MCP-based log-to-context structured data conversion and retrieval analysis system

Abstract

The invention discloses an MCP-based log-to-context structured data conversion and retrieval analysis system, and relates to the technical field of data processing. The system comprises a semantic conversion module, a context index module, a semantic retrieval engine and a rule analysis engine, all the modules complete operation such as capability declaration, index modeling, expression analysis and condition judgment through a unified interface, and a complete data processing and safety analysis process is formed. Structured semantic modeling and rule linkage analysis of log data are realized through a module capability registration and context state driving mechanism; the log is subjected to field analysis, protocol identification and semantic annotation to generate structured semantic data, a context model containing a behavior path, a state sequence and an index dimension is constructed, and cooperative operation of expression retrieval and rule matching is supported. The system has the characteristics of semantic driving, uniform structure, rule self-adaption and closed-loop feedback, and is suitable for security detection and semantic analysis tasks in a multi-source heterogeneous environment.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, and in particular relates to a log-to-context structured data conversion and retrieval analysis system based on MCP. Background Technology

[0002] Traditional security analysis systems such as SIEM typically rely on log rule matching and keyword queries. When log formats are non-standard, semantically ambiguous, or lack context, they are prone to generating numerous false positives and false negatives, failing to meet the dynamic threat analysis needs of multi-source, heterogeneous environments. Furthermore, the diversity of log sources and the uncertainty of their representation result in insufficient modeling capabilities for structured semantics in existing systems, limiting the accuracy and reusability of rule expressions.

[0003] The Model Context Protocol (MCP) is a communication protocol for building modular semantic processing workflows, featuring mechanisms for capability registration, context synchronization, and task-driven execution. MCP allows modules to declare processing capabilities through structured interfaces and dynamically invoke relevant logic based on context state, effectively supporting complex semantic modeling and workflow composition.

[0004] This invention proposes a log semantic transformation mechanism for security analysis scenarios within the MCP protocol framework. Through context enhancement and semantic expression, it transforms raw logs into structured semantic objects and supports expression-based semantic retrieval and rule matching, fundamentally improving the adaptability, execution accuracy, and retrieval effect of security rules. Summary of the Invention

[0005] This invention provides a log-to-context structured data conversion and retrieval analysis system based on MCP (Multi-Channel Programming). Through module capability registration and a context-state driven mechanism, it achieves structured semantic modeling and rule-based analysis of log data. The system includes a semantic conversion module, a context indexing module, a semantic retrieval engine, and a rule analysis engine. Each module completes capability declaration, index modeling, expression parsing, and condition judgment through a unified interface, forming a complete data processing and security analysis workflow. After field parsing, protocol identification, and semantic annotation, logs generate structured semantic data, constructing a context model containing behavioral paths, state sequences, and index dimensions, supporting collaborative operation of expression retrieval and rule matching. The system features semantic drive, unified structure, rule self-adaptation, and closed-loop feedback, making it suitable for security detection and semantic analysis tasks in multi-source heterogeneous environments; in summary, it solves the problems in the background technology.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0007] The log-to-context structured data conversion and retrieval analysis system based on MCP of the present invention consists of an MCP-driven log conversion module (module A), a context structured data generation and indexing module (module B), a semantic retrieval engine (module C), and a security rule matching and analysis engine (module D). Each module is uniformly declared and scheduled through the MCP capability registration mechanism, forming a closed-loop processing flow of log parsing, semantic modeling, security retrieval, and rule matching. Data flow and control flow are coordinated through context-driven and expression parsing mechanisms. Module A receives raw_log input, outputs contextual_data through the convert_log() interface, and calls module B's build_context() interface via the MCP JSON-RPC protocol. Module B receives contextual_data input, outputs indexed_features, and calls module C's execute_query() interface via the MCP JSON-RPC protocol. Module C receives query_expression input, outputs enhanced_context, and calls module D's match_rules() interface via the MCP JSON-RPC protocol. Module D receives enhanced_context input, outputs analysis_results, and calls module E's generate_feedback() interface via the MCP JSON-RPC protocol. Module E receives analysis_results input, outputs visualization_feedback, and calls module A's convert_log() interface via the MCP JSON-RPC protocol, forming a complete closed loop. The MCP protocol center uses the register_capability() interface to register and schedule the capabilities of each module.

