Log data marking method and device

Abstract

The invention discloses a method and a device for marking log data, relates to the technical field of data processing, and mainly aims to reflect the change on the marking processing of the log data in time when an equipment label changes. According to the main technical scheme, log data to be marked are obtained according to a preset period; detecting whether a new marking strategy is obtained or not, wherein the marking strategy is used for recording an equipment label corresponding to the equipment identifier configured by the administrator; if yes, marking a corresponding equipment label for the log data according to an equipment identifier in the log data and a new marking strategy; and if not, analyzing the log data according to a preset rule, generating a new marking strategy, and marking a corresponding equipment label for the log data. The method and the device are used for marking the log data.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a log data marking method and device. Background Art

[0002] Log data records the procedural events generated by a device system. By analyzing this data, we can identify security issues that may exist during device operation. Similarly, by analyzing the log data of a device cluster, we can identify log data with security risks based on pre-set security policies. This data can then be traced back to the corresponding terminal device to identify any security risks.

[0003] At present, the common way to analyze and trace log data is to label the logs, that is, to mark the corresponding device tags for the log data so that the target device that generated the log data can be quickly located using the device tags. The determination of device tags generally requires pre-configuration to ensure the unique correspondence between the device tags and the terminal devices. However, with the expansion of device clusters and structural adjustments in device clusters, the device tags of a terminal often change continuously. For example, changes in the department to which the terminal belongs or changes in the number of members in the department where the terminal is located will cause changes in the device tag of the terminal. However, this change cannot be reflected in the labeling of log data in a timely manner, resulting in the inability to quickly locate the corresponding terminal device based on the device tags on the log data, increasing the security risks of its operation. Summary of the Invention

[0004] In view of the above problems, the present invention provides a log data labeling method and apparatus, the main purpose of which is to promptly reflect changes in device labels in the log data labeling process when such changes occur.

[0005] In order to solve the above technical problems, the present invention proposes the following solutions:

[0006] In a first aspect, the present invention provides a method for marking log data, the method comprising:

[0007] Obtain the log data to be marked according to the preset period;

[0008] Detect whether a new labeling strategy is obtained, where the labeling strategy is used to record the device tag corresponding to the device identifier configured by the administrator;

[0009] If yes, then label the log data with a corresponding device tag according to the device identifier in the log data and the new labeling strategy;

[0010] If not, the log data is analyzed according to preset rules, a new labeling strategy is generated, and the log data is marked with a corresponding device label.

[0011] In a second aspect, the present invention provides a log data marking device, the device comprising:

[0012] An acquisition unit, used for acquiring log data to be marked according to a preset period;

[0013] a detection unit, configured to detect whether a new labeling strategy has been acquired, wherein the labeling strategy is configured to record a device tag corresponding to a device identifier configured by an administrator;

[0014] a marking unit configured to mark the log data with a corresponding device tag according to the device identifier in the log data acquired by the acquisition unit and the new marking strategy if the detection unit detects a new marking strategy;

[0015] The analyzing unit is configured to analyze the log data acquired by the acquiring unit according to preset rules if the detecting unit does not detect the new labeling strategy, generate a new labeling strategy, and mark the log data with a corresponding device tag.

[0016] In order to achieve the above-mentioned purpose, according to the third aspect of the present invention, a storage medium is provided, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the log data marking method of the first aspect.

[0017] In order to achieve the above object, according to a fourth aspect of the present invention, a processor is provided, which is used to run a program, wherein the log data marking method of the first aspect is executed when the program is run.

[0018] By means of the above technical solution, the present invention provides a log data labeling method and device, which can use the latest labeling strategy to label the corresponding device label for the log data to be labeled, which helps to accurately locate the corresponding terminal device according to the device label on the log data. When the method is implemented, the system will obtain the log data to be labeled according to the preset period, and then detect whether a new labeling strategy is obtained. The labeling strategy is used to record the device label corresponding to the device identifier. If a new labeling strategy is obtained, the system can directly use the device identifier in the log data and the new labeling strategy to label the corresponding device label for the log data. In this way, the changes in the device label can be accurately reflected in the labeling processing of the log data using the new labeling strategy, which is convenient for subsequent terminal device positioning operations; when the new labeling strategy is not obtained, the system can also analyze the obtained log data according to the preset rules. Through analysis, the system can still obtain the new labeling strategy and mark the corresponding device label for the log data. It can be seen that no matter how the device label changes, the present invention can use the new labeling strategy to accurately reflect the change in the labeling processing of the log data, and then accurately locate the corresponding terminal device according to the device label on the log data, greatly reducing the security risks of the terminal device operation.

