A log sequence matching method, device, equipment and medium

Abstract

This invention discloses a log sequence matching method, apparatus, device, and medium. The method includes: acquiring user-inputted matching rule information corresponding to an abnormal operation to be monitored; the matching rule information includes identification information, alarm operation logic information, various abnormal keywords, and keyword relationship description information for abnormal keywords with subsequent related abnormal keywords; establishing a rule state diagram based on the matching rule information; after acquiring the log sequence to be matched, matching the log sequence to be matched with keyword nodes in the rule state diagram; when it is determined that the log sequence to be matched matches a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram, it is determined that an abnormal operation to be monitored has occurred, and an alarm operation is executed. This invention can automatically, quickly, and accurately match log sequences and abnormal keywords of abnormal operations based on the rule state diagram to determine whether an abnormal operation has occurred.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a log sequence matching method, apparatus, device, and medium. Background Technology

[0002] An enterprise's business systems record various events that occur within the system, generating event logs. Event logs can be text describing the events. After the business system generates a large number of logs, it needs to match the log sequence (composed of the various log entries) with abnormal keywords indicating abnormal operations targeting the business system to determine if any abnormal operations have occurred. If abnormal operations are confirmed, an alert is triggered. Abnormal operations targeting the business system can refer to actions that steal data or damage the business system.

[0003] In related technologies, a common log sequence matching scheme involves technicians manually matching log sequences with abnormal keywords associated with abnormal operations targeting the business system to determine if such an operation has occurred. Once confirmed, an alert is triggered. However, this log sequence matching scheme relies on manual operation, resulting in high time and manpower costs, low efficiency, and difficulty in guaranteeing accuracy. Summary of the Invention

[0004] This invention provides a log sequence matching method, apparatus, device, and medium to solve the problems of high time and labor costs, low efficiency, and difficulty in guaranteeing accuracy in related log sequence matching schemes.

[0005] According to one aspect of the present invention, a log sequence matching method is provided, comprising:

[0006] Obtain the matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords;

[0007] Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, a rule state diagram of the matching rule information is established.

[0008] After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram;

[0009] When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information.

[0010] According to another aspect of the present invention, a log sequence matching apparatus is provided, comprising:

[0011] The information acquisition module is used to acquire matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords.

[0012] The state diagram establishment module is used to establish a rule state diagram of the matching rule information based on the alarm operation logic information in the matching rule information, each abnormal keyword of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords.

[0013] The sequence matching module is used to match the log sequence to be matched with the keyword nodes in the rule state diagram after obtaining the log sequence to be matched, and to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram.

[0014] The alarm operation execution module is used to determine that the monitored abnormal operation has occurred when it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, and to execute the alarm operation according to the alarm operation logic information.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor;

[0017] and a memory communicatively connected to the at least one processor;

[0018] The memory stores a computer program that is executed by the at least one processor, which enables the at least one processor to perform the log sequence matching method according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the log sequence matching method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the log sequence matching method according to any embodiment of the present invention.

[0021] The technical solution of this invention involves obtaining matching rule information corresponding to the abnormal operation to be monitored, input by the user. This matching rule information includes identification information, alarm operation logic information, various abnormal keywords of the abnormal operation to be monitored, and keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. Then, based on the alarm operation logic information, the various abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored, a rule state diagram of the matching rule information is established. After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram. When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and... When the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that an abnormal operation to be monitored has occurred. An alarm operation is then executed according to the alarm operation logic information. This solves the problems of high time and manpower costs, low efficiency, and difficulty in guaranteeing accuracy in related log sequence matching schemes. Based on the matching rule information input by the user, a rule state diagram is constructed to represent each abnormal keyword of the abnormal operation to be monitored, the abnormal keywords among each abnormal keyword that have subsequent related abnormal keywords, and the keyword relationships between the subsequent related abnormal keywords. After obtaining the log sequence to be matched, the system can automatically and quickly match the log sequence with the abnormal keywords of the abnormal operation based on the constructed rule state diagram to determine whether an abnormal operation has occurred. Once an abnormal operation is determined, an alarm operation is executed, reducing the time and manpower costs of the log sequence matching process and improving its efficiency and accuracy.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a log sequence matching method provided in Embodiment 1 of the present invention.

[0025] Figure 2 This is a flowchart of a log sequence matching method provided in Embodiment 2 of the present invention.

[0026] Figure 3 This is a schematic diagram of a log sequence matching device provided in Embodiment 3 of the present invention.

[0027] Figure 4 A schematic diagram of the structure of an electronic device for implementing the log sequence matching method of this invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "target," "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising," "including," and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a log sequence matching method provided in Embodiment 1 of the present invention. This embodiment is applicable to matching log sequences with abnormal keywords related to abnormal operations on a business system to determine whether an abnormal operation has occurred, and executing an alarm operation after determining that an abnormal operation has occurred. This method can be executed by a log sequence matching device, which can be implemented in hardware and / or software, and can be configured in an electronic device installed within an enterprise. The electronic device can be an electronic device installed within the enterprise used to match log sequences with abnormal keywords related to abnormal operations on a business system to determine whether an abnormal operation has occurred, and to execute an alarm operation after determining that an abnormal operation has occurred. Figure 1 As shown, the method includes:

[0032] Step 101: Obtain the matching rule information corresponding to the abnormal operation to be monitored, which is input by the user.

[0033] The matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords.

