Software log auditing comprehensive management system for cloud computing

Abstract

A software log auditing comprehensive management system for cloud computing relates to the technical field of cloud computing, and comprises the following steps: acquiring configuration attributes of each log source, and dynamically adjusting an acquisition strategy of each log source according to the configuration attributes; constructing a double-region linked list in the virtual memory, and dynamically adjusting the storage node position of the log data in a double-region memory page linked list according to the log data storage linked list position and the active test result of the log data in the log data calling process; performing entity extraction and relation extraction on the log data, constructing a knowledge graph, presetting an edge updating interval of each log source, and dynamically updating the knowledge graph according to the edge updating interval; detecting each node in the knowledge graph in real time, and obtaining an attack chain of an abnormal node based on the knowledge graph and historical attack path data; according to the risk score of the node in the attack chain, the edge updating interval of the log source is updated, and the efficiency and the real-time performance of log data calling are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and specifically to a comprehensive management system for software log auditing in cloud computing. Background Art

[0002] A Chinese patent with the publication number CN116011032A discloses a method, apparatus, electronic device, and storage medium for processing audit logs, including: receiving a deposit request sent by a service end, and determining deposit data corresponding to the audit log in the deposit request; generating a deposit identification number for the deposit data, and performing on-chain storage on the deposit data based on the blockchain middleware interface to obtain deposit block data; associating the deposit identification number with the audit log to obtain association information, and feeding back the association information and the deposit block data to the service end.

[0003] A Chinese patent with the publication number CN119396665A discloses a cloud computing software log audit management system, including: a log collection module: collecting software log data from multiple nodes in a cloud computing environment; a data processing module: preprocessing the collected software log data to obtain valid log data, and using a clustering algorithm to perform unsupervised clustering on the valid log data according to similarity to obtain log clustering clusters; a feature extraction module: extracting features from the data in each log clustering cluster to obtain log features; an intelligent parsing and alarm module: based on a constructed log analysis model, using the log features as the input of the log analysis model for prediction to obtain a risk score, and performing alarm processing based on the risk score.

[0004] Traditional log collection systems often adopt a fixed collection strategy and cannot perceive the configuration attributes that change in real time at the log source. During different time periods, key indicators such as the load of the log source and the data generation frequency will fluctuate greatly, and the fixed collection strategy is likely to cause resource waste or omission of key logs.

[0005] Past log storage methods were mostly simple data stacking, without fully considering the difference in the activity of log data access. This results in a long retrieval time and low efficiency when calling logs, especially when dealing with a large amount of logs, the latency problem becomes more serious. For example, when troubleshooting system failures, due to the inability to quickly locate the frequently used key logs, the troubleshooting time is greatly extended, affecting the normal operation of the business. Moreover, the existing storage architecture fails to make reasonable use of memory resources, cannot dynamically adjust the storage location according to the log activity, and cannot achieve efficient memory management.

[0006] In the prior art, it is difficult to achieve real-time and accurate entity extraction and relationship extraction in constructing a knowledge graph of log data. The log data structure is complex and diverse, and traditional methods are difficult to effectively mine the hidden semantic connection relationships therein, resulting in a deviation between the constructed knowledge graph and the actual log data. At the same time, the knowledge graph update mechanism is rigid and cannot be updated in a timely manner according to changes in the log source, resulting in an outdated knowledge graph and being unable to provide real-time and accurate data support for subsequent anomaly detection and attack chain analysis, seriously affecting the system's response speed to security threats.

[0007] Traditional anomaly detection methods are mostly based on simple rules or static thresholds and cannot effectively handle the complex and changeable attribute values and connection relationships of nodes in the knowledge graph. In the face of increasingly complex attack means, this detection method has a high false alarm rate and serious missed reports, and it is difficult to accurately identify potential security risks. In the link of attack chain analysis, the prior art lacks in-depth mining of historical attack path data, cannot accurately construct a probability transition matrix, and the calculation of node risk scores is not scientific enough, making it difficult to accurately match the real attack chain, resulting in security personnel lacking clear and accurate attack path information when dealing with attacks and being difficult to formulate effective defense strategies.

[0008] Existing risk assessment methods mostly evaluate system risks isolatedly and do not closely associate the risks of nodes in the attack chain with log source management. This results in the inability to dynamically adjust the log source collection and knowledge graph update strategies according to the risk level. For example, when a high security risk is found in a certain area, it is impossible to timely shorten the update interval of the relevant log source to obtain more real-time logs for in-depth analysis, thus missing the opportunity to timely discover and prevent potential attacks and increasing the risk of the system being attacked. Summary of the Invention

[0009] To solve the above technical problems, the purpose of the present invention is to provide a comprehensive management system for software log auditing in cloud computing, including a cloud, and the cloud is communicatively connected with an adaptive configuration module, a log collection module, a log storage module, an active test module, a knowledge graph module, an anomaly detection module, an attack chain matching module, and a risk assessment module;

[0010] The adaptive configuration module is used to collect the configuration attributes of each log source and dynamically adjust the collection strategy of each log source according to the configuration attributes, and the collection strategy includes the collection frequency and the number of log entries collected each time;

[0011] The log collection module is used to collect log data from each log source in real time according to the configured collection strategy, mark the collection time, and set the collection period (one hour);

[0012] The log storage module is used to store the collected log data, construct a double-region linked list in virtual memory, and during the process of log data invocation, dynamically adjust the storage node position of the log data in the double-region memory page linked list according to the linked list position where the log data is stored and the active test result of the log data;

[0013] The active test module is used to perform active tests on the log data;

[0014] The knowledge graph module is used to extract entities and relationships from the log data, construct a knowledge graph, preset the edge update interval for each log source, and dynamically update the knowledge graph according to the edge update interval;

[0015] The anomaly detection module is used to perform real-time detection on each node in the knowledge graph and determine whether to generate an abnormal node according to the real-time detection result;

[0016] The attack chain matching module is used to obtain the attack chain of the abnormal node based on the knowledge graph and historical attack path data;

[0017] The risk assessment module is used to update the edge update interval of the log source to which other nodes belong according to the risk scores of other nodes except the abnormal nodes in the attack chain.

