Training method and device of log detection model, equipment and storage medium

Abstract

The invention provides a log detection model training method, apparatus and device, and a computer readable storage medium. The method comprises the steps of obtaining a log uploaded by a target business file; based on a preset log analysis rule, analyzing the log to obtain log feature information at least comprising script features; determining a training sample according to the log feature information; and training a preset log detection model according to the training sample to obtain a target log detection model. The training efficiency and training effect of the log detection model can be improved, the method can be applied to business scenes such as financial science and technology or medical health, the risk of leakage of privacy data such as financial business data or medical business data can be reduced through the target log detection model obtained through training, and the user experience is improved. Therefore, the security of the financial business data or the medical business data is ensured.

Description

Technical Field

[0001] The present application relates to the technical field of log detection, and in particular to a training method, apparatus, device, and storage medium for a log detection model. Background Art

[0002] In the financial or medical fields, organizations often have local area networks (LANs) equipped with corresponding business databases to store sensitive data such as personal customer information. To prevent data leaks, related technologies use bastion hosts to protect the network from intrusion and data from tampering. However, some technicians can access business databases within production environments by sending business files to the bastion host or other terminals. This is typically accomplished by monitoring the bastion host and configuring its business file processing logic to prevent the execution of high-risk business files. Other methods analyze business file logs to determine whether the files are executable. However, these log detection methods lack sufficient accuracy in analyzing log features, which can easily lead to incorrect identification or missed identification of high-risk business files. Summary of the Invention

[0003] The present application provides a log detection model training method, apparatus, device and computer-readable storage medium, aiming to improve the training efficiency of the log detection model and improve the log detection accuracy of the target log detection model obtained after training.

[0004] In a first aspect, the present application provides a method for training a log detection model, the method comprising the following steps:

[0005] Get the log of target business file upload;

[0006] Parsing the log based on a preset log parsing rule to obtain log feature information including at least script features;

[0007] Determining a training sample based on the log feature information;

[0008] The preset log detection model is trained according to the training samples to obtain a target log detection model.

[0009] In a second aspect, the present application further provides a training device for a log detection model, the training device for the log detection model comprising:

[0010] Log acquisition module, which obtains the log of target business file upload;

[0011] A log parsing module, which parses the log based on preset log parsing rules to obtain log feature information including at least script features;

[0012] A training sample determination module, which determines a training sample according to the log feature information;

[0013] The model training module trains the preset log detection model according to the training samples to obtain the target log detection model.

[0014] In a third aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the training method of the log detection model as described above are implemented.

[0015] In a fourth aspect, the present application also provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the training method of the log detection model as described above are implemented.

[0016] The present application provides a training method, apparatus, device and computer-readable storage medium for a log detection model. The present application obtains a log uploaded by a target business file; and parses the log based on preset log rules to obtain log feature information including at least script features, and determines training samples based on the log feature information such as the script features, so as to train the preset log detection model with the training samples, thereby obtaining a trained target log detection model. By training the model with the log feature information such as the script features, the target log detection model can improve its recognition accuracy for business files with abnormal scripts, thereby avoiding the transmission and execution of high-risk business files. In addition, the training is based on the log feature information, and the amount of training data is small, which can improve the training efficiency of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 A flow chart of a method for training a log detection model provided in an embodiment of the present application;

[0019] Figure 2 This is a diagram of an application scenario of a log detection model provided in one embodiment of the present application;

[0020] Figure 3 A schematic block diagram of a log detection model training device provided in an embodiment of the present application;

[0021] Figure 4 This is a schematic block diagram of the structure of a computer device involved in one embodiment of the present application.

[0022] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0024] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined, or partially merged, so the actual execution order may vary depending on the actual situation.

[0025] Embodiments of the present application provide a method, apparatus, computer device, and computer-readable storage medium for training a log detection model. The log detection model training method can be applied to a terminal device, such as a tablet computer, laptop computer, or desktop computer. The log detection model training method can also be applied to a server, such as a cloud server or a cluster server.

[0026] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0027] Please refer to Figure 1 , Figure 1 A flowchart of a method for training a log detection model provided in an embodiment of the present application.

[0028] like Figure 1 As shown, the training method of the log detection model includes steps S101 to S104.

[0029] Step S101: Obtain the log of target business file upload.