[0034] Optionally, a company's business system can be a server set up within the company to handle its business operations. Business operations can refer to the processes of producing products and providing those products to other companies or individuals. Events occurring within the business system include, but are not limited to: the business system performing business-related operations, external devices accessing the business system, and external devices using the business system to perform business-related operations. Each instance of the business system performing a business-related operation constitutes one event. Each instance of an external device accessing the business system constitutes one event. Each instance of an external device using the business system to perform a business-related operation constitutes one event. External devices can be electronic devices other than the business system.

[0035] Optionally, the business system can record various events occurring within the system, generating event logs. Event logs can be text describing the events. Each log contains a log time. The log time can refer to the time when the event described in the log recorded by the business system occurred. A log sequence can refer to a sequence composed of multiple logs generated by the business system arranged in chronological order. A log sequence contains N logs, where N is a positive integer greater than or equal to 2. The first log in the log sequence has a sequence number of 1, the second log has a sequence number of 2, the third log has a sequence number of 3, and so on, up to the Nth log having a sequence number of N.

[0036] Optionally, abnormal operations targeting a business system can refer to operations that steal data from or damage the business system. An abnormal operation to be monitored can be any abnormal operation targeting a business system that needs to be monitored. For example, an abnormal operation to be monitored could be an operation that decrypts encrypted data in a business system without the enterprise's authorization.

[0037] Optionally, the matching rule information corresponding to the abnormal operation to be monitored can be text input by the user, describing various information needed in the process of matching log sequences with abnormal keywords of the abnormal operation to be monitored, determining whether the abnormal operation to be monitored has occurred, and executing alarm operations after determining that the abnormal operation to be monitored has occurred. The user can be a technical personnel responsible for managing the business system. The matching rule information corresponding to the abnormal operation to be monitored includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords.

[0038] Optionally, the identification information can be text used to identify the matching rule information corresponding to the abnormal operation to be monitored. The alarm operation logic information can be text used to instruct the execution of an alarm operation for the abnormal operation to be monitored by sending alarm information corresponding to the abnormal operation to be monitored. Each abnormal keyword of the abnormal operation to be monitored can refer to multiple words related to the abnormal operation to be monitored.

[0039] Optionally, the existence of subsequent associated abnormal keywords can refer to a situation where, when the abnormal operation to be monitored occurs, a log entry following the log containing the abnormal keyword will contain another specified abnormal keyword. Subsequent associated abnormal keywords refer to another specified abnormal keyword that, when the abnormal operation to be monitored occurs, will be contained in the log entry following the log containing the abnormal keyword. The abnormal keyword and its subsequent associated abnormal keywords are two distinct abnormal keywords. For each abnormal keyword with subsequent associated abnormal keywords among the abnormal keywords of the abnormal operation to be monitored, the matching rule information corresponding to the abnormal operation will include keyword relationship description information. This keyword relationship description information can be text describing the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords.

[0040] Optionally, the keyword relationship between abnormal keywords and their subsequent related abnormal keywords can refer to the sequential relationship between logs containing abnormal keywords and logs containing their subsequent related abnormal keywords in the log sequence.

[0041] Optionally, for each anomalous keyword with subsequent associated anomalous keywords, the keyword relationship between the anomalous keyword and its subsequent associated anomalous keywords can be such that, in the log sequence, the log containing the anomalous keyword's subsequent associated anomalous keyword is placed after the log containing the anomalous keyword, and the time difference between the log time in the log containing the anomalous keyword's subsequent associated anomalous keyword and the log time in the log containing the anomalous keyword is less than a specified duration, and the difference between the sort order number of the log containing the anomalous keyword's subsequent associated anomalous keyword and the sort order number of the log time in the log sequence is less than a specified value. For example, the specified duration is 5 seconds, 10 seconds, or 15 seconds. The specified value is 3 or 6.

[0042] Optionally, for each abnormal keyword with subsequent associated abnormal keywords, the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords can also be such that the log containing the abnormal keyword in the log sequence is placed after the log containing the abnormal keyword, and the time difference between the log time in the log containing the abnormal keyword and the log time in the log containing the abnormal keyword is less than a specified duration.

[0043] Optionally, for each abnormal keyword with subsequent associated abnormal keywords, the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords can also be such that the log containing the abnormal keyword in the log sequence is placed after the log containing the abnormal keyword, and the difference between the sorting number of the log containing the abnormal keyword in the log sequence and the sorting number of the log time in the log sequence is less than a specified value.

[0044] Optionally, the keyword relationship description information for abnormal keywords includes the abnormal keyword and its subsequent associated abnormal keywords. For each abnormal keyword with subsequent associated abnormal keywords, the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords can be determined based on the keyword relationship description information. This involves identifying logs containing the abnormal keyword and logs containing its subsequent associated abnormal keywords within the log sequence. Then, based on these logs, the keyword relationship described in the keyword relationship description information is checked to see if it is satisfied.

[0045] Optionally, for each abnormal keyword among the abnormal keywords of the abnormal operation to be monitored that does not have any subsequent associated abnormal keywords, the matching rule information corresponding to the abnormal operation to be monitored will not include the keyword relationship description information of the abnormal keyword, that is, the keyword relationship description information of the abnormal keyword is empty.

[0046] Optionally, the matching rule information corresponding to the abnormal operation to be monitored, input by the user, can be obtained, including: obtaining the matching rule information corresponding to the abnormal operation to be monitored, input by the user, through the log sequence management page.