[0018] Furthermore, the process by which the adaptive configuration module dynamically adjusts the collection strategy of each log source according to the configuration attributes includes:

[0019] The configuration attributes include various types of key indicators. Statistically analyze the configuration attributes of the log source in several historical collection cycles, obtain the normal value ranges of various types of key indicators of the log source in different time periods, and set the threshold ranges of various types of key indicators in different time periods according to the normal value ranges;

[0020] Obtain the comprehensive load index according to the configuration attributes in the current time period, set the comprehensive load threshold range according to the threshold ranges of various types of key indicators in the current time period, and obtain the dynamic adjustment coefficient according to the comprehensive load index and the comprehensive load threshold range;

[0021] Dynamically adjust the collection strategy of the log source according to the dynamic adjustment coefficient.

[0022] Furthermore, the process of dynamically adjusting the collection strategy of the log source according to the dynamic adjustment coefficient in the current time period includes:

[0023] Normalize various types of key indicators, calculate the comprehensive load index L through weighted summation, and the weight ω i Adjust according to business requirements:

[0024] L = ω1·CPU_norm + ω2·Mem_norm + ω3·Log_rate_norm + ω4·Concurrency_norm;

[0025] Among them, ω1, ω2, ω3, and ω4 represent weights, CPU_norm represents the CPU usage rate after normalization processing, Mem_norm represents the memory usage rate after normalization processing, Log_rate_norm represents the log generation rate after normalization processing, and Concurrency_norm represents the number of concurrent operations after normalization processing;

[0026] Similarly, perform weighted summation calculations on the low threshold, normal threshold, high threshold, and danger threshold corresponding to each type of key indicator to obtain the low load threshold L included in the comprehensive load threshold interval low , normal load threshold L normal , high load threshold L high and danger load threshold L critical ;

[0027] Obtain the dynamic adjustment coefficient α according to the comprehensive load index and the comprehensive load threshold interval to control the changes in the acquisition frequency and the acquisition volume:

[0028]

[0029] Among them, k1 and k2 represent the adjustment sensitivity coefficients;

[0030] Dynamically update the acquisition frequency according to the adjustment coefficient α:

[0031] F new = F base ·α;

[0032] Among them, F new represents the adjusted acquisition frequency, and F base represents the preset acquisition frequency;

[0033] Control the number of log entries collected each time through the adjustment coefficient α:

[0034] Q new = Q base ·α;

[0035] Among them, Q new represents the adjusted number of log entries, and Q base represents the preset number of log entries;

[0036] When L > L critical , trigger the emergency strategy:

[0037] F new = 0;

[0038] Q new = Q min ;

[0039] where Q min is the minimum necessary collection amount (such as only recording error logs).

[0040] Furthermore, the log storage module stores log data. The process of constructing a double-region linked list in virtual memory includes:

[0041] The log storage module includes virtual memory and physical memory (disk). A hot memory page linked list and a cold memory page linked list are constructed in the virtual memory, and the tail node of the hot memory page linked list is linked to the head node of the cold memory page linked list;

[0042] The hot memory page linked list is used to store log data that passes the active test, and the cold memory page linked list and the physical memory are used to store log data that fails the active test.

[0043] Furthermore, during the process of calling log data, the process of dynamically adjusting the storage node position of log data in the double-region memory page linked list according to the linked list position where the log data is stored and the active test result of the log data includes:

[0044] When calling the log data of the log source, if the log data is stored in the physical memory, insert the log data into the head node of the cold memory page linked list. When inserting the log data into the head node of the cold memory page linked list, transfer the log data stored in the tail node of the cold memory page linked list back to the physical memory;

[0045] If the log data is stored in the virtual memory, determine the linked list position where the log data is stored;

[0046] If the log data is stored in the hot memory page linked list, determine whether the log data is located at the head node of the hot memory page linked list. If the log data is not located at the head node of the hot memory page linked list, then transfer the log data to the head node of the hot memory page linked list;

[0047] If the log data is stored in the cold memory page linked list, conduct an active test on the log data. If the log data passes the active test, then insert the log data from the cold memory page linked list into the head node of the hot memory page linked list, and demote the log data stored in the tail node of the hot memory page linked list to the head node of the cold memory page linked list;

[0048] If the log data fails the active test, determine whether the log data is located at the head node of the cold memory page linked list. If the log data is not located at the head node of the cold memory page linked list, then transfer the log data to the head node of the cold memory page linked list.

[0049] Further, the process of the active test module performing an active test on the log data includes:

[0050] Obtain the call count threshold and the call interval threshold of the active memory page linked list;

[0051] Obtain the call records of the log data that needs to be actively tested, where the call records include the data call time of the log data in the virtual memory each time;

[0052] Calculate the time difference between adjacent data call times to obtain the call interval, obtain the adjacent data call times with the corresponding call interval less than the call interval threshold, perform statistical analysis on the adjacent data call times, obtain the frequent call count, and compare the frequent call count with the call count threshold;

[0053] If the frequent call count is greater than or equal to the call count threshold, the log data passes the active test. If the frequent call count is less than the call count threshold, the log data fails the active test.

[0054] Further, the process of the knowledge graph module performing entity extraction and relationship extraction on the log data and constructing a knowledge graph includes:

[0055] Call the log data of each log source from the log storage module, and perform preprocessing operations of word segmentation, sentence segmentation, and part-of-speech tagging on the log data;

[0056] Input the log data after the preprocessing operation into a preset named entity recognition model for entity extraction, obtain several entities in the log data, construct a relationship extraction model based on deep learning, input the several entities into the relationship extraction model for relationship extraction, and obtain the semantic connection relationships between the several entities;

[0057] Represent the several entities and the semantic connection relationships between the several entities as a graph data structure, with the entities as nodes in the graph and the semantic connection relationships as edges in the graph, construct a knowledge graph, fill the extracted several entities and the semantic connection relationships between the several entities into the knowledge graph, and add corresponding attributes to the nodes and edges;

[0058] Further, the process of presetting the edge update interval of each log source and dynamically updating the knowledge graph according to the edge update interval includes:

[0059] Preset the edge update interval of each log source, regularly call the log data of each log source in the log storage module according to the edge update interval, perform preprocessing operations of word segmentation, sentence segmentation, and part-of-speech tagging, entity extraction, and relationship extraction on the log data, and obtain the entities included in the log data and the semantic connection relationships between the entities;

[0060] Match the entities and the semantic connection relationships between entities with the knowledge graph. If there are nodes in the knowledge graph that are consistent with the entities and edges that are consistent with the semantic connection relationships between the entities, then update the attributes of the nodes in the knowledge graph that are consistent with the entities and the edges that are consistent with the semantic connection relationships between the entities according to the entities and the semantic connection relationships between the entities;

[0061] If there are no nodes in the knowledge graph that are consistent with the entities or no edges that are consistent with the semantic connection relationships between the entities, then add, delete, and update the attributes of nodes or edges in the knowledge graph according to the entities or the semantic connection relationships between the entities. For newly emerged entities, add corresponding nodes to the knowledge graph; for entities that no longer exist or are no longer valid, delete the corresponding nodes from the knowledge graph. For newly discovered entity relationships, add corresponding edges to the knowledge graph; for relationships that have become invalid, delete the corresponding edges from the knowledge graph. Subsequently, update the attribute information of the nodes and edges, including the state changes of the entities, the occurrence frequencies of the relationships, etc.

