Log-based document tracking method and device, computer device, and storage medium

Abstract

The present application belongs to the field of data processing, and relates to a log-based document tracking method and device, a computer device and a storage medium. The method comprises: obtaining a document operation log, wherein the operation log comprises field information; setting an easy-to-derive identifier on the operation log according to the field information, and establishing an easy-to-derive calculation field; synchronizing the operation log with the easy-to-derive identifier and the easy-to-derive calculation field; performing document derivation according to the synchronized operation log; storing the derivation information of the document; and performing derivation analysis on the document according to the derivation information. The method can automatically complete the synchronization cleaning of the terminal operation log, the generation of the operation derivation tree and the derivation level calculation. Based on the generated operation log derivation tree, multi-dimensional log query and analysis on the same derivation tree or the same derivation link can be realized. The query is more intuitive, the analysis range is wider, and more information can be provided for terminal document operation behavior monitoring and analysis.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a log-based document tracking method and device, a computer device and a storage medium. BACKGROUND

[0002] With the comprehensive digitization of various industries, the scale of data is growing exponentially, and data security problems are increasingly prominent. From the leakage events occurring within the enterprise, internal threats generally come from two aspects: first, employees inadvertently upload important internal files to the network disk and code to the public network during work, causing leaks; second, employees are driven by data interests and take risks, stealing data. Some employees who plan to leave the company take important secrets or maliciously destroy data when they leave. The existing document tracking mode can only be based on a single operation log query, which is not conducive to tracking the origin and development of the document, and the security of the data is greatly threatened. SUMMARY

[0003] In order to solve the above technical problems, the present application provides a log-based document tracking method, which adopts the technical scheme as follows, comprising:

[0004] Obtain the document operation log, the operation log including field information;

[0005] According to the field information, set an easy-to-derive identifier for the operation log, and establish an easy-to-derive calculation field;

[0006] Synchronize the operation log that has been set with an easy-to-derive identifier and established with an easy-to-derive calculation field;

[0007] According to the synchronized operation log, perform document derivation;

[0008] Store the derivation information of the document;

[0009] According to the derivation information, perform derivation analysis on the document.

[0010] Preferably, the step of obtaining the document operation log, the operation log including field information, specifically comprises:

[0011] Obtain the collection requirements, select a log collection tool or collection program;

[0012] Configure collection parameters and rules, the collection parameters including the field information included in the operation log;

[0013] Deploy the collection tool or collection program to the terminal device;

[0014] Monitor the log collection process and exception handling.

[0015] Preferably, the step of setting the traceable identification and establishing the field for traceable calculation according to the field information specifically comprises:

[0016] According to the field information, determining the type of identification to be set;

[0017] According to the type of identification, setting and applying identification rules;

[0018] According to the identification rules, setting the traceable identification for the operation log;

[0019] Establishing the field for traceable calculation.

[0020] Preferably, the step of synchronizing the operation log with the set traceable identification and the established field for traceable calculation specifically comprises:

[0021] Receiving the operation log and buffering the operation log;

[0022] Reading the buffered log content and parsing according to the predefined log format;

[0023] According to the parsed log information, performing data synchronization operation.

[0024] Preferably, the step of performing document derivation according to the synchronized operation log specifically comprises:

[0025] Creating a derivation information table, creating a separate data table in the database to record the derivation information of each document;

[0026] Identifying the derivation source data, finding the derivation source data in the synchronized document operation log of the database;

[0027] According to the log record, applying the source path tracking algorithm to track the derivation process of the file;

[0028] Constructing a derivation level list for each derivation source, according to the source path and target path, marking the level, parent node id, and source log id of each log, after all logs are traversed, writing the constructed derivation level list into the derivation table, completing the document derivation;

[0029] Dynamically updating the derivation level information.

[0030] Preferably, the step of storing the derivation information of the document specifically comprises:

[0031] According to the type and function of the derivation information, setting the data table structure, the data table structure including metadata field and version history field;

[0032] Metadata is stored in the metadata field, which is information used to describe document attributes and features.

[0033] Version history information of the document is stored in the version history field.

[0034] Permissions and access control are set for the document.

[0035] Preferably, the step of performing derivative analysis on the document according to the derivative information specifically comprises:

[0036] The source log is queried according to the derivative information.

[0037] All derivative operation trees of all derivative source files are queried out through an identification recursive algorithm.

[0038] Derivative links of the document are queried and displayed.

[0039] To solve the above technical problems, the application further provides a log-based document tracking device, which adopts the technical scheme as follows, comprising:

[0040] An acquisition module is configured to acquire the document operation log, wherein the operation log comprises field information.

[0041] A setting module is configured to set an easy-to-derive identifier for the operation log and establish an easy-to-derive calculation field according to the field information.

[0042] A synchronization module is configured to synchronize the operation log after the easy-to-derive identifier is set and the easy-to-derive calculation field is established.

[0043] A derivative module is configured to perform document derivation according to the synchronized operation log.

[0044] A storage module is configured to store derivative information of the document.

[0045] An analysis module is configured to perform derivative analysis on the document according to the derivative information.

[0046] To solve the above technical problems, the application further provides a computer device, which adopts the technical scheme as follows, comprising a memory and a processor, wherein the memory stores computer readable instructions, and the processor executes the computer readable instructions to realize the steps of the log-based document tracking method.

[0047] To solve the above technical problems, the application also provides a computer readable storage medium, which adopts the technical scheme as follows, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by a processor to realize the steps of the log-based document tracking method.