[0019] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0021] Figure 1 A flow chart of a log data marking method provided by an embodiment of the present invention is shown;

[0022] Figure 2 A flow chart of another log data marking method provided by an embodiment of the present invention is shown;

[0023] Figure 3 A block diagram showing the composition of a log data marking device provided by an embodiment of the present invention is shown;

[0024] Figure 4 A block diagram showing the composition of another log data marking device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0026] At present, when labeling logs, that is, when labeling the corresponding device labels for log data, it is necessary to pre-configure the device labels to ensure the unique correspondence between the device labels and the terminal devices. However, when the device cluster changes, resulting in changes in the terminal device labels or the marking requirements for the device labels are adjusted, and the correspondence is not adjusted in time, such changes cannot be reflected in the label markings of the log data, resulting in the inability to accurately locate the corresponding terminal device based on the device labels on the log data. Therefore, there is an urgent need for a method that can detect changes in device labels when labeling log data and reflect the changes in device labels on the log label markings, so as to accurately track and locate terminal devices.

[0027] To this end, an embodiment of the present invention provides a method for labeling log data, which is mainly implemented based on a log management system. When the system needs to label log data, if a new labeling strategy is detected, the log data can be labeled according to the new labeling strategy, so that the changes in device labels are reflected in the log label processing through the new labeling strategy. In addition, the system also has the ability to actively analyze log data. Even if a new labeling strategy is not detected, the system can generate a new labeling strategy based on the analysis results of the log data when labeling log data, and label the log data according to the new labeling strategy. This further ensures that when labeling log data, the system can reflect the changes in device labels in the log labeling process through the updated labeling strategy. That is, the label marked for the device by this method can be quickly and accurately located to the corresponding terminal device based on the log data, and its specific implementation steps are as follows. Figure 1 Shown, including:

[0028] 101. Obtain log data to be marked according to a preset period.

[0029] The purpose of labeling log data in this embodiment is to mark the log data with corresponding device tags, so that the log data can be analyzed to discover the security issues it has and trace the corresponding terminal device to indicate the security risks of the terminal device.

[0030] Generally, to reduce computing resource usage, log data processing and analysis isn't performed in real time. Instead, the generated log data is processed periodically. Therefore, this step involves acquiring log data to be labeled based on a preset period and tagging the log data with the corresponding device tag, facilitating subsequent analysis of the labeled log data within that preset period.

[0031] Among them, the preset period can be set manually by the administrator in the log management system, or it can be set automatically by the log management system. Regardless of whether it is set manually or automatically, when setting it, in addition to considering the storage space occupied by the log data generated by the terminal device within the preset period, it is also necessary to consider the statistical results of historical data and the processing capabilities of the log management system itself. That is, the setting of the preset period must take into account both user needs and the processing capabilities of the processing equipment itself, so as to ensure efficient processing of log data. Among them, the statistical results of historical data include but are not limited to: the period of terminal equipment with security risks obtained by analyzing and counting the marked historical log data, the number of periods corresponding to the log data used in the previous log analysis, etc.

[0032] 102. Check whether a new marking strategy is obtained.

[0033] The labeling strategy in this embodiment is mainly used to record the device tag corresponding to the device identifier, where the device identifier can uniquely correspond to the terminal device, and the device tag represents the relevant characteristics of the terminal device. In this embodiment, the type of device identifier used is not specifically limited. Any device identifier can be selected during the application process, and the device tag is mainly configured according to user needs. For the same terminal device, multiple device tags can be configured.

[0034] Among them, the marking strategy can be manually configured by the administrator directly in the system, or the administrator can preset a set of strategy generation mechanisms, and the system can automatically generate corresponding marking strategies based on the strategy generation mechanism.