[0047] Optionally, the log sequence management page can be a page set up on an electronic device for interacting with the user, obtaining user-inputted information related to the log sequence, or providing the user with information related to the log sequence. The log sequence management page includes a rule information input area and a confirmation control. The rule information input area can be a page area set up on the log sequence management page for inputting matching rule information corresponding to the abnormal operation to be monitored. The user can fill in the matching rule information corresponding to the abnormal operation to be monitored in the rule information input area, thereby inputting the matching rule information corresponding to the abnormal operation to be monitored. The text entered in the rule information input area can be retrieved. The confirmation control can be a control used to confirm that the matching rule information corresponding to the abnormal operation to be monitored has been entered. The user can click the confirmation control to confirm that the operation of entering the matching rule information corresponding to the abnormal operation to be monitored has been completed. The confirmation control can be detected to see if it has been clicked. After completing the operation of filling in the matching rule information corresponding to the abnormal operation to be monitored in the rule information input area, the user can click the confirmation control to confirm that the operation of entering the matching rule information corresponding to the abnormal operation to be monitored has been completed. Each time a confirmation control is clicked, the latest text entered in the rule information input area can be identified as the matching rule information corresponding to the abnormal operation to be monitored, and the matching rule information corresponding to the abnormal operation to be monitored can be obtained through the log sequence management page.

[0048] Step 102: Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, establish the rule state diagram of the matching rule information.

[0049] Optionally, the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored is a structural diagram that represents the keyword relationships between the abnormal keywords of the abnormal operation to be monitored, the abnormal keywords among the abnormal keywords that have subsequent related abnormal keywords, and the subsequent related abnormal keywords of the abnormal keywords. This structure consists of abnormal keyword nodes representing each abnormal keyword in the matching rule information corresponding to the abnormal operation to be monitored, connection edges between abnormal keyword nodes that have connections, attribute information of the connection edges, and node information bound to the keyword nodes.

[0050] Optionally, based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, a rule state diagram of the matching rule information is established, including: extracting each abnormal keyword from the matching rule information, and using each abnormal keyword as a keyword node to represent each abnormal keyword; for each abnormal keyword, extracting the keyword relationship description information of the abnormal keyword from the matching rule information, determining the subsequent related abnormal keywords of the abnormal keyword based on the extracted keyword relationship description information, and establishing the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent related abnormal keywords of the abnormal keyword. The connection between points is used to obtain the connection edges between the abnormal keyword node corresponding to the abnormal keyword and the subsequent associated abnormal keyword node corresponding to the abnormal keyword. The keyword relationship description information of the abnormal keyword is determined as the attribute information of the connection edges between the abnormal keyword node corresponding to the abnormal keyword and the subsequent associated abnormal keyword node corresponding to the abnormal keyword. The alarm operation logic information in the matching rule information is extracted to determine the terminating keyword node in each keyword node. The extracted alarm operation logic information is determined as the node information bound to the terminating keyword node. All keyword nodes, the connection edges between keyword nodes, the attribute information of the connection edges between keyword nodes, and the node information bound to the keyword nodes are aggregated to obtain the rule state diagram of the matching rule information.

[0051] Optionally, keyword nodes are nodes used to represent anomalous keywords. For each anomalous keyword in the matching rule information corresponding to the anomalous operation to be monitored, the anomalous keyword can be extracted from the matching rule information corresponding to the anomalous operation to be monitored, and used as a keyword node to represent the anomalous keyword. Thus, the keyword nodes corresponding to each anomalous keyword in the matching rule information corresponding to the anomalous operation to be monitored are obtained.

[0052] Optionally, after obtaining the keyword nodes corresponding to each abnormal keyword, for each abnormal keyword, keyword relationship description information can be extracted from the matching rule information corresponding to the abnormal operation to be monitored. If the extracted keyword relationship description information is not empty, it can be determined that the abnormal keyword has subsequent associated abnormal keywords. Based on the subsequent associated abnormal keywords contained in the keyword relationship description information, the subsequent associated abnormal keywords can be determined. Then, a connection is established between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword, obtaining the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword. The keyword relationship description information of the abnormal keyword is determined as the attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword. The abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword are the abnormal keyword nodes with a connection relationship. The connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword is used to characterize the keyword relationship between the abnormal keyword and the subsequent associated abnormal keyword. The attribute information of the connecting edges can be used to describe the keyword relationship represented by the connecting edges. If no keyword relationship description information is extracted for the abnormal keyword, or if the keyword relationship description information for the abnormal keyword is empty, it can be determined that the abnormal keyword does not have any subsequent associated abnormal keywords, and other abnormal keywords can continue to be processed.

[0053] Optionally, alarm operation logic information can be extracted from the matching rule information corresponding to the abnormal operation to be monitored. The terminating keyword node in each keyword node can be a keyword node whose corresponding abnormal keyword has no subsequent associated abnormal keywords. The node information bound to the terminating keyword node can be information used to instruct the execution of an alarm operation for the abnormal operation to be monitored. The terminating keyword node in each keyword node can be determined, and the extracted alarm operation logic information can be identified as the node information bound to the terminating keyword node.

[0054] Optionally, after obtaining the keyword nodes used to characterize the abnormal operation to be monitored, the connection edges used to characterize the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords, the attribute information of the connection edges used to characterize the keyword relationship between the abnormal keyword and its subsequent associated abnormal keywords, and the node information bound to the terminating keyword node, all keyword nodes, all connection edges, the attribute information of all connection edges, and the node information bound to the keyword nodes are aggregated to obtain a rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored.

[0055] Optionally, it also includes displaying the rule status graph of the matching rule information on the log sequence management page.

