimizing the database query, the processing speed can be improved: by optimizing the database query performance, the processing speed of the document derivation process can be significantly improved, and the waiting time can be reduced; the resource consumption can also be reduced: optimizing the query performance helps to reduce the resource consumption of the database and improve the overall performance and stability of the system.

[0110] In some alternative implementation manners of this embodiment, the derivation process can also be monitored and logged. During the document derivation process, the derivation progress and results are monitored in real time, and relevant log information is recorded. This helps to promptly discover and solve problems and ensure the smooth progress of the derivation process.

[0111] By monitoring the derivation process in real time, potential problems and anomalies can be promptly discovered, avoiding the expansion of problems. Recording the log information of the derivation process provides a reliable historical record for subsequent analysis and troubleshooting.

[0112] Step S5, store the derivative information of the document.

[0113] In this embodiment, step S5 of storing the derivative information of the document may specifically include the steps of: S51, set the data table structure according to the type and function of the derivative information. The data table structure includes metadata fields and version history fields.

[0114] A reasonable storage structure can ensure the effective storage and efficient access of information. Select a suitable database type for storing derivative information, such as a relational database or a document database. Relational databases are suitable for storing structured information, while document databases are more suitable for storing semi-structured or unstructured information. Ensure that the database can efficiently store and access derivative information, improving the reliability and performance of information storage.

[0115] Design the corresponding data table structure according to the type and function of the derivative information. For example, design a table for metadata that includes fields such as document name, author, creation time, etc.; design a table for version history that includes fields such as version number, modification time, modified content, etc.

[0116] Design indexes for the data tables to improve the retrieval speed of information. Indexes can be designed based on the fields of the derivative information, such as indexing based on the document name or version number. Through index design, the required derivative information can be quickly located, improving the efficiency of information access.

[0117] S52, store metadata through metadata fields. Metadata is information used to describe the attributes and characteristics of a document.

[0118] Metadata is information that describes the attributes and characteristics of a document and plays an important role in document management and retrieval.

[0119] Metadata collection: Extract metadata from the document, including document name, author, creation time, modification time, size, type, etc. Ensure the accuracy and integrity of the metadata, providing a reliable basis for subsequent information storage and retrieval.

[0120] Metadata cleaning: Clean the collected metadata to remove duplicate, invalid, or redundant information. Improve the quality of the metadata, reduce waste of storage space, and help improve the accuracy of information retrieval.

[0121] Metadata storage: Store the cleaned metadata in the database to ensure the reliability and security of the metadata. Through database storage, the metadata can be conveniently accessed and managed, supporting functions such as document retrieval, classification, and statistics.

[0122] S53, store the version history information of the document through the version history field.

[0123] Version history is information that records the modification process of a document and plays an important role in document version control and data recovery. Storing the version history is another important step in storing derivative information.

[0124] Version record: After each modification of the document, record information such as the modified content, time, and modifier. Ensure the integrity and accuracy of the version history, providing a reliable basis for subsequent version control and data recovery.

[0125] Version storage: Store the recorded version information in the database and associate it with the original document. Through database storage, it is convenient to access and manage the version history, supporting functions such as version backtracking and data recovery of the document.

[0126] Version management: Manage the stored version history, including operations such as version comparison, merging, and deletion. Through version management, it is possible to efficiently handle version conflicts and redundant versions, improving the efficiency and accuracy of version control.

[0127] S54, Set permissions and access control for the document.

[0128] Permissions and access control are important means to protect the security of the document. By setting permissions and access control, it is possible to restrict users' access to and operations on the document, ensuring the security and integrity of the document.

[0129] Authenticate users to ensure that only legitimate users can access the document. Through user authentication, it is possible to prevent unauthorized users from accessing the document, improving the security of the document.

[0130] Set corresponding permissions according to the roles and needs of users, such as reading, editing, deleting, etc. Through permission setting, it is possible to restrict users' operating permissions on the document, ensuring that the document will not be illegally modified or deleted.

[0131] Control and review users' access requests according to the permission settings. Through access control, it is possible to further ensure the security of the document, preventing unauthorized access and operations.

[0132] Step S6, Perform derivative analysis on the document according to the derivative information.

[0133] In this embodiment, step S6, performing derivative analysis on the document according to the derivative information can specifically include the steps: S61, Query the source log according to the derivative information.