[0035] This step can be processed sequentially with step 101 or in parallel. That is, the new marking strategy can be detected after the log data to be marked is obtained in step 101. Alternatively, the new marking strategy can be detected in real time.

[0036] In the first case, the new labeling strategy is detected after the log data to be labeled is obtained. Since the processing flow has sequential steps, it is more beneficial to save the processing resources of the log management system.

[0037] In this case, to prevent the log management system from continuously detecting new marking strategies when no new marking strategies are detected, thereby affecting work efficiency, a first detection time threshold can be set in the log management system. If the log management system has not detected a new marking strategy before the first detection time threshold is reached after obtaining the log data to be marked, the process can directly proceed to step 104. If a new marking strategy is detected within the first detection time threshold, the process proceeds to step 103.

[0038] In the second case, the log management system detects in real time whether a new labeling strategy has been acquired. During this detection, the system concurrently acquires the log data to be labeled according to a preset period. If a new labeling strategy is detected during this process, the system can directly proceed to step 103 to process the log data, eliminating the need for additional time and improving log data processing efficiency.

[0039] In the second case, although real-time detection is used, it is not ruled out that the new marking strategy may not have been detected at the time point when the log data is obtained. In this case, the second detection time threshold can be enabled. However, the second detection time threshold in this case is shorter than the first detection time threshold in the first case. If the new marking strategy has not been detected when the second detection time threshold is reached, the process proceeds to step 104; if the new marking strategy is detected when the second detection time threshold is reached, the process proceeds to step 103.

[0040] 103. According to the device identifier in the log data and the new labeling strategy, the log data is labeled with a corresponding device label.

[0041] In this step, if a new tagging strategy is detected, the device identifier in the log data can be matched with the device identifier in the new tagging strategy. This matching process determines the device identifier in the new tagging strategy that corresponds to the device identifier in the log data. The device tag corresponding to the matching device identifier is then searched for in the new tagging strategy and marked on the log data.

[0042] The device identifier can be a unique identifier carried by the terminal device, such as the device IP address, device serial number, etc. The device tag can be a pre-configured identifier that represents the device attributes, such as the unit to which the device belongs, the department to which the device belongs, the title of the person to whom the device belongs (e.g., team leader, team member), etc.

[0043] 104. Analyze the log data according to preset rules, generate a new labeling strategy, and mark the log data with corresponding device tags.

[0044] If no new marking strategy is detected in step 102, in this step, the log data may be analyzed according to preset rules to generate a new marking strategy.

[0045] In this step, the preset rules are data analysis methods set according to user needs before processing log data. Specifically, it can be to analyze the relationship between the device identification in the log data and the device identification in the current marking strategy; it can also be to obtain multiple marking strategies within a historical period, and then summarize the change rules between multiple marking strategies in chronological order. This embodiment does not make specific limitations on this.

[0046] It should be noted that the labeling strategy generated based on the preset rules in this step has relatively little change compared to the original labeling strategy. It is through manually set rules that changes in the correspondence between the device label and the device identifier can be discovered. Step 103 is mostly a situation where manual adjustment of the correspondence is required, which is generally a situation that cannot be discovered through regulations.

[0047] Based on the above Figure 1 It can be seen from the implementation method that the present invention provides a method for marking log data, which can mark the corresponding device label for the log data to be marked according to the new marking strategy. When the method is executed, the log data to be marked can be first obtained according to the preset period. Then it is detected whether the new marking strategy is obtained. In the case of obtaining a new marking strategy, the corresponding device label can be marked for the log data directly according to the device identifier in the log data and the new marking strategy, so that the change of the device label can be reflected in the label mark of the log through the new marking strategy; for the case where the new marking strategy is not obtained, the log management system can automatically analyze the log data to ensure that the change of the device label can still be found in the case of not obtaining a new marking strategy, and the change of the device label is reflected in the label mark of the log through the new marking strategy, so as to ensure that the corresponding terminal device can be accurately located according to the device label corresponding to the log, thereby reducing the security risk of the terminal device operation.

[0048] Furthermore, the preferred embodiment of the present invention is in the above Figure 1 Based on this, the log data marking method provided by the present invention is described in detail, and its specific steps are as follows Figure 2 Shown, including:

[0049] 201. Obtain log data to be marked according to a preset period.