[0056] Optionally, the log sequence management page includes a status graph display area. This status graph display area can be a page area set within the log sequence management page for displaying the rule status graph of the matching rule information corresponding to the abnormal operation to be monitored. The rule status graph of the matching rule information corresponding to the abnormal operation to be monitored can be displayed on the status graph display area of ​​the log sequence management page, making it convenient for users to browse the rule status graph of the matching rule information corresponding to the abnormal operation to be monitored.

[0057] Step 103: After obtaining the log sequence to be matched, match the log sequence to be matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram.

[0058] Optionally, the log sequence to be matched can refer to the log sequence that needs to be matched. The log sequence to be matched can be sent to electronic devices by business systems or users. It can detect whether the electronic device has received the log sequence to be matched. After each detection that the electronic device has received the log sequence to be matched, the received log sequence to be matched is obtained, and then the log sequence to be matched is matched with the keyword node in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored. It is determined whether the log sequence to be matched hits the keyword node in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored and satisfies the keyword relationship description information in the rule state diagram.

[0059] Optionally, the keyword nodes in the rule state diagram of the log sequence to be matched that match the matching rule information corresponding to the abnormal operation to be monitored can refer to all keyword nodes in the rule state diagram that detect the log sequence to be matched containing the matching rule information corresponding to the abnormal operation to be monitored. The keyword nodes in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored are the various abnormal keywords of the abnormal operation to be monitored.

[0060] Optionally, the keyword relationship description information in the rule state graph of the log sequence to be matched, which corresponds to the matching rule information of the abnormal operation to be monitored, can refer to the ability, for each keyword relationship description information in the rule state graph, to determine whether the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keyword described by the keyword relationship description information is satisfied, based on the logs in the log sequence to be matched that contain the abnormal keyword described by the keyword relationship description information and the logs that contain the subsequent associated abnormal keywords of the abnormal keyword described by the keyword relationship description information. The attribute information of each connection edge in the rule state graph of the matching rule information corresponding to the abnormal operation to be monitored is the keyword relationship description information in the rule state graph.

[0061] Generally, when the log sequence to be matched hits the keyword node in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored, and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram of the matching rule information corresponding to the abnormal operation to be monitored, it can be determined that the abnormal operation to be monitored has occurred.

[0062] Optionally, matching the log sequence to be matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram includes: detecting whether the log sequence to be matched contains all keyword nodes in the rule state diagram; if it is detected that the log sequence to be matched contains all keyword nodes in the rule state diagram, then it is determined that the log sequence to be matched hits a keyword node in the rule state diagram; for each keyword relationship description information in the rule state diagram, based on the logs in the log sequence to be matched that contain the abnormal keywords described by the keyword relationship description information and the logs that contain the subsequent associated abnormal keywords of the abnormal keywords described by the keyword relationship description information, detecting whether the keyword relationship between the abnormal keywords described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keywords is satisfied; if it is detected that all keyword relationship description information in the rule state diagram is satisfied, then it is determined that the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram.

[0063] Optionally, it further includes: if it is detected that the log sequence to be matched does not contain all the keyword nodes in the rule state diagram, then it is determined that the log sequence to be matched does not hit any keyword node in the rule state diagram; if it is detected that any keyword relationship description information in the rule state diagram is not satisfied, then it is determined that the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram.

[0064] Optionally, for each keyword node in the rule state graph, it can be checked whether there are logs containing the keyword node in the log sequence to be matched. If a log containing the keyword node is detected in the log sequence to be matched, it can be determined that the log sequence to be matched contains the keyword node. If no log containing the keyword node is detected in the log sequence to be matched, it can be determined that the log sequence to be matched does not contain the keyword node. If the log sequence to be matched contains all the keyword nodes in the rule state graph, it can be determined that the log sequence to be matched matches the keyword nodes in the rule state graph. If the log sequence to be matched does not contain all the keyword nodes in the rule state graph, it can be determined that the log sequence to be matched does not match the keyword nodes in the rule state graph.

[0065] Optionally, after determining that the log sequence to be matched hits the keyword node in the rule state diagram, for each keyword relationship description information in the rule state diagram, based on the logs in the log sequence to be matched that contain the abnormal keywords described by the keyword relationship description information and the logs that contain the subsequent associated abnormal keywords of the abnormal keywords described by the keyword relationship description information, it can be checked whether the keyword relationship between the abnormal keywords described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keywords is satisfied.

[0066] Optionally, the keyword relationship description information includes anomalous keywords and their subsequent associated anomalous keywords. The anomalous keywords and their subsequent associated anomalous keywords described in the keyword relationship description information refer to the anomalous keywords and their subsequent associated anomalous keywords contained within the keyword relationship description information. For each piece of keyword relationship description information in the rule state diagram, the anomalous keywords and their subsequent associated anomalous keywords described in the keyword relationship description information can be determined based on these anomalous keywords. This also determines the logs in the log sequence to be matched that contain the anomalous keywords described in the keyword relationship description information, and the logs in the log sequence to be matched that contain the subsequent associated anomalous keywords described in the keyword relationship description information. The keyword relationship between the anomalous keywords and their subsequent associated anomalous keywords described in the keyword relationship description information can be determined based on the keyword relationship description information.