[0048] Compared with the prior art, the application has the following beneficial effects:

[0049] (1) By obtaining a document operation log containing detailed field information, each change of the document can be ensured to be recorded in detail, which is helpful for subsequent tracing and checking of the document history state and improves the transparency of document management;

[0050] (2) The operation log is provided with an easily derived identifier and an easily derived field is established, so that the processing process of the log data is simplified, and the establishment of the identifier and the field makes the log data more structured, facilitating subsequent data analysis and processing;

[0051] (3) The operation log established through the identifier and the field is synchronized, ensuring the real-time and consistency of the data, which is helpful for seamless connection of the log data in multiple nodes or multiple systems and improves the collaborative efficiency of the overall system;

[0052] (4) Document derivation is performed according to the synchronized operation log, which can automatically generate multiple versions or variants of the document, meet diversified document requirements, greatly improve the automation degree of document generation, and reduce the labor cost;

[0053] (5) The derived information of the document is stored and analyzed, which is helpful for in-depth mining of the association and difference between documents, provides a scientific basis for document management, improves the intelligent level of document management, and provides a strong basis for decision support;

[0054] (6) The synchronization cleaning of the terminal operation log, the operation derivation tree generation and the derivation level calculation can be automatically completed, based on the generated operation log derivation tree, multi-dimensional log query and analysis on the same derivation tree or the same derivation link can be realized, this query mode is more intuitive than the previous single operation log-based query, the analysis range is higher, and more information can be provided for terminal document operation behavior monitoring and analysis. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the schemes in the application, the drawings needed in the description of the embodiments of the application will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0056] Figure 1 is a flow chart of one embodiment of the log-based document tracking method of the present application;

[0057] Figure 2 is a single tracking flowchart of a document operation log used in the prior art;

[0058] Figure 3 is a flow chart of a document derivation embodiment used in the log-based document tracking method of the present application;

[0059] Figure 4 is a document derivation relationship generation diagram used in the log-based document tracking method of the present application;

[0060] Figure 5 is a structural diagram of one embodiment of the log-based document tracking device of the present application;

[0061] Figure 6 is a structural diagram of one embodiment of the computer device of the present application. DETAILED DESCRIPTION

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application; the description and claims of this application as well as the above abstract are intended to cover all alternatives, modifications, equivalents and equivalents thereof falling within the scope of the application. The terms "comprising", "having", "including" and "containing" used in the specification are intended to cover all the embodiments of the application, and are not intended to exclude other elements or steps. The terms "first", "second" and the like used in the description and claims of this application are used to distinguish different objects, and are not intended to describe a particular sequential order.

[0063] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that any of the embodiments described herein can be combined with any of the other embodiments.

[0064] In order to make the technical personnel in the art better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings.

[0065] It should be noted that the log-based document tracking method provided by the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the log-based document tracking device is generally arranged in the server / terminal device.

[0066] It should be understood that the number of terminal devices, networks and servers is only illustrative. Any number of terminal devices, networks and servers can be provided as needed.

[0067] Embodiment one

[0068] Reference is made to Figure 1 , a flow chart of one embodiment of the log-based document tracking method of the present application is shown. The log-based document tracking method includes the following steps:

[0069] Step S1, obtaining a document operation log, the operation log including field information.

[0070] In this embodiment, the electronic device (e.g. server / terminal device) on which the log-based document tracking method runs can receive a log-based document tracking request through wired or wireless connection. It should be noted that the wireless connection can include, but is not limited to, 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAXX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection methods.

[0071] The operation log is an important tool for recording various operation events in a system or application, and contains rich information. According to actual needs, the operation log content includes multiple field information. The field information includes, but is not limited to:

[0072] Log ID: uniquely identifies each log record, facilitating tracking and querying;

[0073] Terminal ID: identifies the terminal device performing the operation, which helps to locate the problem device or user;

[0074] Document name: the name of the document being operated, which is one of the key information in the log;

[0075] Operation type: including creation, upload, copy, move, delete, etc. operation, reflecting the specific behavior of the user on the document;

[0076] Document operation source path: the storage location before the document operation, which helps to understand the source of the document;

[0077] Document operation source device: the storage device type before the document operation, such as local disk, network disk, removable disk, etc.;

[0078] Document operation target path: the storage location after the document operation, reflecting the final destination of the document;

[0079] Document operation target device: the storage device type after the document operation, which is also important;

[0080] Document category: Differentiate files or folders, which helps to make more detailed classification of operations;

[0081] Operation time: Record the timestamp when the operation occurs, which facilitates time series analysis;

[0082] Operation terminal: Terminal device information such as operating system, IP address, etc. that performs the operation, which helps security audit.

[0083] In this embodiment, step S1, the document operation log is obtained, and the operation log includes field information, which can specifically include the following steps:

[0084] S11, acquire the collection requirement, and select a log collection tool or collection program.

[0085] The collection requirement can be obtained by a configuration file to obtain the document type, operation type, and log storage period, etc. that needs to be collected.

[0086] According to the operating system type (such as Windows, Linux, macOS, etc.) of the terminal device, select the appropriate log collection tool or collection program. The tool or program should be able to monitor and capture specified document operation events in real time.

[0087] Through step S11, real-time collection of logs can be realized, ensuring the integrity and accuracy of log data. At the same time, the selection of tools or programs should consider the compatibility and stability of the system.

[0088] S12, configure collection parameters and rules, and the collection parameters include the field information included in the operation log.

[0089] According to the collection requirement, configure the parameters and rules of the collection tool or program, such as log format, collection frequency, storage path, etc. Ensure that the collected log data conforms to the predetermined format and requirements, which facilitates subsequent processing and analysis.

[0090] S13, deploy the collection tool or collection program to the terminal device.

[0091] Deploy the configured collection tool or program to the specified terminal device, and perform necessary tests to ensure its normal operation.

[0092] In practice, the log collection tool of the embodiment adopts an IP-guard system. The IP-guard system, i.e., an enterprise information supervision system, is a comprehensive intranet security management and data protection software. It uses the system management idea, integrates operation auditing, permission control, document encryption and other technical means, and aims to comprehensively solve the three intranet security problems of information security, application efficiency and system management. The IP-guard system provides comprehensive data security protection for enterprises with its powerful data classification and encryption function, strict access control and detailed audit and compliance function. The system supports multi-terminal and multi-level management. The IP-guard system collects document operation logs from terminal devices every day, and the log content includes log id, terminal id, document name, operation type (such as creation, upload, copy, move, delete, etc.), document operation source path, document operation source device (such as local disk, network disk, removable disk), document operation target path, document operation target device, document category (file, folder), operation time, operation terminal, etc.

[0093] Through step S13, real-time collection and transmission of log data can be realized, providing basic data for subsequent analysis and processing. It should be noted that attention should be paid to the impact on the performance of terminal devices during deployment to ensure the normal operation of the system.

[0094] S14, monitoring log collection process and exception handling.

[0095] Real-time monitoring of the log collection process can timely discover and handle collection exceptions, such as interruption, data loss and other problems. At the same time, an exception handling mechanism is established to ensure the continuity and stability of the collection work.