[0050] In this embodiment, when setting the preset period, priority is given to the number of periods corresponding to the log data used in the previous log analysis in the statistical results of historical data. The preset period is determined based on the number of periods. In other words, the time period of the log data used in the previous log analysis is determined, and the preset period is obtained by performing statistics on the time period.

[0051] For example, the log data used in the previous log analysis are in the three time periods of July, August and September, so the preset period can be set to three months.

[0052] Among them, log analysis can be to perform data classification statistics based on the device tags corresponding to the labeled log data, etc.

[0053] 202. Check whether a new marking strategy is obtained.

[0054] In this embodiment, it is preferred to detect in real time whether the administrator has updated the tagging policy in the log management system. If the administrator has already detected a new tagging policy when the log data to be tagged is obtained, step 203 can be executed. If the administrator has not detected a new tagging policy when the log data to be tagged is obtained, the detection continues within a second detection time threshold. If no new tagging policy is detected when the second detection time threshold is reached, step 205 can be executed.

[0055] The log management system has a configuration interface for labeling strategies, where administrators can configure labeling strategies.

[0056] The configuration interface includes a device identification configuration box and a device label configuration box. Administrators can specify the corresponding relationship between the device identification configuration box and the device label configuration box. After specifying, the device label corresponding to the device identification in the labeling strategy is obtained.

[0057] This configuration box supports both manual input and drop-down selection modes. Administrators can add or delete any device identification configuration box or device label configuration box. They can also change the correspondence between any device identification configuration box and device label configuration box.

[0058] In order to cope with the situation where multiple terminal devices may correspond to the same set of device tags (for example, when the personnel belonging to multiple devices all belong to the same department), it is possible to support multiple device identification configuration boxes corresponding to one device tag configuration box.

[0059] In the drop-down selection mode, the administrator can pre-collect all the device identifiers of the terminal device and fill the device identifiers into the device identifier configuration box. During the application process, the administrator can select any device identifier from the drop-down options in the device identifier configuration box to complete the device identifier configuration. For the device label configuration box, the administrator can fill the required device label into the device label configuration box according to their own needs.

[0060] At the same time, the manual input mode and the drop-down selection mode also support joint use, that is, when the option to be selected does not exist in the drop-down box, the manual input mode can be used to complete it in the configuration box, so as to continuously enrich the configuration box.

[0061] Among them, the device tag can be in groups, that is, the same terminal device can correspond to multiple device tags, such as Company A and Department A.

[0062] 203. Verify the new marking strategy based on the log data to be marked.

[0063] Since the present invention periodically obtains the log data to be labeled, the amount of log data may be large. Therefore, the first device identifier in the new labeling strategy and the second device identifier of all log data in the period can be obtained. If the first device identifier can cover all the second device identifiers, it can be considered that all log data in the period can be matched to the same first device identifier in the new labeling strategy, which also means that according to the new labeling strategy, all log data in the period can be marked with corresponding device tags. If the new labeling strategy is verified, step 204 can be continued.

[0064] If the first device identifier doesn't cover all second device identifiers, it can be assumed that the second device identifiers for some log data may not match the corresponding first device identifiers. Failure to pass the new tagging policy verification means that the corresponding device tags for some log data cannot be marked according to the new tagging policy. In this case, a policy alarm message can be generated to prompt the administrator to adjust the new tagging policy so that the adjusted first device identifier can cover the second device identifier.

[0065] 204. Use the verified new marking strategy and the device identifier in the log data to mark the log data with a corresponding device tag.

[0066] In this step, if the new labeling strategy passes the verification, the first device identifier in the new labeling strategy can be matched with the second device identifier in the log data within the period to determine the first device identifier corresponding to the second device identifier of each log data in the new labeling strategy, and the device label corresponding to the matched first device identifier is searched in the new labeling strategy and marked on the corresponding log data.