[0030] Exemplarily, the target business files include, but are not limited to, high-risk business files, modified business files, automatically generated business files, commonly used business files, etc. After processing the target business files in a secure environment, corresponding logs can be obtained. In some embodiments, the target business files include email sending and receiving instructions. For example, in the medical field, doctors can send diagnosis results and / or medical advice to patients via email, or make diagnosis appointments via email, etc.; in the financial field, the target business files can include the sending and receiving of insurance policies, the collection or storage of customer information, the sending and receiving or storage of insurance reporting materials, etc., wherein, when processing the above data, some important business data, such as customer personal information and patient personal information, etc., will be involved; therefore, by analyzing the logs of these target business files to determine the security of the target business files, and using the logs corresponding to these target business files for training, the accuracy of the trained target log detection model in identifying abnormal business files can be improved, thereby avoiding the leakage of business data and reducing the risk of data tampering, thereby ensuring the integrity and security of business data.

[0031] Step S102: parsing the log based on preset log parsing rules to obtain log feature information including at least script features.

[0032] Exemplarily, the pre-set log parsing rules include obtaining business file names from logs, parsing the logs based on the business file names, and establishing features to obtain at least log feature information including script features. It should be understood that script features can be used to determine the execution characteristics of business files and signs of file modification. Therefore, by using script features for model training, the resulting target log detection model can detect the execution characteristics of business files and the risk of tampering, thereby ensuring data security.

[0033] In some embodiments, log feature information also includes semantic features, file type features, and basic information features, etc. The above features can also be obtained during the log parsing process. This application does not limit other features obtained by parsing the log. Technical personnel can adjust the log feature information obtained by parsing according to the actual model training requirements.

[0034] Step S103: Determine a training sample based on the log feature information.

[0035] Exemplarily, after obtaining the log feature information, a training sample for model training is determined according to the log feature information; and the training sample is input into a preset log detection model to train the preset log detection model.

[0036] In some embodiments, different logs are divided into multiple training samples based on log feature information, and a preset log detection model is trained using different training samples. It should be understood that when using multiple training samples for training, different training samples can be input one by one for training, or different training samples can be input simultaneously for training, and this application is not limited to this.

[0037] Step S104: training a preset log detection model according to the training samples to obtain a target log detection model.

[0038] Exemplarily, the training samples are input into a preset log detection model to train the preset log detection model, thereby obtaining a target log detection model for detecting logs of business files.

[0039] In some embodiments, the preset log detection model includes but is not limited to a model constructed based on a logistic regression network and a model constructed based on a support vector machine (SVM) network. The trained target log detection model can perform logical judgment on the input log to determine whether it is an abnormal log, and then determine the risk of the business file, so as to avoid the execution of risky business files and achieve the effect of protecting network and data security.

[0040] In some embodiments, determining the training sample based on the log feature information includes: determining the log whose log feature information meets the preset feature conditions as the first training sample, and determining the log whose log feature information does not meet the preset feature conditions as the second training sample; training the preset log detection model based on the training samples includes: training the preset log detection model based on the first training sample and the second training sample.

[0041] Exemplarily, it is determined whether the log feature information meets the preset feature conditions, and the log whose log feature information meets the preset feature conditions is determined as the first training sample, and the log whose log feature information does not meet the preset feature conditions is determined as the second training sample; it should be understood that the first training sample is a black sample and the second training sample is a white sample, so that the preset log detection model is trained using two training samples.

[0042] In some embodiments, before determining the log whose log feature information meets the preset feature condition as the first training sample, the method further includes: determining whether the log feature information meets the preset feature condition according to a script feature in the log feature information.

[0043] For example, if the log feature information includes a script feature, the script feature is used to determine whether the log feature information meets the preset feature condition. In other embodiments, if the log feature information also includes other features, the script feature and at least one of the other features may be used to determine whether the log feature information meets the preset feature condition. This application does not limit the number of features involved in determining whether the preset feature condition is met.

[0044] In some embodiments, determining whether the log feature information meets the preset feature conditions based on the script features in the log feature information includes: determining whether the log feature information meets the preset feature conditions based on at least one of the business type features, file type features and semantic features in the log feature information, and the script features.

[0045] For example, the log feature information includes at least one of a business type feature, a file type feature, and a semantic feature. When determining whether the log feature information meets the preset feature condition, it can be determined by the script feature and the at least one of the above features.

