Log sequence matching method and device, equipment and medium

Abstract

The invention discloses a log sequence matching method and device, equipment and a medium. The method comprises the following steps: acquiring matching rule information which is input by a user and corresponds to an abnormal operation to be monitored; the matching rule information comprises identification information, alarm operation logic information, each abnormal keyword, and keyword relation description information of the abnormal keywords with subsequent associated abnormal keywords; establishing a rule state diagram according to the matching rule information; after the to-be-matched log sequence is obtained, matching the to-be-matched log sequence with keyword nodes in the rule state diagram; when it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram and meets the keyword relation description information in the rule state diagram, it is determined that abnormal operation to be monitored occurs, and alarm operation is executed. According to the embodiment of the invention, the log sequence and the abnormal keyword of the abnormal operation can be automatically, quickly and accurately matched based on the rule state diagram, and whether the abnormal operation occurs or not is determined.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to a log sequence matching method and device, equipment and medium. BACKGROUND

[0002] A business system of an enterprise records each event occurring in the business system to generate logs of each event. The log of an event can be text for describing the event. After the business system generates a large number of logs, it is necessary to match a log sequence arranged by each generated log and an abnormal keyword of an abnormal operation against the business system to determine whether the abnormal operation against the business system occurs, and to perform an alarm operation after it is determined that the abnormal operation against the business system occurs. The abnormal operation against the business system can be an operation of stealing data in the business system or destroying the business system.

[0003] In related technologies, a commonly used log sequence matching scheme is that a technician matches a log sequence and an abnormal keyword of an abnormal operation against a business system based on manual operation to determine whether the abnormal operation against the business system occurs, and performs an alarm operation after it is determined that the abnormal operation against the business system occurs. The log sequence matching scheme in related technologies relies on manual operation, has high time cost and labor cost, is low in efficiency, and is difficult to ensure accuracy. SUMMARY

[0004] The present application provides a log sequence matching method, device, equipment and medium to solve the problem of high time cost and labor cost, low efficiency and difficult to ensure accuracy of the log sequence matching scheme in related technologies.

[0005] According to an aspect of the present application, a log sequence matching method is provided, comprising:

[0006] obtaining matching rule information corresponding to a to-be-monitored abnormal operation input by a user, wherein the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the to-be-monitored abnormal operation, and keyword relationship description information of an abnormal keyword having a subsequent associated abnormal keyword among the each abnormal keyword of the to-be-monitored abnormal operation;

[0007] establishing a rule state diagram of the matching rule information according to the alarm operation logic information in the matching rule information, the each abnormal keyword of the to-be-monitored abnormal operation, and the keyword relationship description information of the abnormal keyword having the subsequent associated abnormal keyword among the each abnormal keyword of the to-be-monitored abnormal operation;

[0008] After obtaining the log sequence to be matched, the log sequence to be matched and the keyword nodes in the rule state graph are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state graph and satisfies the keyword relationship description information in the rule state graph;

[0009] When it is determined that the log sequence to be matched hits the keyword nodes in the rule state graph and the log sequence to be matched satisfies the keyword relationship description information in the rule state graph, it is determined that the abnormal operation to be monitored occurs, and an alarm operation is performed according to the alarm operation logic information.

[0010] According to another aspect of the present application, a log sequence matching device is provided, comprising:

[0011] An information obtaining module is configured to obtain matching rule information corresponding to an abnormal operation to be monitored input by a user, wherein the matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of an abnormal keyword having a subsequent associated abnormal keyword among the abnormal keywords of the abnormal operation to be monitored;

[0012] A state graph establishing module is configured to establish a rule state graph of the matching rule information according to the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword having a subsequent associated abnormal keyword among the abnormal keywords of the abnormal operation to be monitored;

[0013] A sequence matching module is configured to, after obtaining a log sequence to be matched, match the log sequence to be matched and the keyword nodes in the rule state graph to determine whether the log sequence to be matched hits the keyword nodes in the rule state graph and satisfies the keyword relationship description information in the rule state graph;

[0014] An alarm operation executing module is configured to, when it is determined that the log sequence to be matched hits the keyword nodes in the rule state graph and the log sequence to be matched satisfies the keyword relationship description information in the rule state graph, determine that the abnormal operation to be monitored occurs, and perform an alarm operation according to the alarm operation logic information.

[0015] According to another aspect of the present application, an electronic device is provided, comprising:

[0016] at least one processor;

[0017] and a memory in communication connection with the at least one processor;

[0018] The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the log sequence matching method according to any one of the embodiments of the present application.

[0019] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the log sequence matching method according to any one of the embodiments of the present application when executed by the processor.

[0020] According to another aspect of the present application, a computer program product is provided, which comprises a computer program for implementing the log sequence matching method according to any one of the embodiments of the present application when executed by a processor.

[0021] The technical scheme of the embodiments of the present application acquires the matching rule information corresponding to the abnormal operation to be monitored input by the user, wherein the matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored which has a subsequent associated abnormal keyword; then, a rule state diagram of the matching rule information is established according to the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored which has a subsequent associated abnormal keyword; after acquiring the log sequence to be matched, the keyword nodes in the rule state diagram are matched with the log sequence to be matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; when it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored occurs, and the alarm operation is executed according to the alarm operation logic information, thereby solving the problems of high time cost and labor cost, low efficiency, and difficult to guarantee accuracy of the log sequence matching scheme in the related art. The rule state diagram for representing each abnormal keyword of the abnormal operation to be monitored, the abnormal keyword of the abnormal operation to be monitored which has a subsequent associated abnormal keyword, and the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword can be constructed based on the matching rule information input by the user, the log sequence and the abnormal keyword of the abnormal operation can be quickly and accurately matched based on the constructed rule state diagram after acquiring the log sequence to be matched, it is determined whether the abnormal operation occurs, and the alarm operation is executed after it is determined that the abnormal operation occurs, thereby reducing the time cost and labor cost of the log sequence matching process, improving the efficiency and accuracy of the log sequence matching process.