[0067] For example, the second device identifier in some log data includes the IP address: [aaaa, bbbb, cccc]. The new labeling strategy includes the following correspondences between the first device identifier and the device tag: IP address: [aaaa, bbbb, dddd] - Company A: Department A: Team Member A, IP address: [aaaa, bbbb, cccc] - Company A: Department A: Team Member B. In this example, the IP address [aaaa, bbbb, cccc] in the new labeling strategy is the same as the IP address [aaaa, bbbb, cccc] in the log data. A search in the new labeling strategy reveals that the device tag corresponding to the IP address [aaaa, bbbb, cccc] is "Company A: Department A: Team Member B." Therefore, "Company A: Department A: Team Member B" can be labeled on the log data.

[0068] 205. Analyze the log data according to preset rules, generate a new labeling strategy, and mark the log data with corresponding device tags.

[0069] If the new tagging policy fails verification or the administrator's new tagging policy is not detected, since this embodiment prefers to tag log data with a single device identifier, this step can collect statistics on the device identifiers with the same attributes across all log data within a preset period to obtain a device identifier set. This device identifier set is then matched against the device identifiers in the current tagging policy, and based on the matching result, it is determined whether to adjust the correspondence between the device identifiers and device tags in the current tagging policy.

[0070] If the device identification set is the same as the device identification in the current labeling strategy, no adjustment is required, and the current labeling strategy can be used directly to mark the corresponding device tags for the log data.

[0071] If the device identification set is different from the device identification in the current marking strategy, the change state between the two can be further determined. The correspondence between the device identification and the device label in the current marking strategy is adjusted according to the change state, and a new marking strategy is generated based on the adjusted correspondence.

[0072] The change status includes the addition, subtraction, or modification of device identifiers. Specifically, the device identifier set consisting of device identifiers with the same attributes across all log data indicates whether it has been added or subtracted from the device identifiers in the current tagging strategy. The device identifiers in the log data are the device identifiers of the devices that generated the log data.

[0073] In the present invention, the device identifier of the same attribute is the device IP address. That is, in the present invention, the device IP address in the device identifier is preferably used to label the log data. The labeling strategy preferably configures a correspondence between the device IP address and the device label. The IP address in the log data is compared with the device IP address configured in the labeling strategy to determine the device label corresponding to the log data.

[0074] The reason why the device IP address is preferred for device identification is that the device IP address can most directly reflect the changes in the device cluster, and changes in the device cluster drive changes in the device label. For example:

[0075] Department A in Company A originally had three staff members, each with three corresponding terminal devices. A personnel adjustment within the department resulted in the addition of two new staff members and two corresponding terminal devices. These two terminal devices also had their own IP addresses and generated corresponding log data. Therefore, two new log files were added during the preset period of the personnel adjustment, resulting in the addition of two new IP addresses to the set of IP addresses used in the entire log data compared to the IP addresses in the current marking strategy.

[0076] Based on the above description, when the change status is a reduction in device identification, the corresponding relationship between the device identification and the device label in the current marking strategy can be deleted; if the device identification changes, the device label corresponding to the changed device identification can be determined, and the current marking strategy can be updated according to the device label corresponding to the changed device identification to obtain a new marking strategy; if the device identification is added, the device label corresponding to the newly added IP address can be determined, and the correspondence between the newly added IP address and the corresponding device label can be added to the current marking strategy to obtain a new marking strategy.

[0077] Determining the device label for a newly added IP address involves searching the current labeling strategy to see if there are device labels for IP addresses adjacent to the newly added IP address. Adjacent means that the IP addresses are partially identical. For example, the IP addresses corresponding to Department A and Department B of Company A may be identical.

[0078] If there is a device identifier of an IP address adjacent to the newly added IP address in the current labeling strategy, the device tag corresponding to the device identifier of the adjacent IP address can be searched in the current labeling strategy and determined as the device tag of the newly added IP address; if there is no device identifier of an IP address adjacent to the newly added IP address, a prompt message is generated to prompt the administrator to add the device tag corresponding to the newly added IP address.

[0079] Alternatively, if there are multiple IP addresses adjacent to the newly added IP address in the current tagging strategy, the device tag corresponding to each adjacent IP address can be obtained from the current tagging strategy. If multiple device tags have the same attribute type, the device tag with the largest number of device tags is selected as the device tag corresponding to the newly added IP address.