[0067] Optionally, if the keyword relationship between the abnormal keyword described in the keyword relationship description information and its subsequent associated abnormal keywords in the log sequence is such that the log containing the abnormal keyword's subsequent associated abnormal keyword is ranked after the log containing the abnormal keyword, and the time difference between the log time in the log containing the abnormal keyword's subsequent associated abnormal keyword and the log time in the log containing the abnormal keyword is less than a specified duration, and the difference between the sort order number of the log containing the abnormal keyword's subsequent associated abnormal keyword and the sort order number of the log time in the log sequence is less than a specified value, then it is determined whether the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is ranked after the log containing the abnormal keyword. Following the logs of the abnormal keywords described in the keyword relationship description information, determine whether the time difference between the log time of the log of the abnormal keyword described in the keyword relationship description information and the log time of the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is less than a specified duration. Also determine whether the difference between the sort order number of the log of the abnormal keyword described in the keyword relationship description information and the sort order number of the log of the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is less than a specified value. If, in the log sequence to be matched, the log containing the abnormal keyword described by the keyword relationship description information is ranked after the log containing the subsequent associated abnormal keyword described by the keyword relationship description information, and the time difference between the log time of the subsequent associated abnormal keyword in the log sequence to be matched is less than a specified duration, and the difference between the sort order number of the subsequent associated abnormal keyword in the log sequence to be matched is less than a specified value, then the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword is satisfied. If, in the log sequence to be matched, the log containing the abnormal keyword described by the keyword relationship description information is not ranked after the log containing the subsequent associated abnormal keyword, then the keyword relationship between the abnormal keyword described by the keyword relationship description information and the subsequent associated abnormal keyword is not satisfied.If the time difference between the log time of the log containing the abnormal keyword described in the keyword relationship description information and the log time of the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is greater than or equal to a specified duration, then it is determined that the keyword relationship between the abnormal keyword described in the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied. If the difference between the sort order number of the log containing the abnormal keyword described in the keyword relationship description information and the sort order number of the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is greater than or equal to a specified value, then it is determined that the keyword relationship between the abnormal keyword described in the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.

[0068] Optionally, if the keyword relationship between the abnormal keyword described in the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is such that the log containing the subsequent associated abnormal keyword in the log sequence is placed after the log containing the abnormal keyword, and the time difference between the log time in the log containing the subsequent associated abnormal keyword and the log time in the log containing the abnormal keyword is less than a specified duration, then it is determined whether the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is placed after the log containing the subsequent associated abnormal keyword described in the keyword relationship description information, and whether the time difference between the log time in the log containing the subsequent associated abnormal keyword described in the keyword relationship description information in the log sequence to be matched and the log time in the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is less than a specified duration. If the logs containing the abnormal keywords described in the keyword relationship description information in the log sequence to be matched are listed after the logs containing subsequent associated abnormal keywords, and the time difference between the log timestamps of these associated abnormal keywords and the log timestamps of the abnormal keywords in the log sequence to be matched is less than a specified duration, then the keyword relationship between the abnormal keywords described in the keyword relationship description information and their subsequent associated abnormal keywords is satisfied. If the logs containing the abnormal keywords described in the keyword relationship description information in the log sequence to be matched are not listed after the logs containing these associated abnormal keywords, then the keyword relationship between these associated abnormal keywords and their subsequent associated abnormal keywords is not satisfied. If the time difference between the log timestamps of these associated abnormal keywords and the log timestamps of these associated abnormal keywords in the log sequence to be matched is greater than or equal to a specified duration, then the keyword relationship between these associated abnormal keywords and their subsequent associated abnormal keywords is not satisfied.

[0069] Optionally, if the keyword relationship between the abnormal keyword described in the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is such that the log containing the subsequent associated abnormal keyword in the log sequence is ranked after the log containing the abnormal keyword, and the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword in the log sequence and the sorting sequence number of the log time in the log sequence is less than a specified value, then it is determined whether the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is ranked after the log containing the subsequent associated abnormal keyword described in the keyword relationship description information, and whether the difference between the sorting sequence number of the log containing the subsequent associated abnormal keyword described in the keyword relationship description information in the log sequence to be matched and the sorting sequence number of the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is less than a specified value. If a log entry in the log sequence to be matched that contains the abnormal keyword described by the keyword relationship description information is ranked after a subsequent associated abnormal keyword, and the difference between the ranking number of the subsequent associated abnormal keyword in the log sequence to be matched and the ranking number of the log entry containing the abnormal keyword described by the keyword relationship description information is less than a specified value, then the keyword relationship between the abnormal keyword described by the keyword relationship description information and its subsequent associated abnormal keyword is satisfied. If a log entry in the log sequence to be matched that contains the abnormal keyword described by the keyword relationship description information is not ranked after a subsequent associated abnormal keyword, then the keyword relationship between the abnormal keyword described by the keyword relationship description information and its subsequent associated abnormal keyword is not satisfied. If the difference between the sorting order of the log containing the abnormal keyword described in the keyword relationship description information and the sorting order of the log containing the abnormal keyword described in the keyword relationship description information in the log sequence to be matched is greater than or equal to a specified value, then it is determined that the keyword relationship between the abnormal keyword described in the keyword relationship description information and the subsequent associated abnormal keyword of the abnormal keyword is not satisfied.

[0070] Optionally, if all keyword relationship descriptions in the rule state diagram are satisfied, it can be determined that the log sequence to be matched satisfies the keyword relationship descriptions in the rule state diagram. If any keyword relationship description in the rule state diagram is not satisfied, it is determined that the log sequence to be matched does not satisfy the keyword relationship descriptions in the rule state diagram.

[0071] Step 104: When it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information.

[0072] Optionally, when it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it can be determined that an abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information in the rule state diagram. Executing the alarm operation according to the alarm operation logic information in the rule state diagram includes: extracting the alarm information corresponding to the abnormal operation to be monitored from the alarm operation logic information, and sending the alarm information corresponding to the abnormal operation to be monitored to the target user. The alarm information corresponding to the abnormal operation to be monitored can be a text set to indicate that the abnormal operation to be monitored has occurred and needs to be handled promptly. The target user can be a technical personnel in the enterprise responsible for handling abnormal operations on business systems.