[0008] The structure and processing flow of Module A: Module A receives raw log data and sequentially processes it through a field parsing unit to extract key information, a protocol identification unit to identify the transmission protocol type, and a semantic annotation unit to generate semantic tags based on behavior templates. The field parsing unit is recommended to use regular expression matching and syntax tree construction to perform dynamic field extraction for different log formats, such as the HTTP log parsing regular expression `^(\S+)--\[([^\]]+)\]"([^"]+)"(\d+)(\d+)$`. The protocol identification unit preferably uses a two-layer mechanism based on port mapping and payload feature secondary verification, such as the TCP three-way handshake feature matching algorithm. The semantic annotation unit is defined through a predefined behavior template JSON schema, such as a login behavior template containing `{action:"login",status:["success","failed"]}`. The final output structured log object contains fields such as timestamp, protocol, action, and status, which are used by Module B for context modeling and semantic indexing. This module completes registration through the service interface defined by MCP and supports dynamically loading protocol parsing plugins according to task requirements.

[0009] The processing flow of Module B is as follows: Module B receives the structured logs output by Module A. First, it completes the context state based on the event sequence, including user ID, behavior stage, and device role. Then, it constructs a behavior path model using temporal logic. Finally, it generates a context index supporting multi-dimensional retrieval, including key fields such as session_id, time window, and IP range. For context state completion, a cross-log session ID association algorithm and state machine definition are recommended. The user ID is defined using the formula `user_id = ...`.

[0010] `f(session_id, src_ip, timestamp)` is inferred from multi-source logs; behavior phase segmentation is preferably based on predefined state machine standards, such as the login process state transition diagram "Unauthenticated → Authentication in progress → Authenticated"; device role identification is achieved through an IP segment and device type mapping table. Behavior path modeling adopts a state transition diagram construction algorithm and a sliding time window mechanism, with a recommended sliding time window step size of 5 minutes; the multi-dimensional index structure preferably adopts a B+ tree index construction method, with the index field combination being `{session_id, user_id, [time_range], protocol}`. The context modeling mechanism of this module can adapt to heterogeneous protocols, improving cross-event semantic tracing capabilities.

[0011] The semantic retrieval process of Module C. Module C receives query expressions input by the user, parses the semantic tags and operational relationships in the expression, constructs a logical query graph, and submits it to the indexing system of Module B for querying, returning a semantic matching result set. The expression syntax rules are recommended to use EBNF syntax definitions, such as `expression::=term(AND|OR term)*`, supporting SQL-like syntax and regular expression extensions. Logical query graph construction is preferably based on the AST abstract syntax tree generation algorithm. Taking "protocol=HTTP AND payload_contains=login" as an example, node types include operator nodes, field nodes, and constant nodes. Time condition nesting parsing uses a time window parser and condition combiner. A timestamp-based interval query algorithm optimizes time window queries, supporting complex time logic such as "within the past 5 minutes and more than 3 failures". This module supports complex Boolean operations, nested time conditions, and nested behavior group queries, making it suitable for security analysis under high-dimensional conditions.

[0012] The rule analysis process in module D: After loading the rule expression, module D performs conditional judgments based on the semantic matching results returned by module C, and outputs risk levels and response suggestions based on the context state. Its analysis results are used to generate alarm logs, policy update suggestions, and response action feedback. The recommended rule iteration and marking mechanism uses a confusion matrix calculation model, with the false positive rate calculated using the following formula:

[0013] `FP_rate = FP / (TP+FP)`, the rule iteration threshold is set to trigger optimization when the false alarm rate > 20%; feedback data influences rule updates through incremental learning algorithms and rule priority adjustment strategies, such as adding...