[0062] Furthermore, the process of the anomaly detection module performing real-time detection on each node in the knowledge graph and determining whether to generate an abnormal node according to the real-time detection results includes:

[0063] Obtain the time series of various types of attribute values corresponding to the attributes of each node in the knowledge graph in a number of historical collection cycles and the in-degree and out-degree time series. Input the time series of various types of attribute values and the in-degree and out-degree time series into a temporal convolutional neural network, and obtain the predicted sequences of various types of attribute values and the in-degree and out-degree predicted sequences of each node in the current collection cycle according to the trained temporal convolutional neural network;

[0064] Compare the time series of various types of attribute values and the in-degree and out-degree time series of each node in the current collection cycle with the predicted sequences of various types of attribute values and the in-degree and out-degree predicted sequences respectively, obtain the multi-type attribute deviation values and the in-degree and out-degree deviation values of each node, preset the multi-type attribute deviation threshold and the in-degree and out-degree deviation threshold. If there is a node whose multi-type attribute deviation value is greater than the multi-type attribute deviation threshold or the in-degree and out-degree deviation value is greater than the in-degree and out-degree deviation threshold, then mark the node as an abnormal node, restrict the relevant permissions of the log source to which the abnormal node belongs, and then give an early warning of the attack path of the abnormal node.

[0065] Among them, the calculation formula for the in-degree and out-degree is:

[0066] dr v =ω4·∑ u∈V edge(u→v)+ω5·∑ u∈V edge(v→u);

[0067] Among them, dr vdenotes the in - degree and out - degree of node v, ∑ u∈V edge(u→v) represents the number of edges pointing to node v, that is, the in - degree, ∑ u∈V edge(v→u) represents the number of edges starting from node v and pointing to other nodes, that is, the out - degree. V is the set of all nodes in the knowledge graph. ω4 and ω5 represent weight factors, which are adjusted according to the scenario. For example, for a malware node: the out - degree is high (infecting multiple hosts), and the in - degree may be low (only triggered by a few vulnerability - exploiting nodes), then ω5 is higher than ω4; for a C2 server node: the in - degree is high (connected by multiple infected hosts), and the out - degree may be low (only controlling specific hosts), then ω4 is higher than ω5; for a normal user node: the in - degree and out - degree are usually low and stable, then ω4 is approximately equal to ω5;

[0068]

[0069]

[0070] Among them, S v denotes the multi - type attribute deviation value of node v, D it denotes the attribute value of the i - th type of attribute at the t - th moment, DA it denotes the predicted attribute value of the i - th type of attribute at the t - th moment, dr vt denotes the in - degree and out - degree of the i - th type of attribute at the t - th moment, drA vt denotes the in - degree and out - degree of node v at the t - th moment, drA vt denotes the predicted in - degree and out - degree of node v at the t - th moment. n1 represents the total number of attribute types, and n2 represents the total number of moments in the time series.

[0071] The above formulas are all calculated by removing the dimension and taking their numerical values. The formulas are obtained by collecting a large amount of data for software simulation to get a formula closest to the real situation. The preset parameters and preset thresholds in the formulas are set by those skilled in the art according to the actual situation or obtained through a large amount of data simulation;

[0072] Furthermore, the process of the attack chain matching module obtaining the attack chain of abnormal nodes based on the knowledge graph and historical attack path data includes:

[0073] Preset attack chain template, the attack chain template includes a stage sequence (defining the necessary steps of the attack chain, such as weaponization → delivery → exploitation → lateral movement), node attribute constraints (specific node attributes corresponding to each stage, such as vulnerability exploitation node → malware node → compromised host node), and relationship type constraints (the stages are connected by specific relationships (such as use → infect → control). Starting from the abnormal node, traverse the knowledge graph and match the paths according to the order of the attack chain template, including: Node attribute matching: Whether the current node belongs to the specific node attribute of a certain stage in the template; Relationship type matching: Whether the next node is connected by the relationship specified in the template; Stage order constraint: The path must strictly follow the stage order of the template; Obtain all possible paths that match the attack chain template;

[0074] Obtain the historical attack path data of the knowledge graph, construct the probability transition matrix of each possible path according to the historical attack path data, as well as the risk scores of each node included in each possible path. Optimize the risk scores of each node based on the graph neural network, and dynamically correct the probability transition matrix according to the optimized risk scores, and output the prior probabilities of each possible path;

[0075] Based on the historical attack path data and the prior probabilities of each possible path, obtain the attack chain confidence of each possible path, preset the confidence threshold, and mark the possible paths whose corresponding attack chain confidence is greater than the confidence threshold as attack chains.

[0076] Furthermore, the process of obtaining the attack chain confidence of each possible path includes:

[0077] According to the historical attack path data (such as attack chain logs), count the transfer times C from node i to node j i,j , then the transfer probability is defined as:

[0078]

[0079] where n represents the total number of nodes;

[0080] According to the historical attack path data, obtain the risk scores R of each node included in each possible path i :

[0081] R i = ω6·cq i + ω7·vx i ;

[0082] where cq i represents the number of attacks that node i participated in during the historical collection period, and vx i represents the attribute abnormality frequency of the historical collection period node;

[0083] Subsequently, obtain the risk score R of each node i and the graph structure features (node connection relationships represented by the adjacency matrix A) as the input layer of the graph neural network;

[0084] Perform GNN feature extraction:

[0085] GCN layer:

[0086] GAT layer:

[0087] Among them, H GCN represents the node structure features extracted by the graph convolutional network (GCN), h j represents the relationship features of node j extracted by the graph attention network (GAT), σ represents the activation function, α ij represents the attention coefficient between node i and node j, W GAT and W GCN represent learnable weight matrices, N(i) represents the set of other nodes connected to node i, represents the normalized adjacency matrix;

[0088] Perform embedding fusion and risk calibration:

[0089] Z = σ(W1[H GCN ‖H GAT +W2R);

[0090] Perform risk score optimization:

[0091] R GNN = Softmax(W3Z);

[0092] Among them, Z is the fused node embedding vector, including structure, relationship, and initial risk score, H GAT represents the node relationship features extracted by the graph attention network (GAT), W1, W2, W3 represent learnable weight matrices, R GNN represents the optimized risk score;

[0093] Let the possible path be S = [S1, S2,..., S n , introduce the optimized risk score in each transfer step of the path S, multiply the transfer probability by the risk score of the current node, and obtain the prior probability of the path S:

[0094]

[0095] Based on the historical attack path data and the prior probabilities of each possible path, obtain the attack chain confidence of each possible path:

[0096]

[0097] Further, the process by which the risk assessment module updates the edge update interval of the log source to which other nodes belong according to the risk scores of other nodes except the abnormal nodes in the attack chain includes:

[0098] Obtain the value range of the risk scores, select threshold points within the value range to divide sub - intervals of different warning levels, obtain the warning levels of other nodes according to the risk scores of other nodes except the abnormal nodes in the attack chain, and preset an update response lookup table, where the update response lookup table includes the edge update intervals corresponding to different warning levels;

[0099] Update the edge update interval of the log source to which other nodes belong according to the warning levels of other nodes and the update response lookup table.

[0100] Compared with the prior art, the beneficial effects of the present invention are:

[0101] 1. The adaptive configuration module can collect the configuration attributes of the log source, analyze historical data to obtain the normal value range and threshold range of key indicators. Calculate the comprehensive load index through the current configuration attributes, and accordingly dynamically adjust the collection strategy to ensure that when the performance of the log source changes, the collection frequency and amount can be intelligently adapted, which not only ensures the acquisition of key log data but also avoids resource waste caused by over - collection, improving the pertinence and efficiency of log collection. For example, when the load of a certain log source is too high, the collection frequency is automatically reduced to prevent affecting the system performance.

[0102] 2. The log storage module constructs a double - area linked list composed of hot and cold memory page linked lists in virtual memory. The hot linked list stores active log data, and the cold linked list and physical memory store inactive data. When the log is called, the storage node position is dynamically adjusted according to the linked list position and the active test result. Effectively optimize memory usage, keep frequently called log data at the head of the hot linked list for quick access, and transfer inactive data to the cold linked list or physical memory in a timely manner, improving the log data call efficiency and reducing data reading latency.

[0103] 3. After pre - processing the log data such as word segmentation and part - of - speech tagging, the knowledge graph module constructs a knowledge graph using a named entity recognition model and a relationship extraction model. Preset the edge update interval of the log source and update the knowledge graph regularly. On the one hand, it can timely reflect the changes of entities and relationships in the log data, and on the other hand, it ensures a high degree of fit between the knowledge graph and the actual log information, providing an accurate and real - time data basis for subsequent anomaly detection and attack chain analysis.

[0104] 4. The attack chain matching module presets attack chain templates and traverses the knowledge graph from abnormal nodes to obtain possible paths. It uses historical attack path data to construct a probability transition matrix and node risk scores. Using a graph neural network to optimize the scores and modify the transition matrix, it calculates the path prior probability and attack chain confidence. This module accurately identifies the true attack chain, provides security personnel with clear attack path information, facilitates rapid response strategy development, and enhances the system's defense capabilities against attacks.

[0105] 5. The risk assessment module assigns warning levels based on the risk scores of healthy nodes in the attack chain and dynamically updates the log source edge update interval based on the update response comparison table. Log source update intervals are shortened in high-risk areas to ensure timely access to the latest log information, while intervals are appropriately extended in low-risk areas. This balances resource consumption with security monitoring needs, enabling refined management of system risks and improving overall security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0106] Figure 1 This is a schematic diagram of a cloud computing software log audit integrated management system according to an embodiment of the present application. DETAILED DESCRIPTION

[0107] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0108] like Figure 1 As shown, a cloud computing software log audit integrated management system includes a cloud, and the cloud is connected to an adaptive configuration module, a log collection module, a log storage module, an active testing module, a knowledge graph module, an anomaly detection module, an attack chain matching module and a risk assessment module;

[0109] The adaptive configuration module is used to collect configuration attributes of each log source and dynamically adjust the collection strategy of each log source according to the configuration attributes. The collection strategy includes the collection frequency and the number of log entries collected in a single time.

[0110] The log collection module is used to collect log data from various log sources in real time according to the configured collection strategy, mark the collection time, and set the collection cycle (one hour);

[0111] The log storage module is used to store collected log data, build a dual-region linked list in the virtual memory, and dynamically adjust the storage node position of the log data in the dual-region memory page linked list according to the log data storage link table position and the log data activity test results during the log data call process;

[0112] The active test module is used to perform active tests on log data;

[0113] The knowledge graph module is used to extract entities and relationships from log data, construct a knowledge graph, preset the edge update intervals of each log source, and dynamically update the knowledge graph according to the edge update intervals;

[0114] The anomaly detection module is used to perform real-time detection on each node in the knowledge graph and determine whether to generate an anomaly node according to the real-time detection results;

[0115] The attack chain matching module is used to obtain the attack chain of the anomaly node based on the knowledge graph and historical attack path data;

[0116] The risk assessment module is used to update the edge update intervals of the log sources to which other nodes belong according to the risk scores of other nodes except the anomaly nodes in the attack chain.

[0117] It should be further noted that in the specific implementation process, the process in which the adaptive configuration module dynamically adjusts the collection strategies of each log source according to the configuration attributes includes:

[0118] The configuration attributes include various types of key indicators. The various types of key indicators include CPU usage rate, memory usage rate, log generation rate, and concurrent operation count. Statistical analysis is performed on the configuration attributes of the log sources (including application servers, database servers, and network devices, etc.) in several historical collection cycles to obtain the normal value ranges of the various types of key indicators of the log sources in different time periods (the time period length is 1 minute). Threshold ranges for the various types of key indicators in different time periods are set according to the normal value ranges. The threshold ranges include low thresholds, normal thresholds, high thresholds, and danger thresholds;

[0119] Obtain the comprehensive load index according to the configuration attributes of the current time period. Set the comprehensive load threshold range according to the threshold ranges of the various types of key indicators in the current time period. The comprehensive load threshold range includes a low load threshold, a normal load threshold, a high load threshold, and a danger load threshold. Obtain the dynamic adjustment coefficient according to the comprehensive load index and the comprehensive load threshold range;

[0120] Dynamically adjust the collection strategies of the log sources according to the dynamic adjustment coefficient.