[0022] It should be understood that nothing in this section is intended to limit the scope of the embodiments of the present application nor are they intended to represent key or essential features of the embodiments of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0024] Figure 1 The flow chart of a log sequence matching method provided for the first embodiment of the present application.

[0025] Figure 2 The flow chart of a log sequence matching method provided for the second embodiment of the present application.

[0026] Figure 3 The structural schematic diagram of a log sequence matching device provided for the third embodiment of the present application.

[0027] Figure 4 The structural schematic diagram of an electronic device for implementing the log sequence matching method of the embodiments of the present application. DETAILED DESCRIPTION

[0028] In order to make the technical personnel in the art better understand the present application scheme, the following will combine the drawings in the embodiments of the present application, and the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort should belong to the scope of protection of the present application.

[0029] It is to be understood that the terminology "target", "first", "second", etc. used in the description and the claims and the above drawings is used for distinguishing between similar objects, not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of such terms herein is merely for descriptive purposes and does not necessarily imply a serial or chronological order unless explicitly indicated to do so. Moreover, the use of the terms "comprise", "comprising", "include", "including", and "has" and their variations herein are not meant to be limiting and to exclude other elements from the methods, compositions, processes and / or articles of manufacture that are described herein. For example, an element proceeds to a list of steps, processes, compositions, methods, articles of manufacture or other elements does not, without explicitly stated to do so, indicate that additional elements cannot be included.

[0030] Embodiment one

[0031] Figure 1 A flow chart of a log sequence matching method provided for the embodiment one of the present application. The embodiment can be applicable to matching a log sequence and an abnormal keyword of an abnormal operation against a business system, determining whether the abnormal operation against the business system occurs, and executing an alarm operation in the case that it is determined that the abnormal operation against the business system occurs. The method can be executed by a log sequence matching device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device arranged in an enterprise. The electronic device can be an electronic device arranged in an enterprise for matching a log sequence and an abnormal keyword of an abnormal operation against a business system, determining whether the abnormal operation against the business system occurs, and executing an alarm operation in the case that it is determined that the abnormal operation against the business system occurs. As shown in the figure, the method comprises: Figure 1

[0032] Step 101, obtaining matching rule information corresponding to a to-be-monitored abnormal operation input by a user.

[0033] The matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the to-be-monitored abnormal operation, and keyword relationship description information of an abnormal keyword in which a subsequent associated abnormal keyword exists among the abnormal keywords of the to-be-monitored abnormal operation.

[0034] ​Optionally, the business system of the enterprise can be a server set in the enterprise for processing the business of the enterprise. The business can refer to a process of producing products and providing the products to other enterprises or individuals. Each event occurring in the business system includes, but is not limited to, the business system performing an operation related to the business, an external device accessing the business system, the external device using the business system to perform an operation related to the business, etc. Each time the business system performs an operation related to the business is an event. Each time the external device accesses the business system is an event. Each time the external device uses the business system to perform an operation related to the business is an event. The external device can be an electronic device other than the business system.

[0035] Optionally, the business system can record each event occurring in the business system to generate a log of each event. The log of the event can be a text for describing the event. Each log includes a log time. The log time can refer to a time at which the event described by the log recorded by the business system occurs. The log sequence can refer to a sequence formed by arranging a plurality of logs generated by the business system in a sequence from front to back according to the log times. The log sequence includes N logs. N is a positive integer greater than or equal to 2. The log arranged in the first position in the log sequence has a sequence number of 1 in the log sequence, the log arranged in the second position in the log sequence has a sequence number of 2 in the log sequence, the log arranged in the third position in the log sequence has a sequence number of 3 in the log sequence, and so on, the log arranged in the Nth position in the log sequence has a sequence number of N in the log sequence.

[0036] Optionally, the abnormal operation on the business system can refer to an operation of stealing data in the business system or destroying the business system. The abnormal operation to be monitored can refer to an abnormal operation on the business system that needs to be monitored. For example, the abnormal operation to be monitored can refer to an operation of cracking encrypted data in the business system without authorization of the enterprise.

[0037] Optionally, the matching rule information corresponding to the abnormal operation to be monitored can be a text input by a user for describing various types of information required to be used in a process of matching the log sequence and the abnormal keywords of the abnormal operation to be monitored, determining whether the abnormal operation to be monitored occurs, and performing an alarm operation after it is determined that the abnormal operation to be monitored occurs. The user can be a technical personnel responsible for managing the business system. The matching rule information corresponding to the abnormal operation to be monitored includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of an abnormal keyword in each abnormal keyword of the abnormal operation to be monitored that has a subsequent associated abnormal keyword.

[0038] Optionally, the identification information can be text used to identify the matching rule information corresponding to the abnormal operation to be monitored. The alarm operation logic information can be text used to indicate that the alarm operation is performed on the abnormal operation to be monitored by sending alarm information corresponding to the abnormal operation to be monitored. Each abnormal keyword of the abnormal operation to be monitored can refer to a plurality of words related to the abnormal operation to be monitored.