[0014] `payload_contains="auth"` serves as a supplementary condition; the adaptive mechanism employs timed optimization and threshold triggering, supporting a performance-based closed-loop control process to achieve a complete closed loop of "retrieval → feedback → rule update → re-retrieval". This module supports a rule iteration and marking mechanism to record rule matching effects and their contextual features for subsequent optimization.

[0015] System initialization and module registration process. During startup, modules sequentially complete capability declaration, registration with the MCP center, generation of capability list and interface binding, and finally activate module running status and capability exposure through the control scheduler. This mechanism ensures that the system has module-level discoverability and capability hot update capability.

[0016] The retrieval and rule feedback process is as follows: After an expression is input, module C executes the query. Module D analyzes the results and generates hit rate and false alarm metrics, which are then fed back to modules A and F. The feedback content is used to generate new expression suggestions and strategy modifications, and drives updates to the index structure of module B or the rule system of module D, forming a multi-round feedback loop. Feedback data is stored in a structured format, including fields such as rule hit rate, false alarm rate, and context features. The API call chain triggers inter-module state synchronization through the MCP protocol, supporting real-time propagation of feedback data and rule updates.

[0017] Figure 8 This demonstrates the system's operational flow in a SIEM scenario. After logs are received, they undergo transformation by module A, modeling by module B, querying by module C, and matching by module D, ultimately generating a response action that is returned to the SIEM controller, achieving a closed loop for security policy execution and detection tasks. The system supports real-time task injection, asynchronous expression feedback, and cross-domain index calls.

[0018] The present invention has the following advantages over the prior art:

[0019] (1) A log semantic conversion mechanism based on the MCP protocol is proposed to realize the module capability registration and context-driven structured data generation process.

[0020] (2) Construct a contextual structured data model to integrate information such as protocols, behaviors, and states into indexable objects for semantic retrieval and rule matching.

[0021] (3) Design a semantic retrieval engine that supports expression parsing and logic graph transformation to realize dynamic retrieval control path based on structured conditions.

[0022] (4) Introduce a feedback-based rule iteration mechanism to guide expression adjustment and strategy update through hit rate and false alarm information.

[0023] (5) Implement an adaptive security analysis process and support a multi-round closed-loop task execution mechanism for log semantic processing, policy matching and rule updating.

[0024] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1This is a diagram of the overall system architecture of the present invention;

[0027] Figure 2 This is a structural diagram of the log semantic conversion module of the present invention;

[0028] Figure 3 This is a flowchart illustrating the context structure generation and indexing process of this invention.

[0029] Figure 4 This is a structural diagram of the semantic retrieval engine of the present invention;

[0030] Figure 5 This is a structural diagram of the security rule matching and analysis engine of the present invention;

[0031] Figure 6 This is a flowchart of the system initialization and capability registration process of the present invention;

[0032] Figure 7 This is a flowchart of the retrieval and rule feedback process of this invention;

[0033] Figure 8 This invention relates to a secure retrieval and matching application scenario based on structured context data. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] The problems to be solved by this invention are: (1) the problem of difficulty in searching due to inconsistent log structure, which is solved by converting logs into a unified expression format through a contextual structured modeling mechanism; (2) the problem of difficulty in behavior recognition under multi-source protocols, which is solved by generating structured data with contextual labels through semantic annotation and protocol recognition mechanisms; (3) the problem of retrieval capability being limited by static rules, which is solved by supporting complex logical queries through an expression-driven semantic retrieval engine; (4) the problem of the inability to evaluate the hit effect of security rules, which is solved by establishing a quantitative optimization path through a rule feedback structure and strategy evaluation mechanism.

[0036] 5. The problem of lacking a closed-loop system mechanism is solved by constructing an integrated process control system that combines transformation, retrieval, matching, and feedback through an adaptive execution link.

