Network security analysis method and system based on system log audit analysis

Abstract

The invention provides a network security analysis method and system based on system log auditing analysis, and belongs to the technical field of network security. Behavior chain knitting processing is executed on a streaming log sequence by capturing the streaming log sequence generated by network nodes of a power monitoring system in real time, and the network security is obtained. Associating continuous operation record entries of the same operation main body to form a dynamic behavior chain, performing mode matching on the dynamic behavior chain based on a preset security rule base, identifying candidate behavior fragments, performing reverse traceability analysis on the candidate behavior fragments, constructing a risk diffusion diagram, and performing risk analysis on the risk diffusion diagram. And finally, generating a security analysis report containing a risk source node, a diffusion path and an affected resource list, and pushing the security analysis report to a security management and control center, so that the real-time performance, accuracy and comprehensiveness of network security analysis of the power monitoring system can be effectively improved, and safe and stable operation of the power system is ensured.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a network security analysis method and system based on system log audit analysis. Background Technology

[0002] In the field of power monitoring systems, with the continuous expansion of the power grid and the increasing level of intelligence, the number of network nodes covered by power monitoring systems has increased dramatically. These nodes encompass various equipment and control terminals in all aspects of power generation, transmission, transformation, distribution, and consumption. During operation, these network nodes generate massive amounts of system logs. These logs record in detail key information such as the working status of power equipment, the execution of operating instructions, and the transmission and interaction of data. They are important evidence reflecting the operating status and security situation of the power monitoring system.

[0003] Currently, commonly used network security analysis methods in power monitoring systems have many shortcomings. On the one hand, traditional log analysis methods often employ periodic batch processing for offline analysis of log data. This approach cannot capture the dynamic changes of the power monitoring system in real time, making it difficult to promptly detect ongoing network security threats, such as real-time intrusions and abnormal operations. This may result in untimely handling of security incidents, thereby affecting the stable operation of the power system. On the other hand, existing analysis methods process log data in a relatively isolated manner, focusing only on single log records or simple log combinations, lacking in-depth analysis of the temporal and correlational relationships between logs. Operational behaviors in power monitoring systems are often continuous and interconnected; for example, operation on a certain device may trigger a series of subsequent operations and data interactions. Traditional analysis methods struggle to identify these complex operational behavior patterns and cannot accurately determine whether potential security risks exist, such as unauthorized cross-regional operations or malicious data tampering. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a network security analysis method based on system log audit analysis, the method comprising: Real-time capture of streaming log sequences generated by network nodes, wherein the streaming log sequences contain operation record entries generated sequentially in time order, and each operation record entry carries a node identifier, operation behavior description and trigger time information; The streaming log sequence is subjected to behavior chain weaving processing, which associates consecutive operation record entries belonging to the same operation subject into a dynamic behavior chain. The dynamic behavior chain includes the temporal connection relationship of operation behaviors and resource access links. Based on a preset security rule base, the dynamic behavior chain is pattern matched to identify candidate behavior segments that conform to potential risk patterns. The potential risk patterns include unauthorized access sequences, cross-node abnormal jump sequences, and resource abuse sequences. Reverse source tracing analysis is performed on the candidate behavior fragments to track the preceding related logs and subsequent derived logs in the streaming log sequence and construct a risk diffusion diagram; Based on the risk diffusion map, a security analysis report is generated that includes the risk source node, diffusion path, and list of affected resources, and the security analysis report is pushed to the security control center.