[0073] Optionally, the process further includes: when it is determined that the log sequence to be matched does not match a keyword node in the rule state diagram or does not satisfy the keyword relationship description information in the rule state diagram, it is determined that no abnormal operation to be monitored has occurred, and the current log sequence matching process is terminated. Typically, when the log sequence to be matched does not match a keyword node in the rule state diagram corresponding to the abnormal operation to be monitored, or when the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram corresponding to the abnormal operation to be monitored, it can be determined that no abnormal operation to be monitored has occurred, and the current log sequence matching process is terminated.

[0074] The technical solution of this invention involves obtaining matching rule information corresponding to the abnormal operation to be monitored, input by the user. This matching rule information includes identification information, alarm operation logic information, various abnormal keywords of the abnormal operation to be monitored, and keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. Then, based on the alarm operation logic information, the various abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored, a rule state diagram of the matching rule information is established. After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram. When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and... When the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that an abnormal operation to be monitored has occurred. An alarm operation is then executed according to the alarm operation logic information. This solves the problems of high time and manpower costs, low efficiency, and difficulty in guaranteeing accuracy in related log sequence matching schemes. Based on the matching rule information input by the user, a rule state diagram is constructed to represent each abnormal keyword of the abnormal operation to be monitored, the abnormal keywords among each abnormal keyword that have subsequent related abnormal keywords, and the keyword relationships between the subsequent related abnormal keywords. After obtaining the log sequence to be matched, the system can automatically and quickly match the log sequence with the abnormal keywords of the abnormal operation based on the constructed rule state diagram to determine whether an abnormal operation has occurred. Once an abnormal operation is determined, an alarm operation is executed, reducing the time and manpower costs of the log sequence matching process and improving its efficiency and accuracy.

[0075] Example 2

[0076] Figure 2 This is a flowchart illustrating a log sequence matching method according to Embodiment 2 of the present invention. This embodiment of the present invention can be combined with various optional solutions from one or more of the above embodiments. For example... Figure 2 As shown, the method includes:

[0077] Step 201: Obtain the matching rule information corresponding to the abnormal operation to be monitored by the user input through the log sequence management page.

[0078] The matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords.

[0079] Step 202: Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, establish the rule state diagram of the matching rule information.

[0080] Step 203: Display the rule status diagram of the matching rule information on the log sequence management page.

[0081] Step 204: After obtaining the log sequence to be matched, match the log sequence to be matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram.

[0082] Step 205: When it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information.

[0083] The technical solution of this invention allows users to obtain matching rule information corresponding to the abnormal operation to be monitored, input by the user, through an interactive page. Based on the matching rule information, a rule state diagram can be constructed to represent the abnormal keywords of the abnormal operation to be monitored, the abnormal keywords among the abnormal keywords that have subsequent related abnormal keywords, and the keyword relationships between the subsequent related abnormal keywords of the abnormal keywords. The rule state diagram can be visualized through the interactive page. After obtaining the log sequence to be matched, the system can automatically and quickly match the log sequence with the abnormal keywords of the abnormal operation based on the constructed rule state diagram to determine whether an abnormal operation has occurred. After determining that an abnormal operation has occurred, an alarm operation is executed, reducing the time and manpower costs of the log sequence matching process and improving the efficiency and accuracy of the log sequence matching process.

[0084] Example 3

[0085] Figure 3 This is a schematic diagram of a log sequence matching device according to Embodiment 3 of the present invention. The device can be configured in an electronic device. Figure 3 As shown, the device includes: an information acquisition module 301, a state diagram establishment module 302, a sequence matching module 303, and an alarm operation execution module 304.

[0086] The information acquisition module 301 is used to acquire matching rule information corresponding to the abnormal operation to be monitored, input by the user. The matching rule information includes identification information, alarm operation logic information, various abnormal keywords of the abnormal operation to be monitored, and keyword relationship description information of abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. The state graph establishment module 302 is used to establish the state graph based on the alarm operation logic information, various abnormal keywords of the abnormal operation to be monitored, and keyword relationship description information of abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. A rule state diagram for the matching rule information is established; a sequence matching module 303 is used to match the log sequence to be matched and the keyword nodes in the rule state diagram after obtaining the log sequence to be matched, and determine whether the log sequence to be matched hits the keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; an alarm operation execution module 304 is used to determine that the abnormal operation to be monitored has occurred when it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, and execute an alarm operation according to the alarm operation logic information.

[0087] The technical solution of this invention involves obtaining matching rule information corresponding to the abnormal operation to be monitored, input by the user. This matching rule information includes identification information, alarm operation logic information, various abnormal keywords of the abnormal operation to be monitored, and keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. Then, based on the alarm operation logic information, the various abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information for abnormal keywords among the abnormal keywords of the abnormal operation to be monitored, a rule state diagram of the matching rule information is established. After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram. When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and... When the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that an abnormal operation to be monitored has occurred. An alarm operation is then executed according to the alarm operation logic information. This solves the problems of high time and manpower costs, low efficiency, and difficulty in guaranteeing accuracy in related log sequence matching schemes. Based on the matching rule information input by the user, a rule state diagram is constructed to represent each abnormal keyword of the abnormal operation to be monitored, the abnormal keywords among each abnormal keyword that have subsequent related abnormal keywords, and the keyword relationships between the subsequent related abnormal keywords. After obtaining the log sequence to be matched, the system can automatically and quickly match the log sequence with the abnormal keywords of the abnormal operation based on the constructed rule state diagram to determine whether an abnormal operation has occurred. Once an abnormal operation is determined, an alarm operation is executed, reducing the time and manpower costs of the log sequence matching process and improving its efficiency and accuracy.