[0037] like Figure 1-8As shown, the log-to-context structured data conversion and retrieval analysis system based on MCP of the present invention consists of an MCP-driven log conversion module (module A), a context structured data generation and indexing module (module B), a semantic retrieval engine (module C), and a security rule matching and analysis engine (module D). Each module is uniformly declared and scheduled through the MCP capability registration mechanism, forming a closed-loop processing flow of log parsing, semantic modeling, security retrieval, and rule matching. Data flow and control flow are coordinated through context-driven and expression parsing (see...). Figure 1 Module A receives raw_log input, outputs contextual_data through the convert_log() interface, and calls module B's build_context() interface via the MCP JSON-RPC protocol. Module B receives contextual_data input, outputs indexed_features, and calls module C's execute_query() interface via the MCP JSON-RPC protocol. Module C receives query_expression input, outputs enhanced_context, and calls module D's match_rules() interface via the MCP JSON-RPC protocol. Module D receives enhanced_context input, outputs analysis_results, and calls module E's generate_feedback() interface via the MCP JSON-RPC protocol. Module E receives analysis_results input, outputs visualization_feedback, and calls module A's convert_log() interface via the MCP JSON-RPC protocol, forming a complete closed loop. The MCP protocol center uses the register_capability() interface to register and schedule the capabilities of each module.

[0038] Figure 2The structure and processing flow of module A are demonstrated. Module A receives raw log data, which is then processed sequentially by a field parsing unit to extract key information, a protocol identification unit to identify the transmission protocol type, and a semantic annotation unit to generate semantic tags based on behavior templates. The field parsing unit is recommended to use regular expression matching and syntax tree construction to perform dynamic field extraction for different log formats, such as the HTTP log parsing regular expression `^(\S+)--\[([^\]]+)\]"([^"]+)"(\d+)(\d+)$`; the protocol identification unit preferably uses a two-layer mechanism based on port mapping and payload feature secondary verification, such as the TCP three-way handshake feature matching algorithm; the semantic annotation unit is defined through a predefined behavior template JSON schema, such as a login behavior template containing `{action:"login",status:["success", ...`.

[0039] The final output structured log object contains fields such as timestamp, protocol, action, and status, which are used by module B for context modeling and semantic indexing (see [link to log file]). Figure 2 This module completes registration through the service interface defined by MCP and supports dynamically loading protocol parsing plugins according to task requirements.

[0040] Figure 3 This demonstrates the processing flow of module B. Module B receives structured logs output from module A, first completing the context state based on the event sequence, including user identifier, behavior stage, and device role; then, it constructs a behavior path model using temporal logic; finally, it generates a context index supporting multi-dimensional retrieval, including key fields such as session_id, time window, and IP range (see...). Figure 3 ) Context state completion is recommended to use a cross-log session ID association algorithm and state machine definition. User identification is achieved through a formula.

[0041] `user_id = f(session_id, src_ip, timestamp)` is inferred from multi-source logs; behavior phase segmentation is preferably based on predefined state machine standards, such as the login process state transition diagram "Unauthenticated → Authentication in progress → Authenticated"; device role identification is achieved through an IP segment and device type mapping table. Behavior path modeling adopts a state transition diagram construction algorithm and a sliding time window mechanism, with a recommended sliding time window step size of 5 minutes; the multi-dimensional index structure preferably adopts a B+ tree index construction method, with the index field combination being `{session_id, user_id, [time_range], protocol}`. The context modeling mechanism of this module can adapt to heterogeneous protocols, improving cross-event semantic tracing capabilities.

[0042] Figure 4This demonstrates the semantic retrieval process of module C. Module C receives a query expression input by the user, parses the semantic tags and operational relationships in the expression, constructs a logical query graph, and submits it to the indexing system of module B for querying, returning a semantic matching result set (see...). Figure 4 The expression syntax rules recommend using EBNF syntax definitions, such as `expression::=term(AND|OR term)*`, supporting SQL-like syntax and regular expression extensions. Logical query graph construction is preferably based on the AST (Abstract Syntax Tree) generation algorithm. Taking "protocol=HTTP AND payload_contains=login" as an example, node types include operator nodes, field nodes, and constant nodes. Time condition nesting parsing uses a time window parser and condition combiner, with a timestamp-based interval query algorithm optimizing time window queries, supporting complex time logic such as "within the past 5 minutes and more than 3 failures". This module supports complex Boolean operations, nested time conditions, and nested behavior group queries, suitable for security analysis under high-dimensional conditions.