[0005] In another aspect, embodiments of the present invention also provide a network security analysis system based on system log audit analysis, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0006] Based on the above, this embodiment of the invention, by capturing the streaming log sequences generated by network nodes of a power monitoring system in real time, can obtain operation record entries continuously generated by each node in the system in chronological order. These entries contain node identifiers, operation behavior descriptions, and trigger time information. Behavior chain weaving processing is performed on the streaming log sequences, associating consecutive operation record entries of the same operator into a dynamic behavior chain. This analyzes the temporal connection relationship and resource access links between operation behaviors. Compared to the traditional method of analyzing log entries in isolation, this provides a more comprehensive and accurate understanding of the operation patterns in the power monitoring system, effectively identifying potential security risks hidden in complex operation processes. Pattern matching of the dynamic behavior chains based on a preset security rule base can accurately locate candidate behavior segments that match potential risk patterns, such as unauthorized access sequences, cross-node abnormal jump sequences, and resource abuse sequences. This improves the accuracy and targeting of security threat identification and reduces the occurrence of false positives and false negatives. By performing reverse source tracing analysis on candidate behavior fragments, tracking their preceding related logs and subsequent derived logs in the streaming log sequence, and constructing a risk diffusion graph, the path of risk from its source to its spread and the scope of affected resources can be presented. Finally, based on the risk diffusion graph, a security analysis report containing the risk source node, diffusion path, and list of affected resources is generated and pushed to the security control center. This helps to take measures quickly and effectively to curb the spread of security risks, ensure the safe and stable operation of the power monitoring system, and realize efficient management of the entire process of network security threats to the power monitoring system from real-time monitoring and accurate identification to comprehensive source tracing and effective response. Attached Figure Description

[0007] Figure 1This is a schematic diagram of the execution flow of the network security analysis method based on system log audit analysis provided in the embodiments of the present invention.

[0008] Figure 2 This is a schematic diagram of exemplary hardware and software components of a network security analysis system based on system log audit analysis provided in an embodiment of the present invention. Detailed Implementation

[0009] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a network security analysis method based on system log audit analysis provided in one embodiment of the present invention. The following is a detailed description of this network security analysis method based on system log audit analysis.

[0010] Step S110: Capture the streaming log sequence generated by the network node in real time. The streaming log sequence contains operation record entries generated continuously in chronological order. Each operation record entry carries a node identifier, operation behavior description and trigger time information.

[0011] In a power monitoring system, network nodes encompass multiple devices such as data acquisition servers, monitoring hosts, relay control terminals, and database servers. These nodes continuously generate various operations during operation, and corresponding log generation mechanisms record these operations in real time. The capture of streaming log sequences is achieved through a traffic mirroring tool deployed on the network switches connected to each node. This tool replicates all log data passing through the switches in real time and transmits it to the log aggregation server. Each operation record entry uses a unique device number within the power monitoring system as its node identifier. This device number is assigned during system initialization based on device type and deployment location according to specific rules, ensuring no duplication throughout the system. The operation behavior description details the specific operations performed by the node, covering various types such as data reading, parameter modification, command issuance, connection establishment, and authentication / authorization. Different types of operations correspond to different behavior description formats for subsequent parsing.

[0012] Step S120: Perform behavior chain weaving processing on the streaming log sequence to associate consecutive operation record entries belonging to the same operation subject into a dynamic behavior chain. The dynamic behavior chain includes the temporal connection relationship of operation behaviors and resource access links.

[0013] In power monitoring systems, the operating entities can be operator accounts logged into the monitoring host, automatically running control programs, or devices transmitting data. The purpose of behavior chaining is to link the actions performed by the same entity at different times to form a behavioral trajectory, enabling better analysis of their operational intentions and potential risks.

[0014] Step S121: Extract the operation subject identifier from each operation record entry in the streaming log sequence. The operation subject identifier includes the user account, process ID, and device MAC address.

[0015] When extracting the operation subject identifier, different extraction methods are used for different types of operation record entries. For operations performed by an operator, the user account is extracted from the user information field of the operation record entry. This user account is the operator's unique login identifier in the system and is associated with the operator's identity information. For operations executed automatically by a program, the process ID is extracted from the process information field. The process ID is a unique identifier assigned by the system to each running program, and this ID can be used to locate the specific running program. For communication operations between devices, the device MAC address is extracted from the network information field. The MAC address is the physical address of the device's network card and can be used to identify the specific communication device.