[0088] In an optional embodiment of the present invention, the information acquisition module 301 is specifically used to: acquire matching rule information corresponding to the abnormal operation to be monitored, input by the user, through the log sequence management page.

[0089] In an optional embodiment of the present invention, the state graph establishment module 302 is specifically configured to: extract each abnormal keyword from the matching rule information, and use each abnormal keyword as a keyword node to represent each abnormal keyword; for each abnormal keyword, extract the keyword relationship description information of the abnormal keyword from the matching rule information, determine the subsequent associated abnormal keywords of the abnormal keyword based on the extracted keyword relationship description information, establish a connection between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword, obtain the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword, and determine the keyword relationship description information of the abnormal keyword as the attribute information of the connection edge between the abnormal keyword node corresponding to the abnormal keyword and the abnormal keyword node corresponding to the subsequent associated abnormal keyword; extract the alarm operation logic information from the matching rule information, determine the termination keyword node in each keyword node, and determine the extracted alarm operation logic information as the node information bound to the termination keyword node; and aggregate all keyword nodes, the connection edges between keyword nodes, the attribute information of the connection edges between keyword nodes, and the node information bound to the keyword nodes to obtain the rule state graph of the matching rule information.

[0090] In an optional embodiment of the present invention, the sequence matching module 303, when performing the operation of matching the log sequence to be matched and the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram, is specifically configured to: detect whether the log sequence to be matched contains all the keyword nodes in the rule state diagram; if it is detected that the log sequence to be matched contains all the keyword nodes in the rule state diagram, then it is determined that the log sequence to be matched hits the keyword nodes in the rule state diagram; for each keyword relationship description information in the rule state diagram, based on the logs in the log sequence to be matched that contain the abnormal keywords described by the keyword relationship description information and the logs that contain the subsequent associated abnormal keywords of the abnormal keywords described by the keyword relationship description information, detect whether the keyword relationship between the abnormal keywords described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keywords is satisfied; if it is detected that all the keyword relationship description information in the rule state diagram is satisfied, then it is determined that the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram.

[0091] In an optional embodiment of the present invention, the sequence matching module 303 is further configured to: if it is detected that the log sequence to be matched does not contain all the keyword nodes in the rule state diagram, then determine that the log sequence to be matched does not match any keyword node in the rule state diagram; if it is detected that any keyword relationship description information in the rule state diagram is not satisfied, then determine that the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram.

[0092] In an optional embodiment of the present invention, the system may further include: an end module, configured to determine that no abnormal operation to be monitored has occurred and to end the current log sequence matching process when it is determined that the log sequence to be matched does not hit the keyword node in the rule state diagram or the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram.

[0093] In an optional embodiment of the present invention, the system may further include: a status diagram display module, used to display the rule status diagram of the matching rule information on the log sequence management page.

[0094] The log sequence matching device provided in this embodiment of the invention can execute the log sequence matching method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0095] Example 4

[0096] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement the log sequence matching method of embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, electronic devices, blade electronic devices, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0097] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory 12 or a random access memory 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 12 or loaded from storage unit 18 into the random access memory 13. The random access memory 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, read-only memory 12, and random access memory 13 are interconnected via a bus 14. An input / output interface 15 is also connected to the bus 14.

[0098] Multiple components in electronic device 10 are connected to input / output interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of monitors, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0099] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as log sequence matching methods.

[0100] In some embodiments, the log sequence matching method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on a heterogeneous hardware accelerator via read-only memory and / or a communication unit. When the computer program is loaded into random access memory and executed by a processor, one or more steps of the log sequence matching method described above may be performed. Alternatively, in other embodiments, the processor may be configured to perform the log sequence matching method by any other suitable means (e.g., by means of firmware).

[0101] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices (PLCs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0102] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or electronic device.

[0103] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0104] To provide user interaction, the systems and techniques described herein can be implemented on a heterogeneous hardware accelerator, which includes: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the heterogeneous hardware accelerator. Other types of devices can also be used to provide user interaction; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or haptic feedback); and input from the user can be received in any form (including sound input, voice input, or haptic input).

[0105] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data electronic devices), or computing systems that include middleware components (e.g., application electronic devices), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0106] A computing system can include clients and electronic devices. Clients and electronic devices are generally geographically separated and typically interact via communication networks. The client-electronic device relationship is created by computer programs running on the respective computers and establishing a client-electronic device relationship between them. Electronic devices can be cloud electronic devices, also known as cloud computing electronic devices or cloud servers, which are host products within the cloud computing service system. These address the shortcomings of traditional physical hosts and virtual private server services, such as high management difficulty and weak business scalability.