[0046] Exemplarily, business type features, file type features and semantic features are all obtained by parsing the file name; the business type features are obtained by parsing the first paragraph of the file name, and the business type features are determined by comparing the keywords extracted from the first paragraph with the preset business keywords; the file type features are obtained by parsing the second paragraph of the file name, wherein the end of the second paragraph is the end position of the file name, and the second paragraph is, for example, the suffix of the file name, so as to determine the file type of the business file according to the suffix of the file name, such as when it is determined that the suffix of the file name includes keywords such as exe, jar, etc., the business file is determined to be an executable file type; the semantic features are to determine the semantics present in the entire file name. Specifically, the semantic features also include continuity features, such as if a phrase or letters are arranged continuously, the continuously arranged phrases and / or letters are determined to be continuity features; the common word quantity feature, the target word proportion feature and the semantic proportion feature are used to determine whether the log feature information meets the preset feature conditions, which can improve the accuracy of the conditional judgment and thus improve the accuracy of the training samples.

[0047] In other embodiments, the preset feature condition includes multiple sub-conditions, and the training samples of the log corresponding to the target log feature information can be determined based on whether the log feature information meets the sub-conditions and the number of sub-conditions that meet the sub-conditions, thereby improving the diversity of the training samples and further improving the robustness of the model. For example, the preset feature condition includes sub-condition A, sub-condition B, and sub-condition C; the log feature information of log a meets all sub-conditions, the log feature information of log b meets sub-condition A and sub-condition B, and the log feature information of log c meets sub-condition B and sub-condition C. It can be seen that the log feature information of log a meets all the preset feature conditions, and the log feature information of logs b and log c partially meet the preset feature conditions; therefore, in the process of determining the training samples based on the log feature information, log a, log b, and log c can also be assigned to different training samples to increase the diversity of the training samples. It should be noted that those skilled in the art can adjust the number of logs, the number of sub-conditions set in the preset feature condition, and the specific setting content of the sub-conditions according to the actual use requirements of the target log detection model and the diversity of the logs to be analyzed, and this application is not limited thereto.

[0048] In some embodiments, determining whether the log feature information meets the preset feature condition based on the script feature in the log feature information includes: when the first similarity between the script execution file feature in the script feature and the preset script execution file feature is greater than or equal to a preset first similarity threshold, determining that the log feature information corresponding to the script feature meets the preset feature condition; and / or when the second similarity between the script symbol feature in the script feature and the preset script symbol feature is greater than or equal to a preset second similarity threshold, determining that the log feature information corresponding to the script feature meets the preset feature condition.

[0049] For example, by determining whether the script feature has a high-risk problem through the first similarity between the script execution file feature in the script feature and the preset script execution file feature, and by determining the second similarity between the script symbol feature in the script feature and the preset script symbol feature, it is determined whether the script feature has a high-risk problem, thereby determining whether its corresponding log feature information meets the preset feature conditions. Among them, the script execution file feature includes but is not limited to keywords such as py, groovy, and the script symbol feature includes but is not limited to special symbols often introduced by technicians when setting up scripts. In other embodiments, it is also possible to determine whether the script feature has a risk through the number of script symbol features, and then determine whether the log feature information meets the preset feature conditions.

[0050] Exemplarily, when the first similarity is greater than or equal to the preset first similarity threshold, or the second similarity is greater than or equal to the second similarity threshold, it is determined that the log feature information corresponding to the script feature meets the preset feature conditions; and when the first similarity is less than the preset first similarity threshold, and the second similarity is less than the second similarity threshold, it is determined that the log feature information corresponding to the script feature does not meet the preset feature conditions.

[0051] In some embodiments, the preset log detection model is trained based on the training sample to obtain a target log detection model, including: inputting the training sample into the preset log detection model to obtain a detection result output by the preset log detection model; determining the labeling result corresponding to the training sample; determining the loss value of the preset log detection model based on the detection result and the labeling result, and adjusting the parameters of the preset log detection model based on the loss value to obtain the target log detection model.

[0052] Exemplarily, after determining the training samples, the training samples are labeled to obtain labeling results corresponding to each training sample; the training samples are input into a preset log detection model to obtain the detection results output by the preset log detection model; then, based on the labeling results of the training samples and the corresponding detection results, the loss value of the preset log detection model is determined, and then the parameters of the preset log detection model are adjusted to obtain the target log detection model. In some embodiments, the training samples are input into a sample labeling model to obtain labeling results corresponding to the training samples, so that the preset log detection model can be adjusted based on the labeling results and the detection results corresponding to the training samples output from the preset log detection model.