[0016] During the extraction process, the fields of each operation record entry need to be parsed, and the corresponding operation subject identification information needs to be identified according to the preset field format rules. If an operation record entry has multiple operation subject identifiers, such as when an operator performs an operation through a specific program, both user account and process ID are included, then these two operation subject identifiers are extracted and stored together.

[0017] Step S122: The streaming log sequence is split according to the operation subject identifier to obtain multiple subject-specific log streams. Each subject-specific log stream contains all operation record entries generated by the same operation subject.

[0018] In this embodiment, a mapping table between operation subject identifiers and log streams is first established. When an operation record entry is received from a streaming log sequence, its operation subject identifier is extracted, and then the corresponding log stream is searched in the mapping table. If a log stream corresponding to the operation subject identifier already exists, the operation record entry is added to that log stream; otherwise, a new log stream is created, and the mapping relationship between the operation subject identifier and the new log stream is added to the mapping table.

[0019] In power monitoring systems, there may be a large number of operating entities. Therefore, hash tables can be used to store mapping relationships to improve the efficiency of searching and adding data. Each entity's dedicated log stream is stored as a file in a specific directory on the server. The filename includes the operating entity identifier and creation time, facilitating subsequent management and access.

[0020] Step S123: Sort each subject-specific log stream in ascending order according to the trigger time information to form a time-ordered subject operation sequence.

[0021] In this embodiment, all operation record entries in the subject-specific log stream can be read, the trigger time information of each entry can be extracted, and then these entries can be arranged in order of trigger time from earliest to latest.

[0022] During the sorting process, if two operation record entries have the same trigger time, a secondary sorting is performed based on other auxiliary information of the operation record entries, such as the operation priority field, with higher-priority operations listed first. After sorting, the resulting main operation sequence will overwrite the original main-specific log stream file, ensuring that subsequent processing uses operation record entries in chronological order.

[0023] Step S124: Parse the operation behavior descriptions of two adjacent operation record entries in each main operation sequence, determine whether the latter operation depends on the result of the former operation, and mark it as an associated operation pair if a dependency relationship exists.

[0024] When parsing the operation behavior description, natural language processing technology is used in conjunction with the professional dictionary of the power monitoring system to perform semantic analysis on the operation behavior description and extract key information such as the operation object, action, input parameters, and output results.

[0025] For two adjacent operation records, determining whether the latter operation depends on the result of the former operation mainly involves analyzing the following aspects: whether the output result of the former operation is the input parameter of the latter operation; whether the latter operation needs to be based on the execution status of the former operation to be performed; and whether the former operation is a prerequisite for the latter operation, such as the latter operation can only be triggered after the former operation is successfully executed.

[0026] If analysis confirms the existence of any of the above dependencies, these two operation record entries are marked as associated operation pairs, and an association marker is added to the corresponding entries, recording the type and basis of the association.

[0027] Step S1241: Extract the operation behavior description of the Nth operation record entry in the main operation sequence, and determine the output resource identifier of the Nth operation record entry, wherein the output resource identifier is the resource generated or modified by the operation.

[0028] After extracting the operation description of the Nth operation record entry, semantic analysis is used to determine the resources generated or modified by the operation. In a power monitoring system, these resources may include monitoring data files, equipment parameter configuration information, data tables in the database, network connection sessions, etc.

[0029] The determination of the output resource identifier needs to be combined with the specific type of operation. For example, the output resource identifier of a data acquisition operation is the file path or database table name where the acquired data is stored; the output resource identifier of a parameter modification operation is the modified device parameter item and its corresponding device identifier. The determined output resource identifier is recorded in a specific format in the extended field of the Nth operation record entry.

[0030] Step S1242: Extract the operation behavior description of the (N+1)th operation record entry, and determine the input resource identifier of the (N+1)th operation record entry, wherein the input resource identifier is the resource that needs to be accessed for the operation.