[0039] Optionally, the subsequent associated abnormal keyword of the abnormal keyword can refer to another specified abnormal keyword contained in a log following the log containing the abnormal keyword in the log sequence when the abnormal operation to be monitored occurs. The subsequent associated abnormal keyword of the abnormal keyword can refer to another specified abnormal keyword contained in a log following the log containing the abnormal keyword in the log sequence when the abnormal operation to be monitored occurs. The abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword are two different abnormal keywords in each abnormal keyword. The abnormal keyword for which there is a subsequent associated abnormal keyword in each abnormal keyword of the abnormal operation to be monitored, the matching rule information corresponding to the abnormal operation to be monitored contains keyword relationship description information of the abnormal keyword. The keyword relationship description information of the abnormal keyword can be text used to describe the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword.

[0040] Optionally, the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword can refer to the order of the log containing the abnormal keyword and the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence.

[0041] Optionally, for each abnormal keyword for which there is a subsequent associated abnormal keyword, the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword can be that the log containing the subsequent associated abnormal keyword of the abnormal keyword is arranged after the log containing the abnormal keyword in the log sequence, and the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword and the log time in the log containing the abnormal keyword is less than a specified time length, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence and the sorting sequence number of the log time in the log containing the abnormal keyword in the log sequence is less than a specified value. Exemplarily, the specified time length is 5 seconds, 10 seconds or 15 seconds. The specified value is 3 or 6.

[0042] Optionally, for each abnormal keyword with a subsequent associated abnormal keyword, the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword can also be that the log containing the subsequent associated abnormal keyword in the log sequence is arranged behind the log containing the abnormal keyword, and the time difference between the log time in the log containing the subsequent associated abnormal keyword and the log time in the log containing the abnormal keyword is less than a specified time length.

[0043] Optionally, for each abnormal keyword with a subsequent associated abnormal keyword, the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword can also be that the log containing the subsequent associated abnormal keyword in the log sequence is arranged behind the log containing the abnormal keyword, and the difference between the sorting sequence number in the log sequence of the log containing the subsequent associated abnormal keyword and the sorting sequence number in the log sequence of the log time in the log containing the abnormal keyword is less than a specified value.

[0044] Optionally, the keyword relationship description information of the abnormal keyword contains the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword. For each abnormal keyword with a subsequent associated abnormal keyword, the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword can be determined according to the keyword relationship description information of the abnormal keyword, the log containing the abnormal keyword and the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence are determined, and then whether the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword described in the keyword relationship description information of the abnormal keyword is satisfied is detected according to the log containing the abnormal keyword and the log containing the subsequent associated abnormal keyword of the abnormal keyword.

[0045] Optionally, for each abnormal keyword without a subsequent associated abnormal keyword in each abnormal keyword of the abnormal operation to be monitored, the matching rule information corresponding to the abnormal operation to be monitored does not contain the keyword relationship description information of the abnormal keyword, that is, the keyword relationship description information of the abnormal keyword is empty.

[0046] Optionally, the matching rule information corresponding to the abnormal operation to be monitored input by the user is obtained, including: obtaining the matching rule information corresponding to the abnormal operation to be monitored input by the user through the log sequence management page.

[0047] Optionally, the log sequence management page can be a page in the electronic device configured to interact with the user, obtain information related to the log sequence input by the user, or provide information related to the log sequence to the user. The log sequence management page includes a rule information input area and a confirmation control. The rule information input area can be a page area in the log sequence management page configured to input matching rule information corresponding to the abnormal operation to be monitored. The user can fill in the matching rule information corresponding to the abnormal operation to be monitored in the rule information input area, thereby inputting the matching rule information corresponding to the abnormal operation to be monitored. The text filled in the rule information input area can be obtained. The confirmation control can be a control for confirming that the matching rule information corresponding to the abnormal operation to be monitored has been input. The user can click the confirmation control, thereby confirming that the operation of inputting the matching rule information corresponding to the abnormal operation to be monitored has been completed. It can be detected whether the confirmation control is clicked. The user can click the confirmation control after completing the operation of filling in the matching rule information corresponding to the abnormal operation to be monitored in the rule information input area, thereby confirming that the operation of inputting the matching rule information corresponding to the abnormal operation to be monitored has been completed. After detecting that the confirmation control is clicked each time, the latest obtained text filled in the rule information input area can be determined as the matching rule information corresponding to the abnormal operation to be monitored input by the user, thereby obtaining the matching rule information corresponding to the abnormal operation to be monitored input by the user through the log sequence management page.

[0048] In step 102, a rule state diagram of the matching rule information is established according to the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword with a subsequent associated abnormal keyword in each abnormal keyword of the abnormal operation to be monitored.

[0049] Optionally, the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored is a structural diagram for representing the keyword relationship between each abnormal keyword of the abnormal operation to be monitored, the abnormal keyword with a subsequent associated abnormal keyword in each abnormal keyword, and the subsequent associated abnormal keyword of the abnormal keyword, which is composed of an abnormal keyword node for representing each abnormal keyword in the matching rule information corresponding to the abnormal operation to be monitored, a connection edge between the abnormal keyword nodes with a connection relationship, attribute information of the connection edge, and node information bound to the keyword node.