[0121] It should be further noted that in the specific implementation process, the process of dynamically adjusting the collection strategies of the log sources according to the dynamic adjustment coefficient of the current time period includes:

[0122] Normalize the various types of key indicators, and calculate the comprehensive load index L through weighted summation. The weight ω iAdjust according to business requirements:

[0123] L = ω1·CPU_norm + ω2·Mem_norm + ω3·Log_rate_norm + ω4·

[0124] Concurrency_norm;

[0125] Where ω1, ω2, ω3, and ω4 represent weights, CPU_norm represents the CPU usage rate after normalization, Mem_norm represents the memory usage rate after normalization, Log_rate_norm represents the log generation rate after normalization, and Concurrency_norm represents the number of concurrent operations after normalization;

[0126] Similarly, perform weighted summation calculations on the low threshold, normal threshold, high threshold, and danger threshold corresponding to each type of key indicator to obtain the low load threshold L included in the comprehensive load threshold range low , normal load threshold L normal , high load threshold L high , and danger load threshold L critical ;

[0127] Obtain the dynamic adjustment coefficient α based on the comprehensive load index and the comprehensive load threshold range to control the changes in the acquisition frequency and acquisition volume:

[0128]

[0129] Where k1 and k2 represent adjustment sensitivity coefficients;

[0130] Dynamically update the acquisition frequency according to the adjustment coefficient α:

[0131] F new = F base ·α;

[0132] Where F new represents the adjusted acquisition frequency, and F base represents the preset acquisition frequency;

[0133] Control the number of log entries collected in a single acquisition through the adjustment coefficient α:

[0134] Q new = Q base ·α;

[0135] Where Q new represents the adjusted number of log entries, and Q base represents the preset number of log entries;

[0136] When L > L critical , trigger the emergency strategy:

[0137] F new = 0;

[0138] Q new = Q min ;

[0139] Wherein, Q min is the minimum necessary acquisition amount (such as only recording error logs).

[0140] It should be further noted that in the specific implementation process, the log storage module stores log data, and the process of constructing a double-region linked list in virtual memory includes:

[0141] The log storage module includes virtual memory and physical memory (disk). A hot memory page linked list and a cold memory page linked list are constructed in the virtual memory, and the tail node of the hot memory page linked list is linked to the head node of the cold memory page linked list;

[0142] The hot memory page linked list is used to store log data that passes the active test, and the cold memory page linked list and the physical memory are used to store log data that fails the active test.

[0143] It should be further noted that in the specific implementation process, during the process of calling log data, the process of dynamically adjusting the storage node position of the log data in the double-region memory page linked list according to the linked list position where the log data is stored and the active test result of the log data includes:

[0144] When calling the log data of the log source, if the log data is stored in the physical memory, insert the log data into the head node of the cold memory page linked list. When the head node of the cold memory page linked list inserts the log data, transfer the log data stored in the tail node of the cold memory page linked list back to the physical memory;

[0145] If the log data is stored in the virtual memory, determine the linked list position where the log data is stored;

[0146] If the log data is stored in the hot memory page linked list, determine whether the log data is located at the head node of the hot memory page linked list. If the log data is not located at the head node of the hot memory page linked list, then call the log data to the head node of the hot memory page linked list;

[0147] If the log data is stored in the cold memory page linked list, conduct an active test on the log data. If the log data passes the active test, insert the log data from the cold memory page linked list into the head node of the hot memory page linked list, and demote the log data stored in the tail node of the hot memory page linked list to the head node of the cold memory page linked list;

[0148] If the log data fails the activity test, determine whether the log data is located at the head node of the cold memory page linked list. If the log data is not located at the head node of the cold memory page linked list, then call the log data to the head node of the cold memory page linked list.

[0149] In this embodiment, the significance of the linked list storage dynamic adjustment module for adjusting the position of data nodes is that if the log data of a log source is only called once and then transferred from the cold memory page linked list to the hot memory page linked list and is no longer called, this log data may cause the frequently called log data originally in the hot memory page linked list to be eliminated, thereby reducing the log data call efficiency. At the same time, when batch calling the log data of a certain log source, if these large amounts of log data will only be called once, then after they enter the hot memory page linked list, they will squeeze out a large number of frequently called log data in the hot memory page linked list. When these frequently called log data are called again, since the hot memory page linked list does not have these frequently called log data, it is necessary to read the frequently called log data from the cold memory page linked list or physical memory, and the computing performance of the system will drop sharply.

[0150] The present invention sets a threshold for inserting the log data called by the user into the hot memory page linked list and conducts an activity test, effectively ensuring that the frequently called log data in the hot memory page linked list will not be easily replaced. When the user batch reads log data, if these large amounts of log data will only be called once or do not meet the threshold for inserting into the hot memory page linked list, then these large amounts of log data will not enter the hot memory page linked list, and thus will not eliminate the frequently called log data, but will only stay in the cold memory page linked list and will soon be eliminated later, significantly improving the computing performance of the system.

[0151] It should be further noted that in the specific implementation process, the process of the activity test module for conducting an activity test on the log data includes:

[0152] Obtain the call count threshold and call interval threshold of the active memory page linked list;

[0153] Obtain the call record of the log data that needs to be subjected to the activity test, where the call record includes the data call time of the log data in the virtual memory each time;

[0154] Calculate the time difference between adjacent data call times to obtain the call interval, obtain the adjacent data call times with the corresponding call interval less than the call interval threshold, conduct statistical analysis on the adjacent data call times, obtain all different data call times included in the adjacent data call times, determine the total number of times of all different data call times, use the total number of times as the frequent call count, obtain the frequent call count, and compare the frequent call count with the call count threshold;

[0155] If the frequent call count is greater than or equal to the call count threshold, the log data passes the activity test. If the frequent call count is less than the call count threshold, the log data fails the activity test.