[0043] The rule analysis process of module D. After loading the rule expression, module D performs conditional judgments on the semantic matching results returned by module C, and outputs the risk level and response suggestions based on the context state. Its analysis results are used to generate alarm logs, policy update suggestions, and response action feedback (see...). Figure 5 The recommended rule iteration and labeling mechanism uses a confusion matrix calculation model, with the false positive rate (FP) calculated as `FP_rate = FP / (TP + FP)`. The rule iteration threshold is set to trigger optimization when the FP > 20%. Feedback data influences rule updates through incremental learning algorithms and rule priority adjustment strategies, such as adding...

[0044] `payload_contains="auth"` serves as a supplementary condition; the adaptive mechanism employs timed optimization and threshold triggering, supporting a performance-based closed-loop control process to achieve a complete closed loop of "retrieval → feedback → rule update → re-retrieval". This module supports a rule iteration and marking mechanism to record rule matching effects and their contextual features for subsequent optimization.

[0045] Figure 6 The system initialization and module registration process is demonstrated. During the startup phase, modules sequentially complete capability declaration, registration with the MCP center, generation of a capability list, and interface binding. Finally, the module's running status and capability exposure are activated through the control scheduler (see...). Figure 6 This mechanism ensures that the system has module-level discoverability and the ability to hot update capabilities.

[0046] Figure 7This demonstrates the retrieval and rule feedback process. After an expression is input, module C executes the query. Module D analyzes the results and generates hit rate and false alarm metrics, which are then fed back to modules A and F. The feedback is used to generate new expression suggestions and strategy modifications, and drives updates to the index structure of module B or the rule system of module D, forming a multi-round feedback loop (see...). Figure 7 Feedback data is stored in a structured format, including fields such as rule hit rate, false alarm rate, and context features. The API call chain is triggered by the MCP protocol to achieve state synchronization between modules, supporting real-time propagation of feedback data and rule updates.

[0047] Figure 8 This demonstrates the operational flow of the system deployed in a SIEM scenario. After logs are received, they undergo transformation by module A, modeling by module B, querying by module C, and matching by module D, ultimately generating a response action that is returned to the SIEM controller, thus achieving a closed loop for security policy execution and detection tasks (see...). Figure 8 The system supports real-time task injection, asynchronous expression feedback, and cross-domain index calls.

[0048] The following examples, using the functions and core terminology of each module of the system, illustrate the process performance, semantic structure, and feedback loop mechanism of this invention in a real-world scenario.

[0049] In terms of data structure, the basic data source for the system's processing is the raw data packets collected by network probes or log agents, with the following structure:

[0050]

[0051] The data is parsed and protocol identified by module A. Combining behavioral templates and protocol rule tables, key fields are extracted to construct a standard semantic structure. This data acquisition process can be implemented based on existing open-source probes, such as the Pcap capture solutions provided by Zeek and Wireshark.

[0052] Module A provides the following capabilities through MCP registration: input is a basic log object, and output is semantic data conforming to the context structure standard (fields include session_id, action, status, etc.):

[0053]

[0054]

[0055] The context structure is generated by the state modeler in module B, employing a context annotation algorithm based on session sequence windows to construct behavioral chains for multi-turn logins and cross-protocol communication. The context structure describes the role and state evolution of a log entry across multiple rounds of access, supporting cross-protocol, behavior aggregation, and backtracking capabilities.