[0031] Similarly, the description of the operation behavior of the N+1th operation record entry is parsed to determine the resources that the operation needs to access during execution. These resources can be the results of previous operations or existing resources in the system.

[0032] The determination of the input resource identifier also depends on the operation type. For example, the input resource identifier for a data query operation is the name of the database table or the path of the data file involved in the query; the input resource identifier for an instruction issuance operation can be the device identifier receiving the instruction and the path of the relevant parameter configuration file. The input resource identifier is also recorded in the extended field of the N+1th operation record entry.

[0033] Step S1243: Compare the output resource identifier with the input resource identifier. If there is an intersection between the two, it is determined that the latter operation depends on the result of the former operation.

[0034] During the comparison process, the output resource identifier of the Nth operation record entry is compared one by one with the input resource identifier of the (N+1)th operation record entry. If there are identical resource identifiers, such as both involving the same database table name or the same device parameter item, it indicates that the later operation needs to access the resource generated or modified by the previous operation, and therefore a dependency relationship is determined between the two.

[0035] For example, the Nth operation is to write the collected power data into a data file, and its output resource identifier is the path of the data file; the N+1th operation is to read the data file for analysis, and its input resource identifier is also the path of the data file. At this time, there is an intersection between the two, which is determined to be a dependency relationship.

[0036] Step S1244: If the output resource identifier and the input resource identifier have no intersection, check the operation result status code of the Nth operation and the triggering condition of the N+1th operation. When the success status code of the Nth operation is the triggering condition of the N+1th operation, it is determined that there is a dependency relationship.

[0037] When the output resource identifier and the input resource identifier do not overlap, it does not necessarily mean that there is no dependency. In this case, it is necessary to check the operation result status code of the Nth operation and the triggering condition of the N+1th operation. The operation result status code is used to indicate whether the operation was executed successfully. Different status codes correspond to different execution results, such as success, failure, timeout, etc.

[0038] The triggering condition for operation N+1 might stipulate that it can only be triggered when a preceding operation is successfully executed. If the success status code of operation N exactly matches the triggering condition of operation N+1, then the two operation record entries are determined to have a dependency relationship. For example, operation N is establishing a communication connection with a terminal, and its success status code is a specific value; operation N+1 is issuing a control command to that terminal, and its triggering condition is that the communication connection with that terminal has been successfully established, i.e., it requires the success status code of operation N. In this case, a dependency relationship is determined between the two.

[0039] Step S1245: Mark the Nth and N+1th operation record entries that have a dependency relationship as an associated operation pair, and record the dependency type as resource dependency or state dependency.

[0040] Once a dependency is identified, it is marked in the association tag field of the two operation record entries to clarify that they are a pair of related operations. Simultaneously, the dependency type is recorded based on the reason for the dependency. If the dependency is due to the intersection of the output resource identifier and the input resource identifier, it is marked as a resource dependency; if the dependency is due to the success status code of operation N being a prerequisite for the triggering of operation N+1, it is marked as a state dependency.

[0041] Step S1246: Repeat the above comparison process for all adjacent operation record entries in the main operation sequence until all associated operation pairs are marked.

[0042] Following the methods described in steps S1241 to S1245, each pair of adjacent operation record entries in the main operation sequence is processed one by one. Starting from the first operation record entry, it is compared sequentially with the second, third, ... until the last operation record entry to ensure that no possible related operation pairs are missed.

[0043] During processing, the results of each comparison can be recorded, and entries identified as associated operation pairs can be marked promptly. Once all adjacent operation record entries have been processed, the marking of associated operation pairs for the entire main operation sequence is complete.

[0044] Step S125: Chain consecutive related operation pairs to form an initial behavior chain containing the temporal connection relationship of operation behaviors, and extract the resource identifiers involved in each operation record entry in the initial behavior chain. The resource identifiers include file path, port number and database table name.