[0156] It should be further noted that in the specific implementation process, the knowledge graph module performs entity extraction and relationship extraction on the log data. The process of constructing the knowledge graph includes:

[0157] Call the log data of each log source from the log storage module, and perform preprocessing operations of word segmentation, sentence segmentation, and part-of-speech tagging on the log data;

[0158] Input the log data after preprocessing into a preset named entity recognition model for entity extraction to obtain a number of entities in the log data. The named entity recognition model is trained through a large number of labeled log data and can automatically recognize entities such as user IDs, server names, and vulnerabilities in the log data. Based on deep learning, a relationship extraction model is constructed, and a large number of entities are pre-labeled with relationships to obtain relationship sample data. Then, according to the relationship sample data, a preset deep learning neural network model is trained to obtain a trained relationship extraction model. Input the number of entities into the relationship extraction model for relationship extraction to obtain the semantic connection relationships between the number of entities. The semantic connection relationships include operation relationships (such as access, modification, etc.), dependency relationships, causal relationships, etc.;

[0159] Represent the number of entities and the semantic connection relationships between the number of entities as a graph data structure, with entities as nodes in the graph and semantic connection relationships as edges in the graph to construct a knowledge graph. Fill the extracted number of entities and the semantic connection relationships between the number of entities into the knowledge graph, and add corresponding attributes to the nodes and edges, such as the name and type of the entity, the occurrence time and detailed description of the relationship, etc.;

[0160] It should be further noted that in the specific implementation process, the edge update interval of each log source is preset. The process of dynamically updating the knowledge graph according to the edge update interval includes:

[0161] Preset the edge update interval of each log source. Regularly call the log data of each log source in the log storage module according to the edge update interval, and perform preprocessing operations of word segmentation, sentence segmentation, and part-of-speech tagging, entity extraction, and relationship extraction on the log data to obtain the entities included in the log data and the semantic connection relationships between the entities;

[0162] Match the entity and the semantic connection relationship between entities with the knowledge graph. If there are nodes in the knowledge graph that are consistent with the entity and edges that are consistent with the semantic connection relationship between the entities, update the attributes of the nodes in the knowledge graph that are consistent with the entity and the edges that are consistent with the semantic connection relationship between the entities according to the entity and the semantic connection relationship between the entities;

[0163] If there are no nodes in the knowledge graph that are consistent with the entity or no edges that are consistent with the semantic connection relationship between the entities, add, delete, and update the attributes of nodes or edges in the knowledge graph according to the entity or the semantic connection relationship between the entities. For newly emerged entities, add corresponding nodes to the knowledge graph; for entities that no longer exist or are no longer valid, delete the corresponding nodes from the knowledge graph. For newly discovered entity relationships, add corresponding edges to the knowledge graph; for relationships that have expired, delete the corresponding edges from the knowledge graph, and then update the attribute information of the nodes and edges, including the state changes of entities, the occurrence frequencies of relationships, etc.

[0164] It should be further noted that in the specific implementation process, the process of the anomaly detection module performing real-time detection on each node in the knowledge graph and determining whether to generate an abnormal node according to the real-time detection results includes:

[0165] Obtain the time series of various types of attribute values corresponding to the attributes of each node in the knowledge graph in a number of historical collection cycles and the time series of in-degree and out-degree, input the time series of various types of attribute values and the time series of in-degree and out-degree into a temporal convolutional neural network, and obtain the predicted sequences of various types of attribute values and the predicted sequences of in-degree and out-degree of each node in the current collection cycle according to the trained temporal convolutional neural network;

[0166] Compare the time series of various types of attribute values and the time series of in-degree and out-degree of each node in the current collection cycle with the predicted sequences of various types of attribute values and the predicted sequences of in-degree and out-degree respectively, obtain the multi-type attribute deviation values and in-degree and out-degree deviation values of each node, preset the multi-type attribute deviation threshold and the in-degree and out-degree deviation threshold. If there is a node whose multi-type attribute deviation value is greater than the multi-type attribute deviation threshold or the in-degree and out-degree deviation value is greater than the in-degree and out-degree deviation threshold, mark the node as an abnormal node, restrict the relevant permissions of the log source to which the abnormal node belongs, and then give an early warning of the attack path of the abnormal node.

[0167] Among them, the calculation formula for in-degree and out-degree is:

[0168] dr v =ω4·∑ u∈V edge(u→v)+ω5·∑ u∈V edge(v→u);

[0169] Among them, drv represents the in-degree of node v, ∑ u∈V edge(u→v) represents the number of edges pointing to node v, i.e., in-degree, ∑ u∈V edge(v→u) represents the number of edges from node v to other nodes, that is, the out-degree. V is the set of all nodes in the knowledge graph. ω4 and ω5 represent weight factors, which are adjusted according to the scenario. For example, malware nodes have high out-degree (infecting multiple hosts) and low in-degree (triggered by only a few vulnerability exploit nodes), so ω5 is higher than ω4; C2 server nodes have high in-degree (connected by multiple infected hosts) and low out-degree (controlling only specific hosts), so ω4 is higher than ω5; normal user nodes have low and stable in-degree and out-degree, so ω4 is approximately equal to ω5.

[0170]

[0171] Among them, S v Denotes the multi-type attribute deviation value of node v, D it Indicates the attribute value of the i-th type attribute at the t-th moment, DA it represents the predicted attribute value of the i-th type attribute at the t-th moment, dr vt Indicates the in-and-out degree of the i-th type attribute at time t, drA vt represents the in-and-out degree of node v at time t, drA vt It represents the predicted in-degree of node v at time t, n1 represents the total number of attribute types, and n2 represents the total number of moments in the time series.

[0172] The above formulas are all dimensionless and calculated numerically. The formula is a formula that is closest to the actual situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and preset thresholds in the formula are set by those skilled in the art based on actual conditions or obtained by simulating a large amount of data.