[0050] Optionally, according to the alarm operation logic information in the matching rule information, the various abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword having the subsequent associated abnormal keyword in the various abnormal keywords of the abnormal operation to be monitored, a rule state diagram of the matching rule information is established, including: extracting each abnormal keyword from the matching rule information, and taking each abnormal keyword as a keyword node for representing the abnormal keyword; for each abnormal keyword, extracting the keyword relationship description information of the abnormal keyword from the matching rule information, determining the subsequent associated abnormal keyword of the abnormal keyword according to the extracted keyword relationship description information, establishing a connection line between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword, obtaining a connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword, and determining the keyword relationship description information of the abnormal keyword as attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword; extracting the alarm operation logic information in the matching rule information, determining a terminal keyword node in each keyword node, and determining the extracted alarm operation logic information as node information bound to the terminal keyword node; and gathering all keyword nodes, connection edges between the keyword nodes, attribute information of the connection edges between the keyword nodes, and node information bound to the keyword nodes, to obtain the rule state diagram of the matching rule information.

[0051] Optionally, the keyword node is a node for representing an abnormal keyword. For each abnormal keyword in the matching rule information corresponding to the abnormal operation to be monitored, the abnormal keyword can be extracted from the matching rule information corresponding to the abnormal operation to be monitored, and the abnormal keyword is taken as a keyword node for representing the abnormal keyword. In this way, the keyword nodes corresponding to the various abnormal keywords in the matching rule information corresponding to the abnormal operation to be monitored are obtained.

[0052] Optionally, after obtaining the keyword node corresponding to each abnormal keyword, for each abnormal keyword, the keyword relationship description information of the abnormal keyword can be extracted from the matching rule information corresponding to the abnormal operation to be monitored. If the keyword relationship description information of the abnormal keyword is extracted, the keyword relationship description information of the abnormal keyword is not empty, it can be determined that the abnormal keyword has a subsequent associated abnormal keyword, the subsequent associated abnormal keyword of the abnormal keyword can be determined according to the subsequent associated abnormal keyword of the abnormal keyword contained in the keyword relationship description information, then a connection line between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword is established, a connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword is obtained, and the keyword relationship description information of the abnormal keyword is determined as the attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword. The abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword are abnormal keyword nodes having a connection relationship. The connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword is used to represent the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword. The attribute information of the connection edge can be information used to describe the keyword relationship represented by the connection edge. If the keyword relationship description information of the abnormal keyword is not extracted, the keyword relationship description information of the abnormal keyword is empty, it can be determined that the abnormal keyword has no subsequent associated abnormal keyword, and other abnormal keywords are processed.

[0053] Optionally, the alarm operation logic information in the matching rule information corresponding to the abnormal operation to be monitored can be extracted. The terminal keyword node in each keyword node can be a keyword node in each keyword node corresponding to an abnormal keyword that has no subsequent associated abnormal keyword. The node information bound to the terminal keyword node can be information used to indicate that the alarm operation is performed for the abnormal operation to be monitored. It can be determined that the terminal keyword node in each keyword node, and the extracted alarm operation logic information is determined as the node information bound to the terminal keyword node.

[0054] Optionally, after obtaining the keyword nodes for representing respective abnormal keywords of the abnormal operation to be monitored, the connection edges for representing respective keyword relationships between the abnormal keywords and the subsequent associated abnormal keywords of the abnormal keywords, the attribute information of the connection edges for representing respective keyword relationships between the abnormal keywords and the subsequent associated abnormal keywords of the abnormal keywords, the node information bound to the terminal keyword node, all the keyword nodes, all the connection edges, all the attribute information of the connection edges, and the node information bound to the keyword nodes are aggregated to obtain a rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored.

[0055] Optionally, the rule state diagram of the matching rule information is further displayed on a log sequence management page.

[0056] Optionally, the log sequence management page includes a state diagram display area. The state diagram display area can be a page area of the log sequence management page configured to display the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored. The rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored can be displayed on the state diagram display area of the log sequence management page, so as to facilitate a user to browse the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored.

[0057] In step 103, after obtaining the log sequence to be matched, the log sequence to be matched and the keyword nodes in the rule state diagram are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram.

[0058] Optionally, the log sequence to be matched can be a log sequence that needs to be matched. The log sequence to be matched can be sent by a business system or a user to an electronic device. Whether the electronic device receives the log sequence to be matched can be detected. After detecting that the electronic device receives the log sequence to be matched each time, the log sequence to be matched received by the electronic device is obtained, so as to obtain the log sequence to be matched. Then, the log sequence to be matched and the keyword nodes in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored and satisfies the keyword relationship description information in the rule state diagram.

[0059] Optionally, the keyword node in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored, which is hit by the log sequence to be matched, can refer to detecting that the log sequence to be matched contains all the keyword nodes in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored. The keyword nodes in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored are the respective abnormal keywords of the abnormal operation to be monitored.

[0060] Optionally, the keyword relationship description information in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored, which is satisfied by the log sequence to be matched, can refer to for each keyword relationship description information in the rule state graph, the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is determined to be satisfied according to the log containing the abnormal keyword described by the keyword relationship description information in the log sequence to be matched, and the log containing the subsequent associated abnormal keyword of the abnormal keyword. The attribute information of each connection edge in the rule state graph is the respective keyword relationship description information in the rule state graph.

[0061] Generally, when the log sequence to be matched hits the keyword node in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored and the log sequence to be matched satisfies the keyword relationship description information in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored, it can be determined that the abnormal operation to be monitored occurs.