[0053] The log detection model training method provided in the above embodiment obtains the log uploaded by the target business file; and parses the log based on the preset log rules to obtain log feature information including at least script features, and determines the training samples based on the log feature information such as the script features, so as to train the preset log detection model through the training samples, and then obtain the trained target log detection model. By training the model with the log feature information such as the script features, the recognition accuracy of the target log detection model for business files of abnormal scripts can be improved, thereby avoiding the transmission and execution of high-risk business files. In addition, the training is based on the log feature information, and the amount of training data is small, which can improve the training efficiency of the model.

[0054] In some embodiments, the method further includes: obtaining a log of a business file to be processed; determining the status of the log based on the target log detection model; determining the business file to be processed corresponding to the log with a normal status as a first business file, and determining the business file to be processed corresponding to the log with an abnormal status as a second business file; transmitting the first business file to a business file execution module to execute the first business file.

[0055] Exemplarily, after obtaining the target log detection model, the target log detection model can be configured in the corresponding server or terminal to determine whether the log is abnormal when the log of the business file to be processed is obtained, and the business file to be processed corresponding to the normal log is determined as the first business file, and the business file to be processed corresponding to the abnormal log is determined as the second business file, and the first business file is transmitted to the business file execution module to execute the first business file; and the second business file can be returned or eliminated and error information can be fed back according to the original channel.

[0056] For example, the target log detection model is configured in a server in the medical field. Specifically, the log detection model is configured on the bastion host in the hospital network. Figure 2 , Figure 2 An application scenario diagram of the log detection model provided for an embodiment of the present application. For example, a patient edits and generates medical inquiry information on a first terminal, and uses the first terminal to send the medical inquiry information to a second terminal used by a doctor, wherein the second terminal is connected to the hospital network, so that the second terminal can obtain patient information databases, drug information databases and other databases connected to the hospital network; before the second terminal receives the medical inquiry information, the server obtains the medical inquiry information receiving service, wherein the medical inquiry information receiving service is generated according to the medical inquiry information; and through the target log detection model configured on the server, the log corresponding to the medical inquiry information receiving service is detected; if the first terminal has not been cracked, has no risk itself, and has not been intercepted or modified during information transmission, then the medical inquiry information generated according to the medical inquiry information is detected. The script features of the information receiving service meet the requirements, making the log normal, so that the medical consultation information receiving service can be determined as the first service file, and it is transmitted to the second terminal so that the second terminal executes the medical consultation information reception; if the first terminal is cracked or modified during the information transmission process, and the medical consultation information function is modified, other information may be introduced in the script features, so that the medical consultation information can be stolen after entering the hospital network; at this time, when detected by the target log detection model, the target log detection model can detect the modified script features, thereby determining that the log is in an abnormal state; and then denying access to the service, avoiding the risk of patient data leakage and tampering.

[0057] For example, the configuration of the target log detection model in a server in the financial field is used as an example to illustrate. For example, similar to the above process, if the information receiving terminal is located in an internal LAN, and the internal LAN can access sensitive databases such as insurance policy databases, then the target log detection model can be configured on a server in the network, such as a bastion host, and before receiving the information, the information receiving service is detected. If the log corresponding to the information receiving service is normal, the information receiving service is transmitted to the information receiving terminal so that it executes the information reception; if the log corresponding to the information receiving service is abnormal, a rejection instruction is returned so that the information receiving terminal does not receive the information, so as to avoid the information being able to access and modify the database of the internal LAN after receiving the information, thereby causing the leakage and modification of sensitive data such as insurance policies.

[0058] For example, the target log detection model obtained through training can detect the logs of the business files to be processed and promptly identify high-risk business files, thereby avoiding the execution of high-risk business files, and further achieving the effects of protecting the integrity of business data and improving the security of business data.

[0059] See also Figure 3 , Figure 3 This is a schematic diagram of a log detection model training device provided in an embodiment of the present application. The log detection model training device can be configured in a server or a terminal to execute the aforementioned log detection model training method.

[0060] like Figure 3 As shown, the training device 100 for the log detection model includes: a log acquisition module 110, a log parsing module 120, a training sample determination module 130, and a model training module 140.

[0061] The log acquisition module 110 is used to obtain the log of the target business file upload;

[0062] The log parsing module 120 is configured to parse the log based on preset log parsing rules to obtain log feature information including at least script features;

[0063] A training sample determination module 130 is configured to determine a training sample based on the log feature information;

[0064] The model training module 140 is used to train the preset log detection model according to the training samples to obtain a target log detection model.