[0056] After being received by module D, the rule is executed using an expression graph. Its execution path is mapped to semantic index fields, supporting logical expression and result reuse. A typical rule format is as follows:

[0057]

[0058] The strategy structure is shared by modules C and D, and is used for defining aggregation analysis dimensions and configuring result alignment, as well as supporting automatic triggering of result push and feedback collection. An example strategy is shown below:

[0059]

[0060] The feedback structure is generated by module D and injected into the suggestion engine of modules A and F, supporting multi-dimensional metric analysis such as rule hit rate, false positive ratio, and policy saturation. An example of the feedback is as follows:

[0061]

[0062]

[0063] The suggested structure is generated through module F, and identifies the target of the suggested modification, the updated content, and the applicable strategy ID in the form of a structure, enabling comparison and confirmation before automatic updates. An example suggestion is shown below:

[0064]

[0065] The adaptive mechanism, implemented by the control center, calls the interfaces of the feedback module, expression module, and index module to execute a complete closed-loop task of collection, evaluation, generation, and distribution. This mechanism possesses dynamic learning and rolling strategy optimization capabilities, and is the core of the multi-round feedback self-optimization in this patented method.

[0066] The filtering operation is located in module D, which performs semantic constraint judgment in the rule expression and outputs the labeled behavior events; the aggregation operation performs time series integration and structure backfilling for the same user, IP or protocol according to the group_by configuration in the strategy.

[0067] Overall, this medical audit scenario fully demonstrates the multi-module linkage closed-loop capability of this patented solution from structure generation to rule iteration, possesses cross-system portability and a sustainable rule update mechanism, and can adapt to semantic intelligent analysis and strategy feedback execution in complex multi-source log environments.

[0068] Competitive technology analysis

[0069] This chapter aims to analyze patents and products that are comparable to this patent in terms of log structure transformation, semantic understanding, and secure retrieval analysis, and to clarify the advantages of the modular structure of this invention and the path to improve its expressive capabilities.

[0070] US20210345678A1 Log Event Contextualization System

[0071] Technical features: This patent constructs a context window based on static field rules and time window processing, which is used for event-level log classification and compliance analysis.

[0072] Limitations: It cannot handle scenarios with unknown protocols or field variations; the semantic structure is statically defined, limiting its extensibility.

[0073] Advantages of this invention: It supports structure generation paths based on protocol dynamic recognition and context tag completion, and has scalable expression retrieval capabilities.

[0074] Elastic Stack (ELK) log analysis toolchain

[0075] Technical features: Integrates log collection (Logstash), indexing (Elasticsearch), and visualization (Kibana), supporting configuration rules and template retrieval.

[0076] Limitations: Semantic expressive capabilities rely on user rule design and lack structural modeling and feedback update processes.

[0077] Advantages of this invention: It supports closed-loop analysis that links expression generation based on structured context, semantic engine parsing, and feedback strategies.

[0078] Splunk Enterprise Security

[0079] Technical features: Security event monitoring is performed through rules and search expressions, and user-defined index fields and dashboards are supported.

[0080] Limitations: It relies on static expressions and field rule definitions, making it difficult to adapt to multi-round tasks or dynamic optimization.

[0081] Advantages of this invention: It implements a mechanism for capability registration and dynamic expression reconstruction between modules through the MCP architecture, supporting rule optimization and multi-round execution paths.

[0082] CN111943762A A method and system for multidimensional log analysis

[0083] Technical features: Supports querying and filtering based on business dimensions and field characteristics, suitable for business log scenarios with clear formats.

[0084] Limitations: It lacks a context generation mechanism and dynamic semantic expression path, and cannot adapt to complex behavior tracking scenarios.

[0085] Advantages of this invention: It supports index modeling and expression parsing based on contextual semantic enhancement, and has high adaptability and behavior modeling capabilities.

[0086] This invention constructs a module collaborative structure and semantic closed-loop retrieval mechanism based on the MCP protocol, which has the advantage of full-process control from log to semantic structure generation, expression-driven retrieval to rule feedback optimization, and is suitable for highly dynamic and highly complex security retrieval and analysis scenarios.