[0062] Optionally, the matching of the log sequence to be matched and the keyword node in the rule state graph includes detecting whether the log sequence to be matched contains all the keyword nodes in the rule state graph, and if it is detected that the log sequence to be matched contains all the keyword nodes in the rule state graph, it is determined that the log sequence to be matched hits the keyword node in the rule state graph; for each keyword relationship description information in the rule state graph, whether the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is satisfied is detected according to the log containing the abnormal keyword described by the keyword relationship description information in the log sequence to be matched, and the log containing the subsequent associated abnormal keyword of the abnormal keyword; and if it is detected that all the keyword relationship description information in the rule state graph is satisfied, it is determined that the log sequence to be matched satisfies the keyword relationship description information in the rule state graph.

[0063] Optionally, if it is detected that the to-be-matched log sequence does not contain all the keyword nodes in the rule state graph, it is determined that the to-be-matched log sequence does not hit the keyword nodes in the rule state graph; if it is detected that any one of the keyword relationship description information in the rule state graph is not satisfied, it is determined that the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state graph.

[0064] Optionally, for each keyword node in the rule state graph, it can be detected whether there is a log containing the keyword node in the to-be-matched log sequence. If it is detected that there is a log containing the keyword node in the to-be-matched log sequence, it can be determined that the to-be-matched log sequence contains the keyword node. If it is detected that there is no log containing the keyword node in the to-be-matched log sequence, it can be determined that the to-be-matched log sequence does not contain the keyword node. If it is detected that the to-be-matched log sequence contains all the keyword nodes in the rule state graph, it can be determined that the to-be-matched log sequence hits the keyword nodes in the rule state graph. If it is detected that the to-be-matched log sequence does not contain all the keyword nodes in the rule state graph, it can be determined that the to-be-matched log sequence does not hit the keyword nodes in the rule state graph.

[0065] Optionally, after it is determined that the to-be-matched log sequence hits the keyword nodes in the rule state graph, it can continue to detect, for each keyword relationship description information in the rule state graph, whether the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is satisfied according to the log containing the abnormal keyword described by the keyword relationship description information in the to-be-matched log sequence and the log containing the subsequent associated abnormal keyword of the abnormal keyword.

[0066] Optionally, the keyword relationship description information contains an abnormal keyword and a subsequent associated abnormal keyword of the abnormal keyword. The abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information refer to the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword contained in the keyword relationship description information. For each keyword relationship description information in the rule state graph, the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information can be determined according to the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword contained in the keyword relationship description information, the log containing the abnormal keyword described by the keyword relationship description information in the to-be-matched log sequence, and the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the to-be-matched log sequence. The keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information can be determined according to the keyword relationship description information.

[0067] Optionally, if the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is that the log containing the subsequent associated abnormal keyword of the abnormal keyword is arranged behind the log containing the abnormal keyword in the log sequence, the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword and the log time in the log containing the abnormal keyword is less than the specified time length, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence and the sorting sequence number of the log time in the log containing the abnormal keyword in the log sequence is less than the specified value, it is determined whether the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence, whether the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the log time in the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than the specified time length, and whether the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the sorting sequence number of the log time in the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than the specified value. If the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence, the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the log time in the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than the specified time length, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the sorting sequence number of the log time in the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than the specified value, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is satisfied. If the log containing the abnormal keyword described by the keyword relationship description information is not arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.If a time difference between a log time in a log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence to be matched and a log time in a log containing the abnormal keyword described by the keyword relationship description information in the log sequence to be matched is greater than or equal to a specified time length, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied. If a difference between a sorting sequence number in the log sequence to be matched of a log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information and a sorting sequence number in the log sequence to be matched of a log containing the abnormal keyword described by the keyword relationship description information is greater than or equal to a specified value, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.

[0068] Optionally, if the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is that the log containing the subsequent associated abnormal keyword of the abnormal keyword is arranged behind the log containing the abnormal keyword in the log sequence, and the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword and the log time in the log containing the abnormal keyword is less than the specified duration, it is determined whether the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence, and whether the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence and the log time in the log containing the abnormal keyword described by the keyword relationship description information is less than the specified duration. If the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword, and the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword and the log time in the log containing the abnormal keyword described by the keyword relationship description information is less than the specified duration, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is satisfied. If the log containing the abnormal keyword described by the keyword relationship description information is not arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied. If the time difference between the log time in the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information and the log time in the log containing the abnormal keyword described by the keyword relationship description information is greater than or equal to the specified duration, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.

[0069] Optionally, if the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is that the log containing the subsequent associated abnormal keyword of the abnormal keyword is arranged behind the log containing the abnormal keyword in the log sequence, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword in the log sequence and the sorting sequence number of the log time in the log containing the abnormal keyword in the log sequence is less than a specified value, it is determined whether the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence, and whether the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the sorting sequence number of the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than a specified value. If the log containing the abnormal keyword described by the keyword relationship description information is arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the sorting sequence number of the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is less than a specified value, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is satisfied. If the log containing the abnormal keyword described by the keyword relationship description information is not arranged behind the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied. If the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the log sequence and the sorting sequence number of the log containing the abnormal keyword described by the keyword relationship description information in the log sequence is greater than or equal to a specified value, it is determined that the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.

[0070] Optionally, if it is detected that all keyword relationship description information in the rule state diagram is satisfied, it can be determined that the to-be-matched log sequence satisfies the keyword relationship description information in the rule state diagram. If it is detected that any one of the keyword relationship description information in the rule state diagram is not satisfied, it is determined that the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram.