[0065] Exemplarily, the training sample determination module 130 is also used to determine the log whose log feature information meets the preset feature conditions as the first training sample, and to determine the log whose log feature information does not meet the preset feature conditions as the second training sample; the model training module 140 is also used to train the preset log detection model based on the first training sample and the second training sample.

[0066] Exemplarily, the log detection model training device 100 further includes a feature condition determination module.

[0067] The feature condition determination module is used to determine whether the log feature information meets the preset feature condition according to the script feature in the log feature information.

[0068] Exemplarily, the feature condition determination module is also used to determine that the log feature information corresponding to the script feature meets the preset feature condition when the first similarity between the script execution file feature in the script feature and the preset script execution file feature is greater than or equal to a preset first similarity threshold; and / or to determine that the log feature information corresponding to the script feature meets the preset feature condition when the second similarity between the script symbol feature in the script feature and the preset script symbol feature is greater than or equal to a preset second similarity threshold.

[0069] Exemplarily, the feature condition determination module is further configured to determine whether the log feature information meets the preset feature condition based on at least one of the business type feature, file type feature, and semantic feature in the log feature information, and the script feature.

[0070] Exemplarily, the model training module 140 includes a detection result acquisition submodule, a labeling result determination submodule, and a model parameter adjustment submodule.

[0071] The detection result acquisition submodule is used to input the training sample into the preset log detection model to obtain the detection result output by the preset log detection model.

[0072] The labeling result determination submodule is used to determine the labeling result corresponding to the training sample.

[0073] The model parameter adjustment submodule is used to determine the loss value of the preset log detection model according to the detection result and the annotation result, and adjust the parameters of the preset log detection model according to the loss value to obtain a target log detection model.

[0074] Exemplarily, the training device 100 for the log detection model includes a log acquisition submodule, a log status determination submodule, a business file determination submodule, and a business file processing submodule.

[0075] The log acquisition submodule is used to obtain the logs of the business files to be processed.

[0076] The log status determination submodule is used to determine the status of the log based on the target log detection model.

[0077] The business file determination submodule is configured to determine the business file to be processed corresponding to the log in the normal state as the first business file, and to determine the business file to be processed corresponding to the log in the abnormal state as the second business file.

[0078] The business file processing submodule is used to transfer the first business file to the business file execution module to execute the first business file.

[0079] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0080] See also Figure 4 , Figure 4 This is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application. The computer device can be a server or a terminal.

[0081] like Figure 4 As shown, the computer device includes a processor, a memory, and a network interface connected via a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0082] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions that, when executed, enable the processor to perform any of the log detection model training methods.

[0083] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0084] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any training method of the log detection model.

[0085] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0086] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0087] In one embodiment, the processor is configured to execute a computer program stored in the memory to implement the following steps:

[0088] Get the log of target business file upload;

[0089] Parsing the log based on a preset log parsing rule to obtain log feature information including at least script features;

[0090] Determining a training sample based on the log feature information;

[0091] The preset log detection model is trained according to the training samples to obtain a target log detection model.

[0092] In one embodiment, when determining the training sample according to the log feature information, the processor is configured to implement:

[0093] Determine the log whose log characteristic information meets the preset characteristic condition as a first training sample, and determine the log whose log characteristic information does not meet the preset characteristic condition as a second training sample;

[0094] When the processor trains the preset log detection model according to the training sample, it is configured to implement:

[0095] The preset log detection model is trained according to the first training sample and the second training sample.

[0096] In one embodiment, before determining the log whose log feature information meets the preset feature condition as the first training sample, the processor is configured to implement:

[0097] Determine whether the log characteristic information meets the preset characteristic condition according to the script characteristic in the log characteristic information.

[0098] In one embodiment, when determining whether the log characteristic information meets the preset characteristic condition based on the script characteristic in the log characteristic information, the processor is configured to implement:

[0099] If a first similarity between a script execution file feature in the script feature and a preset script execution file feature is greater than or equal to a preset first similarity threshold, determining that the log feature information corresponding to the script feature meets the preset feature condition; and / or

[0100] When the second similarity between the script symbol feature in the script feature and the preset script symbol feature is greater than or equal to a preset second similarity threshold, it is determined that the log feature information corresponding to the script feature meets the preset feature condition.

[0101] In one embodiment, when determining whether the log characteristic information meets the preset characteristic condition based on the script characteristic in the log characteristic information, the processor is configured to implement:

[0102] Determine whether the log feature information meets the preset feature condition according to at least one of the business type feature, the file type feature, and the semantic feature in the log feature information, and the script feature.