[0134] The source log refers to the operation record of the original document that triggers a series of derivative operations. By querying these logs, it is possible to determine the initial source of the document and the starting point of subsequent derivative operations.

[0135] Through step S61, it is possible to locate the starting point: clarify the starting position of the document derivative chain, providing a reference for subsequent analysis; it is possible to exclude interference: avoid introducing irrelevant or secondary derivative paths in subsequent analysis; it is possible to improve efficiency: starting from the source, it is possible to more effectively track and analyze the derivative situation of the document.

[0136] S62, Query all derivative operation trees of all derivative source files through the identification recursive algorithm.

[0137] A recursive algorithm is an algorithm that repeatedly applies the same rule in a data structure (such as a tree or a graph) until a certain condition is met. In document derivation analysis, the recursive algorithm is used to traverse the document derivation relationship graph, starting from the source log and tracing each derived document and its operations level by level downwards.

[0138] Through step S62, it can achieve comprehensive coverage: ensuring that all derivation operations related to the source file are included in the analysis scope; clear derivation structure: presenting the derivation relationship in a tree structure for easy understanding and analysis; and can be dynamically updated: as new operations are added, the derivation operation tree can be updated in real time to maintain the timeliness of the analysis.

[0139] S63. Query and display the derivation link of the document.

[0140] Based on the recursive query, through the association method where the id of the upper-level operation log is equal to the parent node id of the lower-level operation log, each derivation link can be queried. A derivation link refers to a series of operation sequences from the source file to all its derived files. By visually displaying these links, it can be intuitively seen how the document flows and changes within the system.

[0141] Through step S63, the document derivation relationship can be presented in a graphical way for easy understanding and analysis; details can be captured, and the specific information of each operation, such as operation type, time, operator, etc., can be clearly displayed; problem positioning can be carried out: it helps to quickly discover potential sensitive operations or abnormal behaviors.

[0142] After the document derivation is completed, since the source, level, and parent node id of all document derivation logs have been solidified in the database, all source files can be retrieved at once by directly querying the source id, and then through the identification recursive algorithm query, all derivation operation trees of all derived source files can be retrieved. By querying each derivation link where the id of the upper-level operation log is equal to the parent node id of the lower-level operation log, it can be intuitively seen whether operations such as external transmission via WeChat or copying to a USB drive have been preceded by operations such as file name modification or compression, and how many copies of a sensitive file have been generated on a terminal, and it can achieve the effect of querying billions of data in seconds.

[0143] Implementing this embodiment has the following beneficial effects: (1) By obtaining the document operation logs containing detailed field information, it can ensure that every change to the document is recorded in detail, which helps to trace and verify the historical state of the document later and improves the transparency of document management; (2)Setting easily derivable identifiers for operation logs and establishing fields for easy derivative calculation simplifies the processing of log data. The establishment of such identifiers and fields makes the log data more structured, facilitating subsequent data analysis and processing; (3)Synchronizing the operation logs with identifiers and fields established ensures data timeliness and consistency, helps achieve seamless docking of log data in multi-node or multi-system scenarios, and improves the overall system's collaboration efficiency; (4)Deriving documents based on the synchronized operation logs can automatically generate multiple versions or variants of documents, meeting diverse document requirements, greatly enhancing the automation level of document generation, and reducing labor costs; (5)Storing the derivative information of documents and conducting derivative analysis helps to deeply explore the associations and differences between documents, providing a scientific basis for document management. It not only improves the intelligent level of document management but also provides strong evidence for decision-making support; (6)It can automatically complete the synchronization and cleaning of terminal operation logs, generation of operation derivative trees, and calculation of derivative levels. Based on the generated operation log derivative trees, multi-dimensional log query and analysis can be realized on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous single-operation-log-based query, with a wider analysis scope, and can provide more information for monitoring and analyzing terminal document operation behaviors.

[0144] The present invention can be used in numerous general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In distributed computing environments, program modules can be located in local and remote computer storage media including storage devices.

[0145] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM), etc.

[0146] It should be understood that although the steps in the flowchart of the accompanying drawings are displayed sequentially as indicated by the arrows, these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless otherwise clearly stated in this article, the execution of these steps has no strict order limit, and they can be executed in other orders. Moreover, at least some of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed alternately or alternately with at least some of the sub-steps or stages of other steps.