[0080] For example, in the current labeling strategy, the mapping between device IP addresses and device labels is as follows: [aaaa, bbbb, dddd] corresponds to Company A, Department A, Group A, and Team Leader; [aaaa, bbbb, cccc] corresponds to Company A, Department A, Group A, and Team Member; and [aaaa, bbbb, eeee] corresponds to Company A, Department A, Group A, and Team Member. The newly added device IP address is [aaaa, bbbb, ffff].

[0081] As can be seen, the current labeling strategy contains three IP addresses adjacent to the newly added IP address. These three adjacent IP addresses share the same attribute group: [aaaa, bbbb]. Furthermore, the device tags corresponding to these three adjacent IP addresses all have the same attribute group. The number of group members is 2, and the number of group leaders is 1. Therefore, group members account for a significant portion of the total number of group members. Therefore, Company A, Department A, Group A, and Group Member can be identified as the device tags corresponding to the newly added device IP address [aaaa, bbbb, ffff].

[0082] In addition, when the device identification is changed, a prompt message can be sent to the administrator so that the administrator can configure the device tag corresponding to the changed device identification in the configuration interface to obtain a new labeling strategy.

[0083] 206. Adjust the device labels of historical log data according to the new labeling strategy.

[0084] After obtaining a new marking strategy, you can retrieve the historical log data that has been marked within the preset historical period. For example, if the preset period is three months and the current month is October, then the current preset period is August, September, and October. The previous preset historical period was May, June, and July, so you can retrieve the historical log data for May, June, and July.

[0085] After obtaining the data, you can modify the historical log data according to the corresponding relationship in the new marking strategy. Of course, it is not necessary to modify only the data within the previous preset historical period. If there are modifications required for multiple preset historical periods, you can also refer to this method.

[0086] When making changes, the target historical log data can be searched for the target historical log data that has the device identifier specified in the new labeling strategy. The device identifier in the target historical log data is matched with the device identifier in the new labeling strategy, and the device label corresponding to the target historical log data is re-determined. This ensures that when a device label change is detected, the change can be reflected in the target historical log data through the new labeling strategy. If the target historical log data is subsequently analyzed, accurate analysis results can be obtained based on the device label of the target historical log data.

[0087] It should be noted that when the device label of the target historical log data is changed, a prompt message can be sent to the administrator to inform the administrator of the operation. At the same time, the administrator can also choose whether to terminate the modification based on the prompt.

[0088] Furthermore, as a response to the above Figure 1 In order to realize the method shown in the figure, the embodiment of the present invention also provides a log data marking device for marking the log data. Figure 1 This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not describe the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can implement all the contents of the aforementioned method embodiment. Figure 3 As shown, the device includes:

[0089] An acquisition unit 31 is configured to acquire log data to be marked according to a preset period;

[0090] A detection unit 32 is used to detect whether a new marking strategy is obtained, wherein the marking strategy is used to record the device tag corresponding to the device identifier configured by the administrator;

[0091] The marking unit 33 is configured to mark the log data with a corresponding device tag according to the device identifier in the log data obtained by the obtaining unit 31 and the new marking strategy if the detecting unit 32 detects a new marking strategy;

[0092] The analyzing unit 34 is configured to analyze the log data acquired by the acquiring unit 31 according to preset rules if the detecting unit 32 does not detect a new labeling strategy, generate a new labeling strategy, and mark the log data with a corresponding device tag.

[0093] Furthermore, as a response to the above Figure 2 In addition to the implementation of the method shown in the figure, the embodiment of the present invention also provides another log data marking device for marking the above Figure 2This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not describe the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can implement all the contents of the aforementioned method embodiment. Figure 4 As shown, the device includes:

[0094] An acquisition unit 31 is configured to acquire log data to be marked according to a preset period;

[0095] A detection unit 32 is used to detect whether a new marking strategy is obtained, wherein the marking strategy is used to record the device tag corresponding to the device identifier configured by the administrator;

[0096] The marking unit 33 is configured to mark the log data with a corresponding device tag according to the device identifier in the log data obtained by the obtaining unit 31 and the new marking strategy if the detecting unit 32 detects a new marking strategy;

[0097] The analyzing unit 34 is configured to analyze the log data acquired by the acquiring unit 31 according to preset rules if the detecting unit 32 does not detect a new labeling strategy, generate a new labeling strategy, and mark the log data with a corresponding device tag.