[0045] After marking the associated operation pairs, consecutive associated operation pairs are connected sequentially in chronological order to form an initial behavior chain. The operation record entries in the initial behavior chain are arranged in the order of their trigger times, and there are clear dependencies between adjacent entries, reflecting the temporal connection of the operation behaviors.

[0046] Simultaneously, each operation record entry in the initial behavior chain is parsed to extract the resource identifiers involved. These resource identifiers include identification information of various resources accessed, generated, or modified by the operation, such as the file path for data storage, the port number used for network communication, and the names of data tables involved in the database. These resource identifiers are then associated and stored with the corresponding operation record entries to prepare for the subsequent embedding of resource access chain information.

[0047] Step S126: Based on the access order of resource identifiers, embed resource access link information into the initial behavior chain to generate a dynamic behavior chain containing temporal connection relationships and resource access links.

[0048] Resource access chain information reflects the order in which an operator accesses various resources during the execution of an operation. The resource access chain is constructed based on the resource identifiers involved in each operation record entry in the initial behavior chain and their order of appearance. For example, if an operation in a certain initial behavior chain accesses file A, port B, and data table C in sequence, then the resource access chain is file A → port B → data table C.

[0049] The constructed resource access chain information is embedded into the initial behavior chain and combined with the temporal sequence of operation behaviors to form a dynamic behavior chain. The dynamic behavior chain not only records the order and dependencies of operations, but also shows the access path of the operating entity to the resource.

[0050] Step S127: When a new operation record entry enters the subject's dedicated log stream, repeat the above steps to update the corresponding dynamic behavior chain, perform integrity verification on the updated dynamic behavior chain, check for any broken related nodes, if any exist, re-examine the dependencies of adjacent operation record entries, store the verified dynamic behavior chain in the behavior chain database, and manage it by partition according to the operation subject identifier and generation time.

[0051] During the operation of the power monitoring system, new operations are constantly generated, and corresponding operation record entries are continuously added to the main body's dedicated log stream. When a new entry is added, the dynamic behavior chain needs to be updated according to steps S123 to S126. The new operation record entry is correlated with the original dynamic behavior chain to determine whether there is a dependency relationship. If so, it is added to the dynamic behavior chain.

[0052] The updated dynamic behavior chain requires integrity verification, checking for broken nodes in the operation record entries. This means that an operation record entry has no dependencies on its preceding or following entries. If a broken node is found, the operation behavior descriptions of that node and its adjacent entries are re-examined to analyze for any unidentified dependencies. If a dependency is found after re-examination, the dynamic behavior chain is corrected; otherwise, the broken node is used as the starting or ending point of a new behavior chain.

[0053] Verified dynamic behavior chains are stored in a behavior chain database, which is partitioned according to the operator's identifier and the generation time of the dynamic behavior chain. Each operator's identifier corresponds to a partition, and each partition is further divided into sub-partitions according to the generation time. This partitioning method facilitates the querying, retrieval, and management of dynamic behavior chains, and improves data processing efficiency.

[0054] Step S130: Perform pattern matching on the dynamic behavior chain based on the preset security rule base to identify candidate behavior segments that conform to potential risk patterns. The potential risk patterns include unauthorized access sequences, cross-node abnormal jump sequences, and resource abuse sequences.

[0055] The pre-defined security rule base is constructed based on the security requirements of the power monitoring system and common security threats, and includes feature descriptions and judgment criteria for various potential risk patterns. The pattern matching process compares dynamic behavioral chains with potential risk patterns in the security rule base to identify behavioral fragments that match the risk pattern characteristics.

[0056] An unauthorized access sequence refers to a series of operations in which an operator accesses restricted resources without authorization; an abnormal cross-node jump sequence refers to an operator's jumps between different network nodes that do not conform to normal business logic or security policies; and a resource abuse sequence refers to an operator's use of resources that exceeds the reasonable scope or normal frequency.