[0096] Through step S14, the integrity and accuracy of log data can be guaranteed, and data loss or errors caused by collection exceptions can be avoided. The establishment of the exception handling mechanism helps to improve the reliability and stability of the system.

[0097] Step S2, according to the field information, setting an easily derivable identifier for the operation log, and establishing an easily derivable calculation field.

[0098] In the embodiment, step S2, according to the field information, setting an easily derivable identifier for the operation log, and establishing an easily derivable calculation field can specifically include the following steps:

[0099] S21, according to the field information, determining the type of identifier to be set.

[0100] These identifications are used for classification, filtering and aggregation of operation logs, etc. For example, identification types include, but are not limited to, operation type identification: set according to operation category, used to distinguish different types of operations; disk type identification: set according to source disk type and target disk type, used to distinguish operations of different storage devices; time identification: set according to operation time, used for time dimension classification and filtering of operation logs, etc.

[0101] S22, set and apply identification rules according to identification types.

[0102] It should be noted that these identification rules should ensure the uniqueness, readability and ease of use of the identification. For example, operation type identification rule: the abbreviation or code of the operation category can be used as the identification; disk type identification rule: the English abbreviation or numerical code of the disk type can be used as the identification; time identification rule: the formatted string of the timestamp can be used as the identification, such as "YYYY-MM-DD HH:MM:SS".

[0103] S23, set easy-to-derive identifications for operation logs according to identification rules.

[0104] After setting the identification rules, set easy-to-derive identifications for operation logs.

[0105] It should be noted that the standard of easy-to-derive can be set according to actual needs, which is not limited herein. In specific implementation, according to the identification rules, the operation category, source disk type and target disk type fields can be marked with easy-to-derive identifications. The derived identification includes derivation source and derivation composition. In specific implementation, the data marked with the derivation source identification can be: local disk creation, download to local disk, non-local disk copy, move, compression, decompression to local disk. The data marked with the derivation composition identification can be all operations of the document operation source device for the local disk. In addition, the source path array and the target path array can also be calculated according to the operation log source path and the target path, for example, the IP-guard system collects an operation log of copying C:\A\B\1.txt to D:\E\1.txt. First, the source path C:\A\B and the target path D:\E of the file are taken out, and then the source path array [‘C:’, ‘A’, ‘B’] and the target path array [‘D:’, ‘E’] are cut out according to the path symbol. The advantage of increasing the source path array and the target path array is that it is convenient to find the derivation of the folder.

[0106] In addition, logs that are not accurate can be removed, merged, and supplemented to become normal logs that can be derived. For example, when opening a compressed package using WinRAR compression software, instead of directly decompressing, the files in the compressed package are dragged to a specified directory. At this time, due to the running mechanism of WinRAR compression software, IP-guard terminal will not collect a standard log from the source path of the compressed package to the target path of the decompression directory, but will collect two logs, one for decompression to the system temporary directory, and the other for the creation of the decompression directory. At this time, it is necessary to combine the two logs into a standard derived log through operation time and file name string,

[0107] S24, establish fields for easy derivation calculation.

[0108] According to the field information of the operation log and the business requirements, the calculation fields that need to be established can be determined. These fields are used for more in-depth analysis and statistics of the operation log. For example, the calculation fields include but are not limited to:

[0109] Operation success rate, calculate the proportion of successful operations in a specified time period.

[0110] Average operation time, calculate the average time consumption of operations in a specified time period.

[0111] Disk type operation distribution, statistics of the number and proportion of operations on different disk types.

[0112] Error code distribution, statistics of the number and proportion of different error codes.

[0113] After determining the calculation field requirements, specific calculation field formulas need to be designed. These formulas should accurately reflect the data in the operation log and business requirements. For example:

[0114] Operation success rate formula: Operation success rate = Successful operation times / Total operation times × 100%.

[0115] Average operation time formula: Average operation time = Total operation time / Total operation times.

[0116] Disk type operation distribution formula: Statistics of the number of operations on each disk type, and calculation of the proportion of the total number of operations.

[0117] Error code distribution formula: Statistics of the number of occurrences of each error code, and calculation of the proportion of the total number of errors.

[0118] After designing the calculation field formulas, these fields need to be implemented. This involves parsing, data processing, and calculation of the operation log. The method of implementing the calculation field can vary depending on the system or application, and can include the following steps:

[0119] Data extraction: Extract the required data fields from the operation log.

[0120] Data processing: Clean, transform, and format the extracted data to ensure it meets the requirements of the calculation field formula.

[0121] Calculation implementation: Perform calculations based on the calculation field formula and generate the calculation results.

[0122] Result storage: Store the calculation results in the designated location or database for subsequent analysis and use.

[0123] In implementation, the operation category, source disk type, and target disk type fields are marked with easy-to-derive identifiers, and the operation category, source disk type, and target disk type fields are established for easy-to-derive calculation.

[0124] Step S3, synchronize the operation log with the easy-to-derive identifier and the easy-to-derive calculation field.

[0125] After receiving the log file on the target host, log parsing and data synchronization operations are required.

[0126] In this embodiment, step S3, synchronizing the operation log with the easy-to-derive identifier and the easy-to-derive calculation field, can specifically include the following steps:

[0127] S31, receive the operation log and cache the operation log.

[0128] A dedicated log receiving area can be set up on the target host to receive log files or records from the source host. The received logs can be cached in local memory buffers or temporary files, waiting for subsequent parsing and processing. This can avoid the problem of log loss due to the processing speed not keeping up with the generation speed of the logs.

[0129] S32, read the cached log content and parse it according to the predefined log format.

[0130] Read the cached log content and parse it according to the predefined log format. The parsing process includes extracting operation type, operation time, operation object, and operation data, etc. These information will be used for subsequent data synchronization operations.

[0131] To ensure the accuracy and efficiency of log parsing, regular expressions, XML parsers, or JSON parsers can be used to match and extract log content. At the same time, the parsed log information can be formatted and checked to ensure the integrity and accuracy of the information.

[0132] S33: Execute data synchronization operation according to the parsed log information.

[0133] Based on the parsed log information, the target host will perform corresponding data synchronization operations. These operations may include inserting new data, updating existing data, or deleting no longer needed data.