[0071] Step 104, when it is determined that the to-be-matched log sequence hits the keyword node in the rule state diagram and the to-be-matched log sequence satisfies the keyword relationship description information in the rule state diagram, it is determined that the to-be-monitored abnormal operation occurs, and an alarm operation is performed according to the alarm operation logic information.

[0072] Optionally, when it is determined that the to-be-matched log sequence hits the keyword node in the rule state diagram and the to-be-matched log sequence satisfies the keyword relationship description information in the rule state diagram, it can be determined that the to-be-monitored abnormal operation occurs, and an alarm operation is performed according to the alarm operation logic information in the rule state diagram. The alarm operation according to the alarm operation logic information in the rule state diagram includes: extracting the alarm information corresponding to the to-be-monitored abnormal operation in the alarm operation logic information, and sending the alarm information corresponding to the to-be-monitored abnormal operation to a target user. The alarm information corresponding to the to-be-monitored abnormal operation can be a text set to prompt that the to-be-monitored abnormal operation occurs and needs to be handled in time. The target user can be a technical personnel responsible for handling the abnormal operation of the business system in the enterprise.

[0073] Optionally, it further includes: when it is determined that the to-be-matched log sequence does not hit the keyword node in the rule state diagram or the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram, it is determined that the to-be-monitored abnormal operation does not occur, and it is determined that the current log sequence matching process ends. Generally, when the to-be-matched log sequence does not hit the keyword node in the rule state diagram corresponding to the matching rule information of the to-be-monitored abnormal operation or the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram corresponding to the matching rule information of the to-be-monitored abnormal operation, it can be determined that the to-be-monitored abnormal operation does not occur, and it is determined that the current log sequence matching process ends.

[0074] The technical scheme of the embodiment of the present application comprises the following steps: obtaining matching rule information corresponding to the abnormal operation to be monitored input by a user; wherein the matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword; then, a rule state diagram of the matching rule information is established according to the alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword; after obtaining a log sequence to be matched, the log sequence to be matched and the keyword nodes in the rule state diagram are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; when it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored occurs, and an alarm operation is performed according to the alarm operation logic information, thereby solving the problems of high time cost and labor cost, low efficiency, and difficult-to-ensure accuracy of the log sequence matching scheme in the related art. The rule state diagram for representing each abnormal keyword of the abnormal operation to be monitored, the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword, and the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword can be constructed based on the matching rule information input by the user. After obtaining the log sequence to be matched, the log sequence and the abnormal keyword of the abnormal operation can be quickly and accurately matched based on the constructed rule state diagram, and it is determined whether the abnormal operation occurs. After it is determined that the abnormal operation occurs, the alarm operation is performed, thereby reducing the time cost and labor cost of the log sequence matching process, and improving the efficiency and accuracy of the log sequence matching process.

[0075] Embodiment Two

[0076] Figure 2 A flowchart of a log sequence matching method provided by the embodiment two of the present application. The embodiment two of the present application can be combined with each optional scheme in one or more of the above embodiments. As shown in the figure, the method comprises the following steps: Figure 2

[0077] Step 201: obtaining matching rule information corresponding to the abnormal operation to be monitored input by a user through a log sequence management page.

[0078] The matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword.​

[0079] Step 202, according to the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, the keyword relationship description information of the abnormal keyword with a subsequent associated abnormal keyword in each abnormal keyword of the abnormal operation to be monitored, a rule state diagram of the matching rule information is established.

[0080] Step 203, the rule state diagram of the matching rule information is displayed on a log sequence management page.

[0081] Step 204, after obtaining the log sequence to be matched, the log sequence to be matched and the keyword nodes in the rule state diagram are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram.

[0082] Step 205, when it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored occurs, and an alarm operation is performed according to the alarm operation logic information.

[0083] The technical scheme of the embodiment of the application can obtain the matching rule information corresponding to the abnormal operation to be monitored input by the user through the interactive page, can construct the rule state diagram for representing the keyword relationship between each abnormal keyword of the abnormal operation to be monitored, the abnormal keyword with a subsequent associated abnormal keyword in each abnormal keyword, and the subsequent associated abnormal keyword of the abnormal keyword based on the matching rule information, and can visually display the rule state diagram through the interactive page. After obtaining the log sequence to be matched, the log sequence and the abnormal keyword of the abnormal operation can be quickly and accurately matched based on the constructed rule state diagram, it is determined whether the abnormal operation occurs, and the alarm operation is performed after it is determined that the abnormal operation occurs. The time cost and the labor cost of the log sequence matching process are reduced, and the efficiency and the accuracy of the log sequence matching process are improved.

[0084] Embodiment three

[0085] Figure 3 A structural schematic diagram of a log sequence matching device provided by the embodiment three of the application. The device can be configured in an electronic device. As shown in the figure, the device comprises an information acquisition module 301, a state diagram establishment module 302, a sequence matching module 303, and an alarm operation execution module 304. Figure 3

[0086] ​The information acquisition module 301 is configured to acquire matching rule information corresponding to the abnormal operation to be monitored input by a user; the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of an abnormal keyword having a subsequent associated abnormal keyword among the each abnormal keyword of the abnormal operation to be monitored; the state diagram establishment module 302 is configured to establish a rule state diagram of the matching rule information according to the alarm operation logic information in the matching rule information, the each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword having the subsequent associated abnormal keyword among the each abnormal keyword of the abnormal operation to be monitored; the sequence matching module 303 is configured to, after acquiring a log sequence to be matched, match the log sequence to be matched and a keyword node in the rule state diagram, and determine whether the log sequence to be matched hits the keyword node in the rule state diagram and satisfies keyword relationship description information in the rule state diagram; and the alarm operation execution module 304 is configured to, when it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, determine that the abnormal operation to be monitored occurs, and execute an alarm operation according to the alarm operation logic information.