[0173] It should be further explained that, in the specific implementation process, the attack chain matching module obtains the attack chain of the abnormal node based on the knowledge graph and historical attack path data. The process includes:

[0174] Preset attack chain template, the attack chain template includes a stage sequence (defining the necessary steps of the attack chain, such as weaponization → delivery → exploitation → lateral movement), node attribute constraints (specific node attributes corresponding to each stage, such as vulnerability exploitation node → malware node → compromised host node), and relationship type constraints (connected by specific relationships between stages (such as use → infection → control), starting from the abnormal node, traversing the knowledge graph, and matching paths in the order of the attack chain template, including: node attribute matching: whether the current node belongs to the specific node attribute of a certain stage in the template; relationship type matching: whether the next node is connected by the relationship specified in the template; stage order constraint: the path must strictly follow the stage order of the template; obtaining all possible paths that match the attack chain template;

[0175] Obtain the historical attack path data of the knowledge graph, construct the probability transition matrix of each possible path according to the historical attack path data, as well as the risk scores of each node included in each possible path, optimize the risk scores of each node based on the graph neural network, and dynamically correct the probability transition matrix according to the optimized risk scores, and output the prior probabilities of each possible path;

[0176] Based on the historical attack path data and the prior probabilities of each possible path, obtain the attack chain confidence of each possible path, preset a confidence threshold, and mark the possible paths whose corresponding attack chain confidence is greater than the confidence threshold as attack chains.

[0177] It should be further noted that in the specific implementation process, the process of obtaining the attack chain confidence of each possible path includes:

[0178] According to the historical attack path data (such as attack chain logs), count the transfer times C from node i to node j i,j , then the transfer probability is defined as:

[0179]

[0180] where n represents the total number of nodes;

[0181] According to the historical attack path data, obtain the risk scores R of each node included in each possible path i :

[0182] R i = ω6·cq i + ω7·vx i ;

[0183] where cq i represents the number of attacks participated by node i during the historical collection period, and vx i represents the attribute anomaly frequency of the node during the historical collection period;

[0184] Subsequently, obtain the risk score R of each node i and the graph structure features (node connection relationships represented by the adjacency matrix A) as the input layer of the graph neural network;

[0185] Perform GNN feature extraction:

[0186] GCN layer:

[0187] GAT layer:

[0188] Among them, H GCN represents the node structure features extracted by the graph convolutional network (GCN), h j represents the relationship features of node j extracted by the graph attention network (GAT), σ represents the activation function, α ij represents the attention coefficient between node i and node j, W GAT and W GCN represent learnable weight matrices, N(i) represents the set of other nodes connected to node i, represents the normalized adjacency matrix;

[0189] Perform embedding fusion and risk calibration:

[0190] Z = σ(W1[H GCN ‖H GAT +W2R);

[0191] Perform risk score optimization:

[0192] R GNN = Softmax(W3Z);

[0193] Among them, Z is the fused node embedding vector, containing structure, relationship, and initial risk score, H GAT represents the node relationship features extracted by the graph attention network (GAT), W1, W2, W3 represent learnable weight matrices, R GNN represents the optimized risk score;

[0194] Let the possible path be S = [S1, S2,..., S n , introduce the optimized risk score in each transfer step of the path S, multiply the transfer probability by the risk score of the current node, and obtain the prior probability of the path S:

[0195]

[0196] Based on the historical attack path data and the prior probabilities of each possible path, obtain the attack chain confidence of each possible path:

[0197]

[0198]

[0199] It should be further noted that in the specific implementation process, the process of the risk assessment module updating the edge update interval of the log source to which other nodes belong according to the risk scores of other nodes except the abnormal nodes in the attack chain includes:

[0200] Obtain the value range of the risk scores, select threshold points within the value range to divide sub-intervals of different warning levels, obtain the warning levels of other nodes according to the risk scores of other nodes except the abnormal nodes in the attack chain, and preset an update response lookup table, where the update response lookup table includes the edge update intervals corresponding to different warning levels;

[0201] Update the edge update interval of the log source to which other nodes belong according to the warning levels of other nodes and the update response lookup table.

[0202] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical method of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A comprehensive management system for software log auditing in cloud computing, characterized in that, It includes a cloud, and the cloud is communicatively connected to an adaptive configuration module, a log collection module, a log storage module, an active test module, a knowledge graph module, an anomaly detection module, an attack chain matching module, and a risk assessment module; The adaptive configuration module is used to collect the configuration attributes of each log source and dynamically adjust the collection strategy of each log source according to the configuration attributes; The log collection module is used to collect log data from each log source in real time according to the configured collection strategy, mark the collection time, and set the collection period; The log storage module is used to store the collected log data, construct a double-region linked list in the virtual memory, and dynamically adjust the storage node position of the log data in the double-region memory page linked list according to the linked list position where the log data is stored and the active test result of the log data during the log data call process; The active test module is used to perform an active test on the log data; The knowledge graph module is used to perform entity extraction and relationship extraction on the log data, construct a knowledge graph, preset the edge update interval of each log source, and dynamically update the knowledge graph according to the edge update interval; The anomaly detection module is used to perform real-time detection on each node in the knowledge graph and determine whether an abnormal node is generated according to the real-time detection result; The attack chain matching module is used to obtain the attack chain of the abnormal node based on the knowledge graph and historical attack path data; The risk assessment module is used to update the edge update interval of the log source to which other nodes belong according to the risk scores of other nodes except the abnormal node in the attack chain.

2. The integrated management system for software log auditing of cloud computing according to claim 1, wherein, The process by which the adaptive configuration module dynamically adjusts the collection strategy of each log source according to the configuration attributes includes: The configuration attributes include various types of key indicators. Statistical analysis is performed on the configuration attributes of the log source in several historical collection periods to obtain the normal value range of various types of key indicators of the log source in different time periods, and the threshold range of various types of key indicators in different time periods is set according to the normal value range; Obtain the comprehensive load index according to the configuration attributes of the current time period, set the comprehensive load threshold range according to the threshold range of various types of key indicators in the current time period, and obtain the dynamic adjustment coefficient according to the comprehensive load index and the comprehensive load threshold range; Dynamically adjust the collection strategy of the log source according to the dynamic adjustment coefficient.

3. The integrated management system for software log auditing of cloud computing according to claim 2, wherein, The process by which the log storage module stores log data and constructs a double-region linked list in the virtual memory includes: The log storage module includes a virtual memory and a physical memory. A hot memory page linked list and a cold memory page linked list are constructed in the virtual memory, and the tail node of the hot memory page linked list is linked to the head node of the cold memory page linked list; The hot memory page linked list is used to store the log data that has passed the active test, and the cold memory page linked list and the physical memory are used to store the log data that has not passed the active test.