[0134] Insert operation: When the parsed log information indicates that new data needs to be inserted into the target database, the target host will perform the insert operation and write the new data into the specified database table.

[0135] Update operation: When the parsed log information indicates that existing data in the target database needs to be updated, the target host will perform an update operation to find the corresponding record and update the data.

[0136] Delete operation: When the parsed log information indicates that certain data in the target database needs to be deleted, the target host will perform the delete operation and delete the corresponding data records.

[0137] In order to ensure the accuracy and efficiency of data synchronization, a transaction processing mechanism can be used to ensure data consistency; at the same time, technologies such as batch processing can also be used to improve the efficiency of data synchronization.

[0138] During implementation, the first full synchronization will be performed from the IP-guard system, synchronizing document operation logs within a specified number of days. After the full synchronization, incremental synchronization will be performed on a daily basis. Due to the large number of endpoints, the same IP-guard system may collect logs from thousands or even tens of thousands of endpoints. This large volume of logs within a specified number of days can result in a lengthy synchronization process. This allows for efficient and stable synchronization of logs within a specified number of days, customized to meet specific needs.

[0139] During implementation, the designated days for synchronization can be dynamically split, with dynamic thread tasks initiated to alternately complete log synchronization for different days. For example, logs from March 1st to March 31st can be synchronized in two groups using a trade-off algorithm based on device performance. Task A completes the synchronization of odd-numbered days from March 1st to March 31st, while Task B completes the synchronization of even-numbered days from March 1st to March 31st. This splitting approach offers the advantage of cutting off the logs from the 16th day in the middle, as it avoids situations where the logs in the first or second half of a month are significantly less than those in the other half due to long holidays like May Day, National Day, and Spring Festival.

[0140] The balancing algorithm automatically divides the data into several average sizes according to the size of the data and the performance of the machine, and then processes the data in multiple tasks. This intelligent task greatly shortens the time of full synchronization through the dynamic thread task combined with the balancing algorithm. In addition, the log analysis system monitors the memory usage of the source system database, and intelligently adjusts the amount of logs read from the source system database according to the memory usage, avoiding high memory usage that causes the source system database to crash and ensuring the stability of the service.

[0141] In some optional implementations of the present embodiment, considering that various errors may occur during log parsing and data synchronization, such as log format errors, data operation failures, etc. In order to deal with these errors, the target host can establish corresponding error handling and recovery mechanisms.

[0142] Log format error handling: When encountering a log format error, the log record can be skipped and error information can be recorded, and the next log can be parsed. In this way, the entire log synchronization process can be avoided due to individual log format errors.

[0143] Data operation failure handling: When the data operation fails, the operation can be attempted to be re-executed or the corresponding solution can be taken according to the error type. For example, when encountering a database deadlock error, the operation can be attempted after waiting for a period of time; when encountering a database connection failure error, the database connection configuration can be checked and the database can be reconnected.

[0144] At the same time, in order to ensure the reliability of data synchronization, a log backup and recovery mechanism can also be used. During log synchronization, log files can be backed up to a designated storage location at regular intervals; when data synchronization fails, the log files can be recovered from the backup and the synchronization operation can be re-performed.

[0145] Step S4, according to the synchronized operation log, document derivation is performed.

[0146] In the present embodiment, step S4, according to the synchronized operation log, document derivation can specifically include the following steps:

[0147] S41, a derivation information table is created, and a separate data table is created in the database to record the derivation information of each document.

[0148] The derivation table can include fields: operation log detailed information, parent node id, belonging level, source log id, etc. The source log id represents that the file is derived from the same source file.

[0149] The SQL statement can be executed in the database to create the derived table. Whenever a document is changed or new derived information is generated, the relevant information is captured through the logging mechanism and inserted into the derived information table. This method can systematically track and record the derived information of the document, facilitating subsequent queries and analysis, and improving the efficiency and accuracy of document management.

[0150] Through step S41, the derived information can be recorded. The derived table is used to store key information during the derivation process of each document, including the detailed content of the operation log, which helps subsequent tracing and auditing.

[0151] Through step S41, the derivation hierarchy can also be managed: through the parent node id and the corresponding hierarchy field, the positions of different file operations on their respective derivation chains can be clearly represented, which is crucial for understanding and managing complex derivation relationships.

[0152] Through step S41, the source can also be identified: the source log id is used to identify the source of the same type of file derivation, ensuring that the same type of file can be accurately traced back to its original file.

[0153] S42, identify the source data of derivation, find the source data of derivation in the document operation log synchronized by the database.

[0154] The source data includes real source and virtual source. Filter the log entries synchronized by the database, pay attention to the operation type, timestamp and associated document ID in the record. Through the operation chain in the log, trace back to the log item that triggers the change, which is the real source. For virtual source, it is necessary to analyze whether there is an agent operation or system task identifier in the log, which can point to the non-direct user entity that triggers the change. Integrate the log information to construct the source data graph, clearly identify the real and virtual sources, and ensure accurate data traceability.

[0155] Through step S42, the starting point can be determined: identifying the source of derivation is the starting point of the document derivation process, only after the source is determined, can the subsequent derivation operation be accurately performed; it can also distinguish the source type: the real source usually refers to the actual existing file or data, while the virtual source may refer to temporary or intermediate data generated by some operations. Distinguishing between the two helps to adopt different strategies in subsequent processing.

[0156] S43, according to the log record, apply the source path tracking algorithm to track the derivation process of the file.

[0157] The source path tracking algorithm first finds which source the file being operated belongs to, and then adds the new target path to the list of the source. If the target path already exists in the list of another source, it is considered to have changed its ownership and will be deleted from the original source, ensuring that each file path belongs to only one source. Finally, the mapping of all sources is kept up-to-date and accurate. If the corresponding log target path exists in the other source target path set, because the operation log is sorted by time for traversal, the target path in the other source target set needs to be removed.

[0158] Figure 2 is a single tracking flowchart of the document operation log used in the prior art. As shown in Figure 2 , each step of the derivation tree is a separate document operation log. Before the system automatically builds this derivation tree, the system can only perform single-dimensional queries on certain operation behaviors. For example, querying the upload operation behavior can find the two upload logs in Figure 2 . Querying the suffix modification operation behavior can find the one suffix modification log in Figure 2 , but it cannot query the file that is modified first and then uploaded, nor can it know what the source file is that performs the upload operation, whether it is an important code file, etc.