[0087] The technical scheme of the embodiment of the present application comprises the following steps: obtaining the matching rule information corresponding to the abnormal operation to be monitored input by a user; wherein the matching rule information comprises identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword; then, a rule state diagram of the matching rule information is established according to the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword; after obtaining the log sequence to be matched, the keyword nodes in the log sequence to be matched and the rule state diagram are matched to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; when it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored occurs, and an alarm operation is performed according to the alarm operation logic information, thereby solving the problems of high time cost and labor cost, low efficiency and difficult to guarantee accuracy of the log sequence matching scheme in the related art. The rule state diagram for representing each abnormal keyword of the abnormal operation to be monitored, the abnormal keyword of the abnormal operation to be monitored, which has a subsequent associated abnormal keyword, and the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword can be constructed based on the matching rule information input by the user. After obtaining the log sequence to be matched, the log sequence and the abnormal keyword of the abnormal operation can be quickly and accurately matched based on the constructed rule state diagram, and it is determined whether the abnormal operation occurs. After it is determined that the abnormal operation occurs, the alarm operation is performed, thereby reducing the time cost and labor cost of the log sequence matching process, and improving the efficiency and accuracy of the log sequence matching process.

[0088] In an optional implementation of the embodiment of the present application, optionally, the information obtaining module 301 is specifically configured to: obtain the matching rule information corresponding to the abnormal operation to be monitored input by a user through a log sequence management page.

[0089] In an optional implementation of the embodiment of the present application, the state diagram establishing module 302 is specifically configured to: extract each abnormal keyword from the matching rule information, and take each abnormal keyword as a keyword node for representing the abnormal keyword; for each abnormal keyword, extract keyword relationship description information of the abnormal keyword from the matching rule information, determine a subsequent associated abnormal keyword of the abnormal keyword according to the extracted keyword relationship description information, establish a connection between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword, obtain a connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword, and determine the keyword relationship description information of the abnormal keyword as attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword of the abnormal keyword; extract alarm operation logic information in the matching rule information, determine a terminal keyword node in each keyword node, and determine the extracted alarm operation logic information as node information bound to the terminal keyword node; and aggregate all keyword nodes, connection edges between the keyword nodes, attribute information of the connection edges between the keyword nodes, and the node information bound to the keyword nodes to obtain a rule state diagram of the matching rule information.

[0090] In an optional implementation of the embodiment of the present application, when the sequence matching module 303 performs the operation of matching the to-be-matched log sequence and the keyword nodes in the rule state diagram, determining whether the to-be-matched log sequence hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram, the sequence matching module 303 is specifically configured to: detect whether the to-be-matched log sequence contains all keyword nodes in the rule state diagram; if it is detected that the to-be-matched log sequence contains all keyword nodes in the rule state diagram, it is determined that the to-be-matched log sequence hits the keyword nodes in the rule state diagram; for each keyword relationship description information in the rule state diagram, according to logs containing an abnormal keyword described by the keyword relationship description information and logs containing a subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information in the to-be-matched log sequence, it is detected whether a keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword of the abnormal keyword described by the keyword relationship description information is satisfied; and if it is detected that all keyword relationship description information in the rule state diagram is satisfied, it is determined that the to-be-matched log sequence satisfies the keyword relationship description information in the rule state diagram.

[0091] In an optional implementation of the embodiment of the present application, the sequence matching module 303 is further configured to: if it is detected that the to-be-matched log sequence does not contain all keyword nodes in the rule state diagram, determine that the to-be-matched log sequence does not hit the keyword nodes in the rule state diagram; and if it is detected that any one of keyword relationship description information in the rule state diagram is not satisfied, determine that the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram.

[0092] In an optional implementation of the embodiment of the present application, the sequence matching module 303 is further configured to: if it is detected that the to-be-matched log sequence does not contain all keyword nodes in the rule state diagram, determine that the to-be-matched log sequence does not hit the keyword nodes in the rule state diagram; and if it is detected that any one of keyword relationship description information in the rule state diagram is not satisfied, determine that the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram.

[0093] In an optional implementation of the embodiment of the present application, the sequence matching module 303 is further configured to: if it is detected that the to-be-matched log sequence does not contain all keyword nodes in the rule state diagram, determine that the to-be-matched log sequence does not hit the keyword nodes in the rule state diagram; and if it is detected that any one of keyword relationship description information in the rule state diagram is not satisfied, determine that the to-be-matched log sequence does not satisfy the keyword relationship description information in the rule state diagram.

[0094] The log sequence matching device provided by the embodiment of the present application can execute the log sequence matching method provided by any embodiment of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0095] Embodiment Four

[0096] Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement the log sequence matching method of the embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, electronic devices, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (such as headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0097] As Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory 12, a random access memory 13, etc., communicatively connected to the at least one processor 11, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory 12 or loaded into the random access memory 13 from the storage unit 18. Various programs and data required for the operation of the electronic device 10 can also be stored in the random access memory 13. The processor 11, the read-only memory 12, and the random access memory 13 are connected to each other through a bus 14. An input / output interface 15 is also connected to the bus 14.