[0098] Further, such as Figure 4 As shown, the analysis unit 34 includes:

[0099] An identification statistics module 341 is configured to count the device identification sets contained in the log data, wherein each log data entry contains the device identification of the device that generated the log data;

[0100] The matching module 342 is configured to adjust the correspondence between the device identifier and the device tag in the current marking strategy according to the change state of the device identifier when the device identifier set obtained by the identifier statistics module 341 is inconsistent with the device identifier in the current marking strategy;

[0101] The strategy generation module 343 is configured to generate a new marking strategy based on the corresponding relationship adjusted by the matching module 342 .

[0102] Further, such as Figure 4 As shown, the change state in the matching module 342 includes at least the addition and reduction of the device identifier. The matching module 342 adjusts the correspondence between the device identifier and the device tag in the current marking strategy according to the change state of the device identifier, including:

[0103] The policy deletion submodule 3421 is configured to delete the corresponding relationship between the device identifier and the device tag in the current marking policy if the change state is a decrease in the device identifier;

[0104] The policy adjustment submodule 3422 is configured to determine the corresponding device tag according to the IP address of the newly added device tag if the change state is that the device tag is newly added, and to add the corresponding relationship between the newly added device tag and the corresponding device tag to the current tagging policy.

[0105] Further, such as Figure 4 As shown, the policy adjustment submodule 3422 determines the corresponding device tag according to the IP address of the newly added device identifier, specifically for:

[0106] Searching for a device identifier of an adjacent IP address in the current marking strategy based on the IP address;

[0107] If it exists, determining the device tag corresponding to the newly added device identifier according to the device tag corresponding to the device identifier;

[0108] If it does not exist, a prompt message is generated to prompt the administrator to add a corresponding device tag to the newly added device identifier.

[0109] Further, such as Figure 4 As shown, the policy adjustment submodule 3422 determines the device tag corresponding to the newly added device identifier based on the device tag corresponding to the device identifier, specifically for:

[0110] If there are multiple device identifiers with adjacent IP addresses, obtain the device label corresponding to each device identifier;

[0111] Determine whether there are multiple device tags with the same attribute type among the device tags corresponding to different device identifiers;

[0112] If so, the one with the largest number is selected from the multiple device tags as the device tag corresponding to the newly added device identifier.

[0113] Further, such as Figure 4 As shown, before the marking unit 33 performs the operation of marking the log data with the corresponding device tag according to the device identification in the log data and the new marking strategy, the apparatus further includes a verification unit 35, and the verification unit 35 includes:

[0114] The identification acquisition module 351 is used to obtain the first device identification in the new marking strategy and the second device identification in the log data;

[0115] A judging module 352 is configured to judge whether the first device identification obtained by the identification obtaining module 351 covers the second device identification;

[0116] The execution module 353 is configured to execute the marking operation of the log data if the judgment module 352 judges that the answer is yes;

[0117] The alarm module 354 is configured to generate a policy alarm message if the judgment module 352 judges that the policy is negative, so as to prompt the administrator to adjust the new marking policy.

[0118] Further, such as Figure 4 As shown, after the marking unit 33 marks the corresponding device tag for the log data according to the device identifier in the log data and the new marking strategy, the apparatus further includes a modification unit 36, and the modification unit 36 includes:

[0119] The data acquisition module 361 is used to acquire the marked historical log data within a preset historical period;

[0120] The label modification module 362 is used to search and modify the device label marked on the historical log data obtained by the data acquisition module 361 according to the updated corresponding relationship in the new labeling strategy.

[0121] Further, such as Figure 4 As shown, the apparatus further includes a determining unit 37, and the determining unit 37 includes:

[0122] The cycle statistics module 371 is used to count the number of cycles corresponding to the log data used in the previous log analysis;

[0123] The period determination module 372 is configured to determine the preset historical period according to the number of periods counted by the period statistics module 371 .

[0124] Furthermore, an embodiment of the present invention further provides a storage medium for storing a computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the above Figure 1-2 The log data labeling method described in .

[0125] Furthermore, an embodiment of the present invention further provides a processor, which is used to run a program, wherein the program executes the above-mentioned Figure 1-2 The log data labeling method described in .