[0147] Embodiment 2 Further reference Figure 5 to Figure 1 As an implementation of the method shown above, the present invention provides an embodiment of a log-based document tracking device. This device embodiment corresponds to the method embodiment shown in Figure 1 and can be specifically applied to various electronic devices.

[0148] As Figure 5 shown, the log-based document tracking device 70 in this embodiment includes: an acquisition module 71, a setting module 72, a synchronization module 73, a derivation module 74, a storage module 75, and an analysis module 76. Among them: The acquisition module 71 is used to acquire document operation logs, and the operation logs include field information; The setting module 72 is used to set an easily derivable identifier for the operation log according to the field information and establish fields for easy derivative calculation; The synchronization module 73 is used to synchronize the operation log with an easily derivable identifier set and fields for easy derivative calculation established; The derivation module 74 is used to perform document derivation according to the synchronized operation log; The storage module 75 is used to store the derivative information of the document; The analysis module 76 is used to perform derivative analysis on the document according to the derivative information.

[0149] Implementing this embodiment has the beneficial effects as follows: It can automatically complete the synchronous cleaning of terminal operation logs, the generation of operation derivative trees, and the calculation of derivative levels. Based on the generated operation log derivative trees, multi-dimensional log queries and analyses can be realized on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous one that could only query based on a single operation log, and has a wider analysis scope, providing more information for the monitoring and analysis of terminal document operation behaviors.

[0150] Embodiment Three To solve the above technical problems, the embodiment of the present invention also provides a computer device. Specifically, please refer to Figure 6 , Figure 6 which is the basic structural block diagram of the computer device in this embodiment.

[0151] The above computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are communicatively connected to each other through a system bus. It should be noted that only the computer device 8 with components such as the memory 81, the processor 82, and the network interface 83 is shown in the figure. However, it should be understood that it is not required to implement all the shown components, and more or fewer components can be alternatively implemented. Among them, those skilled in the art of the present technology can understand that a computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0152] The above computer device can be a desktop computer, a notebook, a palm computer, a cloud server, and other computing devices. The above computer device can interact with users through methods such as keyboards, mice, remote controls, touch pads, or voice control devices.

[0153] The above-mentioned memory 81 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the above-mentioned memory 81 may be an internal storage unit of the above-mentioned computer device 8, such as the hard disk or memory of the computer device 8. In other embodiments, the above-mentioned memory 81 may also be an external storage device of the above-mentioned computer device 8, such as a plug-in hard disk equipped on the computer device 8, a Smart Media Card (SMC), a Secure Digital (SD) card, a FlashCard, etc. Of course, the above-mentioned memory 81 may also include both the internal storage unit and the external storage device of the above-mentioned computer device 8. In this embodiment, the above-mentioned memory 81 is generally used to store the operating system and various application software installed on the above-mentioned computer device 8, such as computer-readable instructions of the document tracking method based on logs. In addition, the above-mentioned memory 81 can also be used to temporarily store various data that have been output or will be output.

[0154] In some embodiments, the above-mentioned processor 82 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 82 is generally used to control the overall operation of the above-mentioned computer device 8. In this embodiment, the above-mentioned processor 82 is used to run the computer-readable instructions stored in the above-mentioned memory 81 or process data, such as running the computer-readable instructions of the above-mentioned document tracking method based on logs.

[0155] The above-mentioned network interface 83 may include a wireless network interface or a wired network interface, and the network interface 83 is generally used to establish a communication connection between the above-mentioned computer device 8 and other electronic devices.

[0156] Implementing this embodiment has the beneficial effect that it can automatically complete the synchronous cleaning of terminal operation logs, the generation of operation derivative trees, and the calculation of derivative levels. Based on the generated operation log derivative tree, multi-dimensional log query and analysis can be realized on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous one that can only query based on a single operation log, and the analysis scope is wider, which can provide more information for the monitoring and analysis of terminal document operation behaviors. Embodiment Four The present invention also provides another implementation manner, that is, to provide a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor, so that the at least one processor executes the steps of the log-based document tracking method as described above.