[0098] Various components in the electronic device 10 are connected to the input / output interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, a speaker, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0099] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit, a graphics processing unit, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, a digital signal processor, and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the log sequence matching method.

[0100] In some embodiments, the log sequence matching method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed onto the heterogeneous hardware accelerator via the read-only memory and / or the communication unit. When the computer program is loaded into the random access memory and executed by the processor, one or more steps of the log sequence matching method described above can be performed. Alternatively, in other embodiments, the processor can be configured to perform the log sequence matching method by any other appropriate means, such as by means of firmware.

[0101] The various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits, application specific standard products, chips, computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0102] Computer programs implementing methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a standalone software package, or entirely on a remote machine or electronic device.

[0103] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. Computer-readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disc read-only memories, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0104] To provide for interaction with a user, the systems and techniques described here can be implemented on a heterogeneous hardware accelerator having a display device (e.g., a cathode ray tube or a liquid crystal display monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the heterogeneous hardware accelerator. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0105] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), a blockchain network, and the Internet.

[0106] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server is a remote computer system accessible to a client computer through a communication network. Cloud server, also known as cloud computing server or cloud host, is a host product in the cloud computing service system, which solves the defects of large management difficulty and weak business scalability in traditional physical host and virtual private server service.

[0107] It should be understood that various forms of flow shown above can be used, with steps reordered, added, or removed. For example, the steps recited in the present invention can be performed in parallel, in series, or in a different order, without limitation herein, as long as the desired results of the technical solutions of the present invention can be achieved.

[0108] The specific embodiments described above are not intended to be limiting, and persons skilled in the art will appreciate that various modifications, combinations, sub-combinations and alternatives can be made to the specific embodiments without departing from the spirit and principles of the present invention. Accordingly, the disclosure is intended to embrace all such alternatives, modifications and variances that fall within the scope of the present invention, including the patent claims as allowed, filed and issued.

Claims

1. A log sequence matching method, characterized in that, include: Obtain the matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords; Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, a rule state diagram of the matching rule information is established. After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information.

2. The log sequence matching method according to claim 1, characterized in that, Obtain the matching rule information corresponding to the abnormal operation to be monitored, based on user input, including: The log sequence management page allows you to obtain matching rule information for user-inputted abnormal operations.

3. The log sequence matching method according to claim 1, characterized in that, Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, a rule state diagram of the matching rule information is established, including: Extract each abnormal keyword from the matching rule information, and use each abnormal keyword as a keyword node to represent each abnormal keyword; For each abnormal keyword, keyword relationship description information is extracted from the matching rule information. Based on the extracted keyword relationship description information, the subsequent associated abnormal keywords are determined. A connection is established between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword. The connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword is obtained. The keyword relationship description information of the abnormal keyword is determined as the attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword. Extract the alarm operation logic information from the matching rule information, determine the termination keyword node in each keyword node, and determine the extracted alarm operation logic information as the node information bound to the termination keyword node; By aggregating all keyword nodes, the connection edges between keyword nodes, the attribute information of the connection edges between keyword nodes, and the node information bound to the keyword nodes, a rule state diagram of the matching rule information is obtained.

4. The log sequence matching method according to claim 1, characterized in that, Matching the log sequence to be matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram includes: Detect whether the log sequence to be matched contains all the keyword nodes in the rule state graph; If the log sequence to be matched is detected to contain all the keyword nodes in the rule state graph, then it is determined that the log sequence to be matched matches the keyword nodes in the rule state graph; For each keyword relationship description information in the rule state diagram, based on the logs containing the abnormal keywords described by the keyword relationship description information and the logs containing the subsequent associated abnormal keywords of the abnormal keywords described by the keyword relationship description information in the log sequence to be matched, it is detected whether the keyword relationship between the abnormal keywords described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keywords is satisfied. If all keyword relationship descriptions in the rule state diagram are satisfied, then the log sequence to be matched is determined to satisfy the keyword relationship descriptions in the rule state diagram.

5. The log sequence matching method according to claim 4, characterized in that, Also includes: If it is detected that the log sequence to be matched does not contain all the keyword nodes in the rule state diagram, then it is determined that the log sequence to be matched does not match any keyword nodes in the rule state diagram. If any keyword relationship description information in the rule state diagram is not satisfied, it is determined that the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram.

6. The log sequence matching method according to claim 1, characterized in that, Also includes: When it is determined that the log sequence to be matched does not match any keyword node in the rule state diagram or does not satisfy the keyword relationship description information in the rule state diagram, it is determined that no abnormal operation to be monitored has occurred, and the current log sequence matching process is determined to end.

7. The log sequence matching method according to claim 1, characterized in that, Also includes: The rule status graph of the matching rule information is displayed on the log sequence management page.

8. A log sequence matching device, characterized in that, include: The information acquisition module is used to acquire matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. The state diagram establishment module is used to establish a rule state diagram of the matching rule information based on the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. The sequence matching module is used to match the log sequence to be matched with the keyword nodes in the rule state diagram after obtaining the log sequence to be matched, and to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram. The alarm operation execution module is used to determine that the monitored abnormal operation has occurred when it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, and to execute the alarm operation according to the alarm operation logic information.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that is executed by the at least one processor, which enables the at least one processor to perform the log sequence matching method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the log sequence matching method according to any one of claims 1-7.

Images