[0159] Through the information provided by the derivation tree shown in Figure 2 , it can be seen that multi-dimensional queries can be performed, and the logs of any operation behavior can be traced back to the source file. It can also be visually seen what the entire derivation track of the source file of interest is and where multiple copies are stored. The prior art ignores multi-dimensional tracking of documents, resulting in a huge waste of information.

[0160] Figure 3 is a flowchart of the document derivation specific implementation method used in the log-based document tracking method of the present application. As shown in Figure 3As shown in the following example: map (source A) = "C:\Test1\1.txt|C:\Test1\2.txt", map (source B) = "C:\Test2\1.txt|C:\Test2\2.txt", when traversing to a log that is copied from C:\Test1\1.txt to C:\Test3\1.txt at 2025-01-05 12:00:00, map (source A) is updated to map (source A) = "C:\Test1\1.txt|C:\Test1\2.txt|C:\Test3\1.txt", and traversing continues to a log that is copied from C:\Test1\1.txt to C:\Test3\1.txt at 2025-01-05 When the log file C:\Test2\1.txt is copied to C:\Test1\1.txt at 12:01:00, map (source B) is updated to map (source B) = "C:\Test2\1.txt|C:\Test2\2.txt|C:\Test1\1.txt", and map (source A) is updated to map (source A) = "C:\Test1\2.txt|C:\Test3\1.txt".

[0161] The source path tracing algorithm is a log-based file path attribution tracking and mapping update mechanism that maintains a mapping from source identifiers to file path sets (using Map <String,Set <string>> indicates) and a log list (List <logentry>), which realizes dynamic updating function. The core process is to traverse the log sequence, extract the source path and target path for each log entry, and then determine the operation starting point by finding the source containing the source path (with the help of findSourceContaining function). If found, the target path is added to the corresponding source set. Then, the findSourceContainingExcluding function is used to detect whether the target path already exists in other source sets. If it exists, it is removed to ensure uniqueness. Finally, the updated mapping is returned. The overall implementation relies on set operations to add and remove paths, with a time complexity of O(k * n * m) (k is the number of logs, n is the number of sources, and m is the average set size).

[0162] By step S43, the path uniqueness can be ensured: through the source path tracking algorithm, it can be ensured that each file path belongs to only one source, avoiding the confusion and conflict of file ownership; the source mapping can also be maintained: the algorithm updates the source list dynamically to keep all source mappings up-to-date and accurate, which is crucial for subsequent file management and operation.

[0163] S44, for each derived source, construct a derived level list, and according to the source path and target path, mark the level, parent node id, and source log id of each log. After all logs are traversed, the constructed derived level list is written to the derived table, and the document derivation is completed.

[0164] S44, dynamically update the derived level information.

[0165] As the file derivation process proceeds, it is necessary to dynamically update the derived level information. This includes updating the parent node id and level field to reflect the current file's position on the derivation link.

[0166] Through step S44, the derivation relationship can be reflected: by dynamically updating the derived level information, the derivation relationship between files can be clearly reflected, which helps to understand and manage complex document systems; it also supports file searching: accurate derived level information helps to quickly locate target files, improving the efficiency of file searching.

[0167] Figure 4 is a document derivation relationship generation diagram used in the log-based document tracking method of the present application. As shown in Figure 4 As shown, in actual implementation, the IP-guard system collects terminal document operation logs every day and saves them into a database doc_log_year-month-day table created every day, and then synchronizes the logs in a specified number of days to the database single table doc_log. During synchronization, first, the derivative source data is found from the doc_log table set cache relationship algorithm and written into the derivative table doc_trace, then each operation log is traversed and corresponded to the corresponding source, and the level and parent node are labeled at the same time, the derivative composition list is constructed, and then the data is written into the derivative table doc_trace again to complete the derivative relationship generation.

[0168] In actual implementation, the document derivative can be derived from the source first, and then find the derivative composition. First, write the logs marked with the specified derivative source identifier in the synchronization process into the derivative table, and this part of data is the data that IP-guard clearly records to its source and synchronizes. There is another part of data, which may be due to the date that the log in the specified number of days is not synchronized to its source, or the IP-guard system starts to collect logs and its source has been generated, so it is not collected by the system, which will find a virtual source in the data synchronized with the terminal and file source path in the derivative composition according to the earliest operation log as the virtual source written into the derivative table. Different from the real source, the virtual source also needs to write a secondary node, and the secondary node is the operation log whose file source path is the same as the virtual node file source path and there is no operation log between the virtual node and the secondary node. The directory path of the operation log is equal to the source path of the secondary node. After the real source and the secondary node of the virtual source are written into the derivative table, the operation log can be traversed in the system to find the derivative composition part.

[0169] For the scenarios that appear in the derivative finding process, including simple file derivative, file compression into compressed package derivative, compressed package decompression into multiple files, and complex scenarios such as how to find a folder from a file, how to find a file from a folder, how to find a folder from a folder, etc.

[0170] Simple file derivation, according to the rule that the file target path of the last level operation log is equal to the file source path of the next level operation log, but there cannot exist a file whose file target path of the operation log between the operation time of the last level operation log and the operation time of the next level operation log is equal to the file source path of the next level operation log, if there is, it means that such log does not belong to the current level and should be written in the later level. For example, a new file C:\A\B\1.txt is created, the file C:\A\B\1.txt is moved to D:\1.txt, then D:\1.txt is moved to C:\A\B\1.txt, finally C:\A\B\1.txt is moved to E:\1.txt, the above four logs, when writing the next level based on the log of creating a new file C:\A\B\1.txt, according to the rule that the file target path of the last level operation log is equal to the file source path of the next level operation log, C:\A\B\1.txt is moved to D:\1.txt and C:\A\B\1.txt is moved to E:\1.txt can be found, but, C:\A\B\1.txt is moved to E:\1.txt should be written after C:\A\B\1.txt is moved to D:\1.txt, instead of being derived directly from the source file.

[0171] File compression into a compressed package derivation, at this time, the operation of the compressed package needs to coexist in the respective derivation track of all compressed files.

[0172] Decompression of the compressed package into multiple files, at this time, the decompressed file only needs to correspond to the file track at the time of compression.