[0087] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A log-to-context structured data conversion and retrieval analysis system based on MCP, characterized in that, The system consists of a log transformation module driven by MCP, a context structure generation and indexing module, a semantic retrieval engine, and a security rule matching and analysis engine. Each module is uniformly declared and scheduled through the MCP capability registration mechanism, forming a closed-loop processing flow of log parsing, semantic modeling, security retrieval, and rule matching. Data flow and control flow are coordinated with each other through context driving and expression parsing. The MCP-driven log conversion module receives raw log data, which is then processed sequentially by a field parsing unit to extract key information, a protocol identification unit to identify the transmission protocol type, and a semantic annotation unit to generate semantic tags based on behavior templates. The final output structured log object contains fields such as timestamp, protocol, action, and status, which are used by the context structuring generation and indexing module to perform context modeling and semantic indexing. The MCP-driven log conversion module completes registration through the service interface defined by MCP and supports dynamically loading protocol parsing plugins according to task requirements. The context structure generation and indexing module receives structured logs output by the log transformation module driven by MCP. First, it completes the context state based on the event sequence, including user identifier, behavior stage, and device role. Then, it constructs a behavior path model based on time sequence logic. Finally, it generates a context index that supports multi-dimensional retrieval, including key fields such as session_id, time window, and IP segment. The semantic retrieval process of the semantic retrieval engine is as follows: The semantic retrieval engine receives the query expression input by the user, parses the semantic tags and operation relationships in the expression, constructs a logical query graph and submits it to the indexing system of the context structure generation and indexing module for querying, and returns a semantic matching result set; The rule analysis process of the security rule matching and analysis engine is as follows: After loading the rule expression, the security rule matching and analysis engine performs condition judgment on the semantic matching results returned by the semantic retrieval engine, and outputs the risk level and response suggestions in combination with the context state. The analysis results are used to generate alarm logs, policy update suggestions, and response action feedback; the security rule matching and analysis engine supports a rule iteration and marking mechanism to record the rule matching effect and its contextual features for subsequent optimization.

2. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 1, characterized in that, The field parsing unit uses regular expression matching and syntax tree construction to perform dynamic field extraction for different log formats.

3. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 1, characterized in that, The protocol identification unit is based on a two-layer mechanism of port mapping and secondary verification of payload features; Semantic annotation units are defined using a predefined behavior template JSON schema.

4. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 1, characterized in that, The context state completion uses a cross-log session ID association algorithm and state machine definition. The user identifier is inferred from multi-source logs using the formula `user_id = f(session_id, src_ip, timestamp)`. Behavioral phase division is based on a predefined state machine standard. Device role identification is achieved through an IP segment and device type mapping table. Behavioral path modeling uses a state transition graph construction algorithm and a sliding time window mechanism, with the time window sliding step size set to 5 minutes. The multidimensional index structure uses a B+ tree index construction method, and the index field combination is `{session_id, user_id, [time_range], protocol}`.

5. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 1, characterized in that, The syntax rules of the expression adopt the EBNF syntax definition and support SQL-like syntax and regular expression extensions; The logical query graph is constructed based on the AST abstract syntax tree generation algorithm; the time condition nested parsing adopts a time window parser and a condition combiner, and the time window query is optimized by a timestamp-based interval query algorithm, which supports complex time logic including "within the past 5 minutes and the number of failures > 3".

6. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 1, characterized in that, The rule iteration marking mechanism adopts a confusion matrix calculation model, and the rule iteration threshold is set to trigger optimization when the false alarm rate is >20%. Feedback data influences rule updates through incremental learning algorithms and rule priority adjustment strategies. The adaptive mechanism adopts timed optimization and threshold triggering mechanisms, supports closed-loop control processes based on performance indicators, and realizes a complete closed loop of "retrieval → feedback → rule update → re-retrieval".

7. The log-to-context structured data conversion and retrieval analysis system based on MCP according to claim 6, characterized in that, The feedback data is stored in a structured storage format, including rule hit rate, false alarm rate, and context feature fields; The API call chain triggers inter-module state synchronization through the MCP protocol, supporting real-time propagation of feedback data and rule updates.

Images