4. A comprehensive management system for software log auditing of cloud computing according to claim 3, characterized in that, The process of dynamically adjusting the storage node position of the log data in the double-region memory page linked list according to the linked list position where the log data is stored and the active test result of the log data during the log data call process includes: When calling the log data of the log source, if the log data is stored in physical memory, insert the log data into the head node of the cold memory page linked list. When inserting the log data into the head node of the cold memory page linked list, recall the log data stored in the tail node of the cold memory page linked list back to physical memory; If the log data is stored in virtual memory, determine the linked list position where the log data is stored; If the log data is stored in the hot memory page linked list, determine whether the log data is located at the head node of the hot memory page linked list. If the log data is not located at the head node of the hot memory page linked list, then call the log data to the head node of the hot memory page linked list; If the log data is stored in the cold memory page linked list, perform an activity test on the log data. If the log data passes the activity test, then insert the log data from the cold memory page linked list into the head node of the hot memory page linked list, and demote the log data stored in the tail node of the hot memory page linked list to the head node of the cold memory page linked list; If the log data fails the activity test, determine whether the log data is located at the head node of the cold memory page linked list. If the log data is not located at the head node of the cold memory page linked list, then call the log data to the head node of the cold memory page linked list.

5. The integrated management system for software log auditing of cloud computing according to claim 4, wherein The process of the activity test module performing an activity test on the log data includes: Obtain the call count threshold and call interval threshold of the active memory page linked list; Obtain the call records of the log data that needs to be subjected to the activity test, where the call records include the data call time of the log data in virtual memory each time; Calculate the time difference between adjacent data call times to obtain the call interval, obtain the adjacent data call times with the corresponding call interval less than the call interval threshold, perform statistical analysis on the adjacent data call times, obtain the frequent call count, and compare the frequent call count with the call count threshold; If the frequent call count is greater than or equal to the call count threshold, then the log data passes the activity test. If the frequent call count is less than the call count threshold, then the log data fails the activity test.

6. The integrated management system for software log auditing of cloud computing according to claim 5, wherein, The process of the knowledge graph module performing entity extraction and relationship extraction on the log data to construct a knowledge graph includes: Call the log data of each log source from the log storage module, and perform preprocessing operations such as word segmentation, sentence segmentation, and part-of-speech tagging on the log data; Input the preprocessed log data into a preset named entity recognition model for entity extraction to obtain several entities in the log data. Based on deep learning, construct a relationship extraction model, input the several entities into the relationship extraction model for relationship extraction, and obtain the semantic connection relationships between the several entities; Represent the several entities and the semantic connection relationships between the several entities as a graph data structure, with the entities as the nodes in the graph and the semantic connection relationships as the edges in the graph, construct a knowledge graph, fill the extracted several entities and the semantic connection relationships between the several entities into the knowledge graph, and add corresponding attributes to the nodes and edges.

7. The integrated management system for software log auditing of cloud computing according to claim 6, characterized in that, Preset the edge update interval of each log source. The process of dynamically updating the knowledge graph according to the edge update interval includes: Preset the edge update intervals for each log source, and regularly call the log data of each log source in the log storage module according to the edge update intervals. Perform preprocessing operations, entity extraction, and relationship extraction on the log data to obtain the entities included in the log data and the semantic connection relationships between the entities. Match the entities and the semantic connection relationships between the entities with the knowledge graph. If there are nodes in the knowledge graph that are the same as the entities and edges that are the same as the semantic connection relationships between the entities, update the attributes of the nodes in the knowledge graph that are the same as the entities and the edges that are the same as the semantic connection relationships between the entities according to the entities and the semantic connection relationships between the entities. If there are no nodes in the knowledge graph that are the same as the entities or no edges that are the same as the semantic connection relationships between the entities, add, delete nodes or edges to the knowledge graph according to the entities or the semantic connection relationships between the entities, and update the attributes.

8. The integrated management system for software log auditing of cloud computing according to claim 7, characterized in that, The process of the anomaly detection module performing real-time detection on each node in the knowledge graph and determining whether to generate an abnormal node according to the real-time detection results includes: Obtain the time series of various types of attribute values corresponding to the attributes of each node in the knowledge graph in a number of historical collection cycles and the in-degree and out-degree time series. Input the time series of various types of attribute values and the in-degree and out-degree time series into a temporal convolutional neural network, and obtain the predicted sequences of various types of attribute values and the in-degree and out-degree predicted sequences of each node in the current collection cycle according to the trained temporal convolutional neural network. Compare the time series of various types of attribute values and the in-degree and out-degree time series of each node in the current collection cycle with the predicted sequences of various types of attribute values and the in-degree and out-degree predicted sequences respectively to obtain the multi-type attribute deviation values and the in-degree and out-degree deviation values of each node. Preset the multi-type attribute deviation threshold and the in-degree and out-degree deviation threshold. If there is a node whose multi-type attribute deviation value is greater than the multi-type attribute deviation threshold or the in-degree and out-degree deviation value is greater than the in-degree and out-degree deviation threshold, mark the node as an abnormal node.

9. The integrated management system for software log auditing of cloud computing according to claim 8, characterized in that, The process of the attack chain matching module obtaining the attack chain of the abnormal node based on the knowledge graph and the historical attack path data includes: Preset the attack chain template, start from the abnormal node, traverse the knowledge graph, and obtain all possible paths that match the attack chain template. Obtain the historical attack path data of the knowledge graph, construct the probability transition matrix of each possible path according to the historical attack path data, and the risk scores of each node included in each possible path. Optimize the risk scores of each node based on a graph neural network, dynamically correct the probability transition matrix according to the optimized risk scores, and output the prior probabilities of each possible path. Based on the historical attack path data and the prior probabilities of each possible path, obtain the attack chain confidence of each possible path. Preset the confidence threshold, and mark the possible paths whose corresponding attack chain confidence is greater than the confidence threshold as attack chains.

10. The integrated management system for software log auditing of cloud computing according to claim 9, characterized in that, The process of the risk assessment module updating the edge update intervals of the log sources to which other nodes belong according to the risk scores of other nodes except the abnormal nodes in the attack chain includes: Obtain the value range of the risk score, select a threshold point within the value range to divide sub-intervals of different warning levels, and obtain the warning levels of other nodes based on the risk scores of other nodes except the abnormal nodes in the attack chain. Preset an update response table, and the update response table includes edge update intervals corresponding to different warning levels; Update the edge update intervals of the log sources to which other nodes belong according to the warning levels of other nodes and the update response table.

Images