[0157] Implementing this embodiment has the beneficial effects that it can automatically complete the synchronous cleaning of terminal operation logs, the generation of operation derivative trees, and the calculation of derivative levels. Based on the generated operation log derivative trees, multi-dimensional log queries and analyses can be realized on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous one that can only query based on a single operation log, and the analysis scope is wider, which can provide more information for the monitoring and analysis of terminal document operation behaviors. Through the description of the above implementation manners, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation manner. Based on such an understanding, the technical solution of the present invention, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0158] Obviously, the embodiments described above are only a part of the embodiments of the present invention, rather than all the embodiments. The accompanying drawings show the preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosed content of the present invention more thorough and comprehensive. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions recorded in the foregoing specific implementation manners, or perform equivalent replacements on some of the technical features. Any equivalent structures directly or indirectly using the content of the specification and drawings of the present invention in other related technical fields are equally within the scope of the patent protection of the present invention.< / logentry> < / string>

Claims

1. A log-based document tracking method, characterized in that, Including the following steps: Obtain the document operation log, where the operation log includes field information; According to the field information, set an easily derivable identifier for the operation log and establish fields for easy derivative calculation; Synchronize the operation log with the easily derivable identifier set and the fields for easy derivative calculation established; Perform document derivation according to the synchronized operation log; Store the derived information of the document; Perform derivative analysis on the document according to the derived information.

2. The log-based document tracking method according to claim 1, wherein The step of obtaining the document operation log, where the operation log includes field information specifically includes: Obtain the collection requirements and select a log collection tool or collection program; Configure the collection parameters and rules, where the collection parameters include the field information included in the operation log; Deploy the collection tool or collection program to the terminal device; Monitor the log collection process and perform exception handling.

3. The log-based document tracking method according to claim 1, wherein The step of setting an easily derivable identifier for the operation log and establishing fields for easy derivative calculation according to the field information specifically includes: Determine the identifier type to be set according to the field information; Set and apply the identifier rules according to the identifier type; Set an easily derivable identifier for the operation log according to the identifier rules; Establish fields for easy derivative calculation.

4. The log-based document tracking method according to claim 1, wherein The step of synchronizing the operation log with the easily derivable identifier set and the fields for easy derivative calculation established specifically includes: Receive the operation log and cache the operation log; Read the cached log content and parse it according to the predefined log format; Perform data synchronization operations according to the parsed log information.

5. The log-based document tracking method according to claim 1, wherein The step of performing document derivation according to the synchronized operation log specifically includes: Create a derived information table and create a separate data table in the database to record the derived information of each document; Identify the derived source data and find the derived source data in the document operation log that has been synchronized in the database; Apply the source path tracking algorithm to track the derivation process of the file according to the log records; Construct a derived hierarchy list for each derived source. According to the source path and target path, mark the belonging level, parent node id, and source log id of each log. After all logs are traversed, write the constructed derived hierarchy list into the derived table to complete document derivation; Dynamically update the derived hierarchy information.

6. The log-based document tracking method according to claim 1, wherein The step of storing the derived information of the document specifically includes: Set the data table structure according to the type and function of the derived information, where the data table structure includes metadata fields and version history fields; Store metadata through the metadata fields, where the metadata is information used to describe the attributes and characteristics of the document; Store the version history information of the document through the version history fields; Set permissions and access control for the document.

7. The log-based document tracking method according to any one of claims 1 to 6, characterized in that, The step of performing derivative analysis on the document according to the derived information specifically includes: Query the source log according to the derived information; Query all the derivative operation trees of all the derived source files through the identifier recursive algorithm; Query and display the derivation link of the document.

8. A log-based document tracking device, characterized in that, Including: An acquisition module for acquiring the document operation log, where the operation log includes field information; A setting module for setting an easily derivable identifier for the operation log according to the field information and establishing a field for easily derivable calculation; A synchronization module for synchronizing the operation log with the easily derivable identifier set and the field for easily derivable calculation established; A derivation module for performing document derivation according to the synchronized operation log; A storage module for storing the derived information of the document; An analysis module for performing derivative analysis on the document according to the derived information.

9. A computer device, characterized in that, It includes a memory and a processor. Computer-readable instructions are stored in the memory. When the processor executes the computer-readable instructions, the steps of the log-based document tracking method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that, Computer-readable instructions are stored on the computer-readable storage medium. When the computer-readable instructions are executed by the processor, the steps of the log-based document tracking method according to any one of claims 1 to 7 are implemented.

Images