[0173] Complex scenarios such as how files find folders, how folders find files, and how folders find folders can be simply understood as folders are actually carriers of files, and each folder operation (copy, move, rename) is actually an operation on the files inside. Each folder operation records how the operation affects the files, and then uses the affected files to find the derivatives. This simplifies the problem of finding files in folders, which can be solved using the custom algorithm hasSubstr. This algorithm means that the elements of array A completely contain array B, and the order is the same, then return true, otherwise return false. For example, hasSubstr([1, 2, 3], [1, 2]) returns true, hasSubstr([1, 2, 3], [2, 1]) returns false, and hasSubstr([1, 2, 3], [1, 2, 3, 4]) returns false. When this algorithm is applied to files and folders, file1 path C:\A\B\1.txt can find the folder operation path C:\A or C:\A\B. At this time, hasSubstr(['C:', 'A', 'B'], ['C:', 'A']) or hasSubstr(['C:', 'A', 'B'], ['C:', 'A', 'B']) are both true, but C:\A\B\C will not be true. At this time, hasSubstr(['C:', 'A', 'B'], ['C:', 'A', 'B', 'C']) is false. Using this function, you can find the derivatives of the folder. Therefore, you need to add an array field to the file path when building the table to facilitate the derivation of the folder. The derivation of the folder is different from the derivation of the file. The derivation of the file only needs to find the next level source file path and the same data as the previous level target file path (part of the scene such as deletion, recovery, and new target path empty). In addition, it does not need to care about the previous level source file path. However, the derivation of the folder is different. For the scenario where the source file path disappears, it does not care about the previous level source file path. However, for the scenario where the source file does not disappear, the source file path also needs to be derived as a folder. In summary, the scenarios of moving, renaming, and deleting do not perform source file folder derivation, while other scenarios do.

[0174] For example, when deriving the operation log of copying C:\A\B\1.txt to D:\A\B\1.txt, in addition to finding the next level file operation of the target file path D:\A\B\1.txt, it also needs to find the folder operation that fully contains the file path D:\A\B. In addition, the source file C:\A\B\1.txt has been copied and has not disappeared, so it also needs to perform a folder derivation on the source file to find the folder operation that fully contains the path C:\A\B. When deriving the operation log of renaming C:\A\B\1.txt to C:\A\B\2.txt, it only needs to find the next level file and folder according to the file C:\A\B\2.txt, because the source file C:\A\B\1.txt has disappeared through renaming, so it does not need to perform folder derivation separately. Therefore, each log record is written into the derivation track table, and an identifier is written according to the operation type to determine whether the source file has disappeared, and whether to perform folder derivation on the source file separately according to the identifier.

[0175] In some optional implementations of the present embodiment, in order to improve the efficiency of the document derivation process, the database query can also be optimized, including creating appropriate indexes and optimizing query statements.

[0176] By optimizing the database query, the processing speed can be improved: by optimizing the database query performance, the processing speed of the document derivation process can be significantly improved, and the waiting time can be reduced; resource consumption can also be reduced: optimizing query performance helps to reduce the resource consumption of the database and improve the overall performance and stability of the system.

[0177] In some optional implementations of the present embodiment, the derivation process can also be monitored and logged. During the document derivation process, the derivation progress and results are monitored in real time, and relevant log information is recorded. This helps to discover and solve problems in a timely manner and ensures the smooth progress of the derivation process.

[0178] By monitoring the derivation process in real time, potential problems and abnormalities can be discovered in a timely manner to avoid the problem from becoming larger. Recording the log information of the derivation process provides reliable historical records for subsequent analysis and troubleshooting.

[0179] Step S5, store the derivation information of the document.

[0180] In the present embodiment, step S5, storing the derivation information of the document can specifically include the steps of:

[0181] S51, according to the type and function of the derivation information, set the data table structure, and the data table structure includes metadata fields and version history fields.

[0182] A reasonable storage structure can ensure the effective storage and efficient access of information. Select a suitable database type for storing derivative information, such as a relational database or a document database. Relational databases are suitable for storing structured information, while document databases are more suitable for storing semi-structured or unstructured information. Ensure that the database can efficiently store and access derivative information, improve the reliability and performance of information storage.

[0183] According to the type and function of derivative information, design the corresponding data table structure. For example, design a table for metadata containing fields such as document name, author, creation time, etc.; design a table for version history containing fields such as version number, modification time, modification content, etc.

[0184] Design indexes for data tables to improve information retrieval speed. Indexes can be designed according to the fields of derivative information, such as indexing by document name or version number. Through index design, you can quickly locate the required derivative information and improve the efficiency of information access.

[0185] S52, store metadata through metadata fields, which are information used to describe document properties and characteristics.

[0186] Metadata is information that describes the properties and characteristics of a document, and plays an important role in document management and retrieval.

[0187] Metadata collection: Extract metadata from documents, including document name, author, creation time, modification time, size, type, etc. Ensure the accuracy and completeness of metadata to provide a reliable foundation for subsequent information storage and retrieval.

[0188] Metadata cleaning: Clean the collected metadata to remove duplicate, invalid or redundant information. Improve the quality of metadata, reduce storage space waste, and help improve information retrieval accuracy.

[0189] Metadata storage: Store cleaned metadata in the database to ensure the reliability and security of metadata. Through database storage, you can easily access and manage metadata, support document retrieval, classification and statistics, and other functions.

[0190] S53, store version history information of the document through version history fields.

[0191] Version history is information that records the modification process of a document, and plays an important role in version control and data recovery of the document. Storing version history is another important step in storing derivative information.

[0192] Version record: After each modification of the document, record the modified content, time and modifier, etc. Ensure the integrity and accuracy of the version history to provide a reliable foundation for subsequent version control and data recovery.

[0193] Version storage: Store the version information of the record in the database and associate it with the original document. Through database storage, it is convenient to access and manage version history, support document version rollback and data recovery functions, etc.

[0194] Version management: Manage the stored version history, including version comparison, merging, deletion, etc. Through version management, it can efficiently handle version conflicts and redundant versions, improve the efficiency and accuracy of version control.

[0195] S54, set permissions and access control for the document.

[0196] Permissions and access control are important means to protect the security of the document. By setting permissions and access control, you can limit user access and operations on the document, ensuring the security and integrity of the document.