[0107] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0108] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A log sequence matching method, characterized in that, include: Obtain the matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords; Based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords, a rule state diagram of the matching rule information is established; wherein, each abnormal keyword is extracted from the matching rule information, and each abnormal keyword is used as a keyword node to represent each abnormal keyword; for each abnormal keyword, the keyword relationship description information of the abnormal keyword is extracted from the matching rule information, and the subsequent related abnormal keywords of the abnormal keyword are determined according to the extracted keyword relationship description information, and an abnormal keyword node corresponding to the abnormal keyword and an abnormal keyword node corresponding to the subsequent related abnormal keywords of the abnormal keyword are established. The connection between the abnormal keywords is obtained by connecting the abnormal keyword nodes and the subsequent associated abnormal keyword nodes. The keyword relationship description information of the abnormal keywords is determined as the attribute information of the connection edges between the abnormal keyword nodes and the subsequent associated abnormal keyword nodes. The alarm operation logic information in the matching rule information is extracted to determine the terminating keyword node in each keyword node. The extracted alarm operation logic information is determined as the node information bound to the terminating keyword node. All keyword nodes, the connection edges between keyword nodes, the attribute information of the connection edges between keyword nodes, and the node information bound to the keyword nodes are aggregated to obtain the rule state diagram of the matching rule information. After obtaining the log sequence to be matched, the log sequence to be matched is matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram; When it is determined that the log sequence to be matched hits a keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, it is determined that the abnormal operation to be monitored has occurred, and an alarm operation is executed according to the alarm operation logic information.

2. The log sequence matching method according to claim 1, characterized in that, Obtain the matching rule information corresponding to the abnormal operation to be monitored, based on user input, including: Through the log sequence management page, obtain the matching rule information corresponding to the abnormal operation to be monitored, which is input by the user.

3. The log sequence matching method according to claim 1, characterized in that, Matching the log sequence to be matched with the keyword nodes in the rule state diagram to determine whether the log sequence to be matched hits a keyword node in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram includes: Detect whether the log sequence to be matched contains all the keyword nodes in the rule state graph; If the log sequence to be matched is detected to contain all the keyword nodes in the rule state graph, then it is determined that the log sequence to be matched matches the keyword nodes in the rule state graph; For each keyword relationship description information in the rule state diagram, based on the logs containing the abnormal keywords described by the keyword relationship description information and the logs containing the subsequent associated abnormal keywords of the abnormal keywords described by the keyword relationship description information in the log sequence to be matched, it is detected whether the keyword relationship between the abnormal keywords described by the keyword relationship description information and the subsequent associated abnormal keywords of the abnormal keywords is satisfied. If all keyword relationship descriptions in the rule state diagram are satisfied, then the log sequence to be matched is determined to satisfy the keyword relationship descriptions in the rule state diagram.

4. The log sequence matching method according to claim 3, characterized in that, Also includes: If it is detected that the log sequence to be matched does not contain all the keyword nodes in the rule state diagram, then it is determined that the log sequence to be matched does not match any keyword nodes in the rule state diagram. If any keyword relationship description information in the rule state diagram is not satisfied, it is determined that the log sequence to be matched does not satisfy the keyword relationship description information in the rule state diagram.

5. The log sequence matching method according to claim 1, characterized in that, Also includes: When it is determined that the log sequence to be matched does not match any keyword node in the rule state diagram or does not satisfy the keyword relationship description information in the rule state diagram, it is determined that no abnormal operation to be monitored has occurred, and the current log sequence matching process is determined to end.

6. The log sequence matching method according to claim 1, characterized in that, Also includes: The rule status graph of the matching rule information is displayed on the log sequence management page.

7. A log sequence matching device, characterized in that, include: The information acquisition module is used to acquire matching rule information corresponding to the abnormal operation to be monitored, which is input by the user; wherein, the matching rule information includes identification information, alarm operation logic information, each abnormal keyword of the abnormal operation to be monitored, and keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. The state diagram establishment module is used to establish a rule state diagram of the matching rule information based on the alarm operation logic information in the matching rule information, the abnormal keywords of the abnormal operation to be monitored, and the keyword relationship description information of the abnormal keywords of the abnormal operation to be monitored that have subsequent related abnormal keywords. Specifically, it extracts each abnormal keyword from the matching rule information and uses each abnormal keyword as a keyword node to represent it. For each abnormal keyword, it extracts the keyword relationship description information from the matching rule information, determines the subsequent related abnormal keywords based on the extracted keyword relationship description information, and establishes the abnormal keyword node corresponding to the abnormal keyword and the abnormal relationship node corresponding to the subsequent related abnormal keywords. The connections between keyword nodes are used to obtain the connection edges between the abnormal keyword node corresponding to the abnormal keyword and the subsequent associated abnormal keyword node corresponding to the abnormal keyword. The keyword relationship description information of the abnormal keyword is determined as the attribute information of the connection edges between the abnormal keyword node corresponding to the abnormal keyword and the subsequent associated abnormal keyword node corresponding to the abnormal keyword. The alarm operation logic information in the matching rule information is extracted to determine the terminating keyword node in each keyword node. The extracted alarm operation logic information is determined as the node information bound to the terminating keyword node. All keyword nodes, the connection edges between keyword nodes, the attribute information of the connection edges between keyword nodes, and the node information bound to the keyword nodes are aggregated to obtain the rule state diagram of the matching rule information. The sequence matching module is used to match the log sequence to be matched with the keyword nodes in the rule state diagram after obtaining the log sequence to be matched, and to determine whether the log sequence to be matched hits the keyword nodes in the rule state diagram and satisfies the keyword relationship description information in the rule state diagram. The alarm operation execution module is used to determine that the monitored abnormal operation has occurred when it is determined that the log sequence to be matched hits the keyword node in the rule state diagram and the log sequence to be matched satisfies the keyword relationship description information in the rule state diagram, and to execute the alarm operation according to the alarm operation logic information.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that is executed by the at least one processor, which enables the at least one processor to perform the log sequence matching method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the log sequence matching method according to any one of claims 1-6.

Images