[0126] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0127] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0128] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages can be utilized to realize the content of the present invention described herein, and the above description of specific languages is for the purpose of disclosing the best mode of the present invention.

[0130] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0131] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0136] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0137] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0139] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for marking log data, characterized in that: The method comprises: Obtain the log data to be marked according to the preset period; Detecting whether a new marking strategy is obtained, wherein the marking strategy is used to record a device tag corresponding to a device identifier; If yes, then label the log data with a corresponding device tag according to the device identifier in the log data and the new labeling strategy; If not, the log data is analyzed according to preset rules, a new labeling strategy is generated, and the log data is marked with a corresponding device label.

2. The method according to claim 1, characterized in that Analyze the log data according to preset rules and generate a new labeling strategy, including: According to the device identification set of the log data statistics, each log data contains the device identification of the device that generated the log data; When the device identification set is inconsistent with the device identification in the current marking strategy, adjusting the correspondence between the device identification and the device tag in the current marking strategy according to the change state of the device identification; Based on the adjusted correspondence, a new labeling strategy is generated.

3. The method according to claim 2, characterized in that The change state includes at least the addition and reduction of a device identifier, and adjusting the correspondence between the device identifier and the device tag in the current marking strategy according to the change state of the device identifier includes: If the change state is that the device identification is reduced, the corresponding relationship between the device identification and the device label in the current marking strategy is deleted; If the change state is that a device identifier is newly added, the corresponding device tag is determined according to the IP address of the newly added device identifier, and the corresponding relationship between the newly added device identifier and the corresponding device tag is added to the current marking strategy.

4. The method according to claim 3, characterized in that Determining the corresponding device tag according to the IP address of the newly added device identifier includes: Searching for a device identifier of an adjacent IP address in the current marking strategy based on the IP address; If it exists, determining the device tag corresponding to the newly added device identifier according to the device tag corresponding to the device identifier; If it does not exist, a prompt message is generated to prompt the administrator to add a corresponding device tag to the newly added device identifier.

5. The method according to claim 4, characterized in that Determining a device tag corresponding to a newly added device identifier according to the device tag corresponding to the device identifier includes: If there are multiple device identifiers with adjacent IP addresses, obtain the device label corresponding to each device identifier; Determine whether there are multiple device tags with the same attribute type among the device tags corresponding to different device identifiers; If so, the one with the largest number is selected from the multiple device tags as the device tag corresponding to the newly added device identifier.

6. The method according to claim 1, characterized in that Before performing the operation of marking the log data with a corresponding device tag according to the device identifier in the log data and the new tagging strategy, the method further includes: Obtaining a first device identifier in a new marking strategy and a second device identifier in the log data; Determining whether the first device identifier covers the second device identifier; If yes, then perform a marking operation on the log data; If not, a policy alarm message is generated to prompt the administrator to adjust the new marking policy.

7. The method according to claim 1, characterized in that After marking the log data with a corresponding device tag according to the device identifier in the log data and the new tagging strategy, the method further includes: Obtain the historical log data that has been marked within the preset historical period; According to the updated corresponding relationship in the new labeling strategy, the device label marked in the historical log data is searched and modified.

8. The method according to claim 7, characterized in that The method further comprises: Count the number of cycles corresponding to the log data used in the previous log analysis; The preset historical period is determined according to the number of periods.

9. A log data marking device, characterized in that: The device comprises: An acquisition unit, used for acquiring log data to be marked according to a preset period; a detection unit, configured to detect whether a new marking strategy has been acquired, wherein the marking strategy is configured to record a device tag corresponding to a device identifier; a marking unit configured to mark the log data with a corresponding device tag according to the device identifier in the log data acquired by the acquisition unit and the new marking strategy if the detection unit detects a new marking strategy; The analyzing unit is configured to analyze the log data acquired by the acquiring unit according to preset rules if the detecting unit does not detect the new labeling strategy, generate a new labeling strategy, and mark the log data with a corresponding device tag.

10. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the log data marking method according to any one of claims 1 to 8.

11. A processor, characterized in that: The processor is configured to run a program, wherein the program, when running, executes the log data marking method according to any one of claims 1 to 8.

Images