[0197] User authentication is performed to ensure that only authorized users can access the document. Through user authentication, unauthorized access to the document can be prevented, improving the security of the document.

[0198] According to the user's role and needs, set the corresponding permissions, such as reading, editing, deleting, etc. Through permission setting, you can limit user operation permissions on the document, ensuring that the document will not be illegally modified or deleted.

[0199] According to the permission settings, control and audit the user's access requests. Through access control, you can further ensure the security of the document, prevent unauthorized access and operation.

[0200] Step S6, according to the derivative information, the document is analyzed by derivation.

[0201] In this embodiment, step S6, according to the derivative information, the document is analyzed by derivation, which can include the following steps:

[0202] S61, according to the derivative information, query the source log.

[0203] The source log refers to the operation record of the original document that triggers a series of derivative operations. By querying these logs, you can determine the original source of the document and the starting point of subsequent derivative operations.

[0204] Through step S61, you can locate the starting point: clearly define the starting position of the document derivation chain, provide a reference for subsequent analysis; you can exclude interference: avoid introducing irrelevant or secondary derivative paths in subsequent analysis; you can improve efficiency: starting from the source, you can more effectively track and analyze the derivative situation of the document.

[0205] S62, all the derivative operation trees of the derivative source files are queried out by the recursive algorithm.

[0206] The recursive algorithm is an algorithm that repeatedly applies the same rule in a data structure (such as a tree or a graph) until a certain condition is met. In document derivative analysis, the recursive algorithm is used to traverse the document derivative relationship graph, starting from the source log, and tracking each derivative document and its operation level by level.

[0207] Through step S62, it can be fully covered: ensure that all derivative operations related to the source file are included in the analysis range; the derivative structure is clear: the derivative relationship is displayed in a tree structure, which is convenient for understanding and analysis; it can be dynamically updated: with the addition of new operations, the derivative operation tree can be updated in real time, maintaining the timeliness of the analysis.

[0208] S63, query and display the derivative link of the document.

[0209] Based on the recursive query, each derivative link can be queried out by associating the id of the upper level operation log with the parent node id of the lower level operation log. The derivative link refers to a series of operation sequences from the source file to all its derivative files. By displaying these links in a visual way, the flow and change process of the document in the system can be intuitively seen.

[0210] Through step S63, the document derivative relationship can be presented in a graphical way, which is convenient for understanding and analysis; details can be captured, and the specific information of each operation can be clearly displayed, such as operation type, time, operator, etc.; problem positioning can be performed: it helps to quickly find potential sensitive operations or abnormal behaviors.

[0211] After the document derivative is completed, because the source, level, and parent node id of all document derivative logs have been fixed to the database, all source files can be queried out by directly querying the source id, and all derivative operation trees of the derivative source files can be queried out by the recursive algorithm. By querying each derivative link by associating the id of the upper level operation log with the parent node id of the lower level operation log, it can be intuitively seen whether the file name modification, compression, and other disguising operations have been performed before the file is transmitted outside WeChat, copied to a U disk, and how many copies of a sensitive file have been generated on a terminal, which can achieve the effect of querying billions of data per second.

[0212] The implementation of the present embodiment has the following advantages:

[0213] (1) By obtaining the document operation log containing detailed field information, it can ensure that every change of the document is recorded in detail, which is helpful for subsequent tracing and checking of the historical state of the document, and improves the transparency of document management;

[0214] (2) The operation log is set with an easy-to-derive identifier and a field for easy-to-derive calculation, simplifying the processing of log data, and the identifier and field are established to make the log data more structured, facilitating subsequent data analysis and processing;

[0215] (3) The operation log is synchronized through the identifier and field, ensuring real-time and consistency of data, which helps to seamlessly connect the log data in multiple nodes or systems, and improves the collaborative efficiency of the overall system;

[0216] (4) Document derivation is performed according to the synchronized operation log, which can automatically generate multiple versions or variants of the document, meet diversified document requirements, greatly improve the automation level of document generation, and reduce labor costs;

[0217] (5) The derivative information of the stored document is analyzed, which helps to deeply mine the association and difference between documents, provides a scientific basis for document management, improves the intelligent level of document management, and provides a strong basis for decision support;

[0218] (6) The terminal operation log can be automatically synchronized and cleaned, the operation derivation tree can be generated, and the derivation level can be calculated, based on the generated operation log derivation tree, multi-dimensional log query and analysis on the same derivation tree or the same derivation link can be realized, this query mode is more intuitive than the previous single operation log query, the analysis range is higher, and more information can be provided for terminal document operation behavior monitoring and analysis.

[0219] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0220] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by computer readable instructions instructing relevant hardware, and the computer readable instructions can be stored in a computer readable storage medium. When the program is executed, the processes of the above-mentioned embodiments of each method can be included. The storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0221] It should be understood that although each step in the flowchart of the accompanying drawings is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0222] Embodiment two

[0223] Further reference Figure 5 , as an implementation of the method described above Figure 1 , the present application provides an embodiment of a log-based document tracking device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied to various electronic devices.

[0224] As shown in Figure 5 , the log-based document tracking device 70 of the present embodiment includes an acquisition module 71, a setting module 72, a synchronization module 73, a derivation module 74, a storage module 75, and an analysis module 76. Among them:

[0225] The acquisition module 71 is configured to acquire a document operation log, and the operation log includes field information.

[0226] The setting module 72 is configured to set an easy-to-derive identifier for the operation log according to the field information, and establish an easy-to-derive calculation field.

[0227] The synchronization module 73 is configured to synchronize the operation log that has been set with the easy-to-derive identifier and established with the easy-to-derive calculation field.

[0228] The derivation module 74 is configured to derive a document according to the synchronized operation log.

[0229] Storage module 75, used to store derivative information of the document;

[0230] The analysis module 76 is used to perform derivative analysis on the document based on the derivative information.

[0231] The beneficial effects of implementing this embodiment are: it can automatically complete the synchronous cleaning of terminal operation logs, the generation of operation derivative trees and the calculation of derivative levels. Based on the generated operation log derivative tree, multi-dimensional log query and analysis can be achieved on the same derivative tree or the same derivative link. This query mode is more intuitive than the previous one that can only query based on a single operation log, and has a wider analysis range, which can provide more information for terminal document operation behavior monitoring and analysis.