[0103] In one embodiment, when the processor trains the preset log detection model according to the training sample to obtain the target log detection model, it is configured to implement:

[0104] Inputting the training sample into the preset log detection model to obtain a detection result output by the preset log detection model;

[0105] Determining a labeling result corresponding to the training sample;

[0106] The loss value of the preset log detection model is determined according to the detection result and the annotation result, and the parameters of the preset log detection model are adjusted according to the loss value to obtain a target log detection model.

[0107] In one embodiment, when implementing the log detection model training method, the processor is further configured to implement:

[0108] Get the log of pending business documents;

[0109] Determining a status of the log based on the target log detection model;

[0110] Determine the to-be-processed business file corresponding to the log in the normal state as the first business file, and determine the to-be-processed business file corresponding to the log in the abnormal state as the second business file;

[0111] The first business file is transmitted to a business file execution module to execute the first business file.

[0112] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working process of the above-mentioned training of the log detection model can refer to the corresponding process in the aforementioned log detection model training method embodiment, and will not be repeated here.

[0113] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the training method of the log detection model of the present application.

[0114] The computer-readable storage medium may be an internal storage unit of the computer device described in the aforementioned embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a SmartMedia Card (SMC), a Secure Digital (SD) card, a flash memory card, etc., equipped on the computer device.

[0115] It should be understood that the terms used in this specification are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0116] It should also be understood that the term "and / or" used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system that includes a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also includes elements that are inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system that includes the element.

[0117] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments. The above description is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for training a log detection model, characterized in that: include: Get the log of target business file upload; Parsing the log based on a preset log parsing rule to obtain log feature information including at least script features; Determining a training sample based on the log feature information; The preset log detection model is trained according to the training samples to obtain a target log detection model.

2. The method for training a log detection model according to claim 1, wherein: The determining of the training sample according to the log feature information includes: Determine the log whose log characteristic information meets the preset characteristic condition as a first training sample, and determine the log whose log characteristic information does not meet the preset characteristic condition as a second training sample; The training of the preset log detection model according to the training sample includes: The preset log detection model is trained according to the first training sample and the second training sample.

3. The method for training a log detection model according to claim 2, wherein: Before determining the log whose log feature information meets the preset feature condition as the first training sample, the method further includes: Determine whether the log characteristic information meets the preset characteristic condition according to the script characteristic in the log characteristic information.

4. The method for training a log detection model according to claim 3, wherein: The determining, based on the script feature in the log feature information, whether the log feature information meets the preset feature condition includes: If a first similarity between a script execution file feature in the script feature and a preset script execution file feature is greater than or equal to a preset first similarity threshold, determining that the log feature information corresponding to the script feature meets the preset feature condition; and / or When the second similarity between the script symbol feature in the script feature and the preset script symbol feature is greater than or equal to a preset second similarity threshold, it is determined that the log feature information corresponding to the script feature meets the preset feature condition.

5. The method for training a log detection model according to claim 3, wherein: The determining, based on the script feature in the log feature information, whether the log feature information meets the preset feature condition includes: Determine whether the log feature information meets the preset feature condition according to at least one of the business type feature, the file type feature, and the semantic feature in the log feature information, and the script feature.

6. The method for training a log detection model according to any one of claims 1 to 5, wherein: The step of training a preset log detection model according to the training sample to obtain a target log detection model includes: Inputting the training sample into the preset log detection model to obtain a detection result output by the preset log detection model; Determining the labeling results corresponding to the training samples; The loss value of the preset log detection model is determined according to the detection result and the annotation result, and the parameters of the preset log detection model are adjusted according to the loss value to obtain a target log detection model.

7. The method for training a log detection model according to any one of claims 1 to 5, wherein: The method further comprises: Get the log of pending business documents; Determining a status of the log based on the target log detection model; Determine the to-be-processed business file corresponding to the log in the normal state as the first business file, and determine the to-be-processed business file corresponding to the log in the abnormal state as the second business file; The first business file is transmitted to a business file execution module to execute the first business file.

8. A training device for a log detection model, characterized in that: The training device of the log detection model includes: Log acquisition module, which obtains the log of target business file upload; A log parsing module, which parses the log based on preset log parsing rules to obtain log feature information including at least script features; A training sample determination module, which determines a training sample according to the log feature information; The model training module trains the preset log detection model according to the training samples to obtain the target log detection model.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the log detection model training method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the log detection model training method according to any one of claims 1 to 7 are implemented.

Images