[0232] Example 3

[0233] To solve the above technical problems, the embodiment of the present invention also provides a computer device. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0234] The computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 8 having components of the memory 81, the processor 82, and the network interface 83, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0235] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0236] The memory 81 includes at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 81 can be an internal storage unit of the computer device 8, such as a hard disk or a memory of the computer device 8. In other embodiments, the memory 81 can also be an external storage device of the computer device 8, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 8. Of course, the memory 81 can also include both the internal storage unit and the external storage device of the computer device 8. In this embodiment, the memory 81 is generally used to store an operating system and various application software installed on the computer device 8, such as computer readable instructions of the log-based document tracking method, etc. In addition, the memory 81 can also be used to temporarily store various data that have been output or will be output.

[0237] The processor 82 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 82 is generally used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to run computer readable instructions or process data stored in the memory 81, such as computer readable instructions of the log-based document tracking method.

[0238] The network interface 83 can include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 8 and other electronic devices.

[0239] The implementation of this embodiment has the beneficial effect that it can automatically complete synchronization cleaning of terminal operation logs, operation derivation tree generation, and derivation level calculation. Based on the generated operation log derivation tree, multi-dimensional log query and analysis on the same derivation tree or the same derivation link can be realized. This query mode is more intuitive than the previous query based on a single operation log, has a higher analysis range, and can provide more information for terminal document operation behavior monitoring and analysis.

[0240] Embodiment Four

[0241] The application also provides another embodiment, that is, providing a computer readable storage medium, the computer readable storage medium stores computer readable instructions, the computer readable instructions can be executed by at least one processor, so that the at least one processor executes the steps of the log-based document tracking method as described above.

[0242] The embodiment has the beneficial effects that the synchronization cleaning of the terminal operation log, the operation derivation tree generation and the derivation level calculation can be automatically completed, based on the generated operation log derivation tree, the multi-dimensional log query and analysis on the same derivation tree or the same derivation link can be realized, the query mode is more intuitive than the previous query based on a single operation log, the analysis range is higher, and more information can be provided for terminal document operation behavior monitoring and analysis

[0243] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the various embodiment methods of the present application.

[0244] Obviously, the above-described embodiments are only some of the embodiments of the present application, not all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be realized in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some technical features. Any equivalent structure made by using the content of the present application specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.< / logentry> < / string>

Claims

1. A log-based document tracking method, characterized in that: The steps include: Obtaining the document operation log, wherein the operation log includes field information; According to the field information, an identifier that is easy to derive is set for the operation log, and a field that is easy to derive calculation is established; Synchronizing the operation logs after setting identifiers that are easy to derive and establishing fields that are easy to derive and calculate; Derivation of documents based on the synchronized operation logs; storing derivative information of the document; performing derivative analysis on the document according to the derivative information; The step of setting an identifier that is easy to derive for the operation log according to the field information and establishing a field that is easy to derive and calculate specifically includes: Determine the identification type to be set based on the field information; According to the identification type, setting and applying identification rules; According to the identification rule, setting an easily derived identification for the operation log; Create fields that are easy to derive calculations; The step of deriving a document based on the synchronized operation log specifically includes: Create a derived information table, and create a separate data table in the database to record the derived information of each document; Identify the derived source data and find it in the document operation logs that have been synchronized with the database; According to the log records, the source path tracing algorithm is applied to track the derivation process of the file; Build a derived level list for each derived source, annotate each log's level, parent node ID, and source log ID based on the source path and target path. After all logs are traversed, write the constructed derived level list into the derived table to complete document derivation. Dynamically update derived hierarchy information.

2. The log-based document tracking method according to claim 1, characterized in that: The step of obtaining the document operation log, wherein the operation log includes field information, specifically includes: Obtain collection requirements and select log collection tools or programs; Configuring collection parameters and rules, wherein the collection parameters include the field information included in the operation log; Deploy collection tools or collection programs to terminal devices; Monitor the log collection process and exception handling.

3. The log-based document tracking method according to claim 1, characterized in that: The step of synchronizing the operation log after setting the identifier that is easy to derive and establishing the field that is easy to derive and calculate specifically includes: receiving the operation log and caching the operation log; Read the cached log content and parse it according to the predefined log format; Perform data synchronization operations based on the parsed log information.

4. The log-based document tracking method according to claim 1, characterized in that: The step of storing the derivative information of the document specifically includes: According to the type and function of the derived information, a data table structure is set, wherein the data table structure includes a metadata field and a version history field; The metadata field is used to store metadata, wherein the metadata is information used to describe document attributes and characteristics; Storing version history information of the document via the version history field; Set permissions and access controls on the document.

5. The log-based document tracking method according to any one of claims 1 to 4, characterized in that: The step of performing derivative analysis on the document according to the derivative information specifically includes: querying the source log based on the derived information; By using the identification recursive algorithm, all derived operation trees of all derived source files are queried; Query and display the derived links of the document.

6. A log-based document tracking device, characterized in that: include: An acquisition module, configured to acquire the document operation log, wherein the operation log includes field information; A setting module, configured to set an identifier that is easy to derive for the operation log according to the field information, and to establish a field that is easy to derive and calculate; A synchronization module, configured to synchronize the operation logs after setting identifiers that are easy to derive and establishing fields that are easy to derive and calculate; A derivation module, configured to derive documents based on the synchronized operation logs; A storage module, configured to store derivative information of the document; an analysis module, configured to perform derivative analysis on the document based on the derivative information; The setting module is specifically used for: Determine the identification type to be set based on the field information; According to the identification type, setting and applying identification rules; According to the identification rule, setting an easily derived identification for the operation log; Create fields that are easy to derive calculations; The derivative module is specifically used for: Create a derived information table, and create a separate data table in the database to record the derived information of each document; Identify the derived source data and find it in the document operation logs that have been synchronized with the database; According to the log records, the source path tracing algorithm is applied to track the derivation process of the file; Build a derived level list for each derived source, annotate each log's level, parent node ID, and source log ID based on the source path and target path. After all logs are traversed, write the constructed derived level list into the derived table to complete document derivation. Dynamically update derived hierarchy information.

7. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the log-based document tracking method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the log-based document tracking method according to any one of claims 1 to 5.

Images