[0057] Step S131: Load a set of potential risk patterns from the security rule base. Each potential risk pattern includes a sequence of characteristic operations, a resource access threshold, and node jump constraints.

[0058] The set of potential risk patterns in the security rule base is stored in a structured data format, with each potential risk pattern containing multiple attributes. A characteristic operation sequence refers to the combination and order of a series of specific operations that constitute the risk pattern; resource access thresholds specify the upper limit on the number of times and duration of access to a certain type of resource within a specific time period; and node jump constraints clarify the allowed range and conditions for an operator to jump between different nodes.

[0059] During pattern matching, these potential risk patterns are first loaded into memory for rapid comparison. During loading, the attributes of each potential risk pattern are parsed and validated to ensure correct format and logical consistency.

[0060] Step S132: Divide the dynamic behavior chain into multiple behavior sub-segments according to a fixed time window, and each behavior sub-segment contains operation record entries within a preset duration.

[0061] The size of the fixed time window is set according to the business characteristics and security analysis needs of the power monitoring system; for example, it can be set to one hour or half a day. The segmentation process divides the operation record entries within the same fixed time window into a behavior sub-segment based on the trigger time of the operation record entries in the dynamic behavior chain.

[0062] For example, if the fixed time window is one hour, starting from a certain hour, all operation records within the next hour are grouped into a behavior segment, and then behavior segments for other time windows are sequentially divided. This segmentation method can decompose a continuous dynamic behavior chain into multiple time-bound segments, facilitating time-segmented risk analysis.

[0063] Step S133: Extract features from each behavior sub-segment to obtain the operation type sequence, resource access list, and number of node switching involved in each behavior sub-segment.

[0064] Feature extraction is a crucial step in pattern matching. By analyzing behavioral segments, information reflecting their characteristics is extracted. The operation type sequence refers to the chronological sequence of all operation types within a behavioral segment, such as data reading, parameter modification, and connection establishment. The resource access list records the identifiers of all resources accessed by operations within the behavioral segment. The node switching count counts the number of times the operator switches from one network node to another within the behavioral segment.

[0065] These extracted features will serve as the basis for comparison with potential risk patterns, and the accuracy of feature extraction directly affects the pattern matching results.

[0066] Step S134: Compare the operation type sequence with the feature operation sequence in the potential risk pattern. When the operation type sequence contains all the operation types of the feature operation sequence and the order is consistent, it is determined that the operation type matches.

[0067] When comparing the operation type sequence with the feature operation sequence, a sequence alignment algorithm is used to compare the operation types in the two sequences one by one. First, it is checked whether the operation type sequence contains all the operation types in the feature operation sequence. Then, it is checked whether the order in which these operation types appear is consistent with the order in the feature operation sequence.

[0068] For example, if the characteristic operation sequence of a potential risk pattern is "connection request → authentication failure → forced login", then if the operation type sequence of the behavior sub-fragment contains these three operation types in the same order, the operation types are considered to match. If the operation type sequence is missing one of the operation types from the characteristic operation sequence, or if the order is inconsistent, then a mismatch is determined.

[0069] Step S1341: Convert the operation type sequence of the behavior sub-fragment into an operation type encoding sequence, wherein each operation type in the operation type sequence corresponds to a unique code.

[0070] To improve comparison efficiency, the operation type sequence is converted into an operation type encoding sequence. The system predefines a unique code for each operation type; the code can be a combination of numbers or characters. During the conversion process, each operation type in the operation type sequence of the behavior sub-fragment is replaced with its corresponding predefined code, thus forming the operation type encoding sequence.

[0071] In power monitoring systems, there are various operation types, such as remote control operations for substation equipment, power data acquisition operations, and system configuration modification operations. Each operation type has its unique code. During conversion, the system traverses the operation type sequence of the behavior sub-segment, searches for the corresponding code of each operation type in the predefined coding table, and arranges these codes sequentially according to the order of the operation types in the sequence to form an operation type coding sequence.

[0072] The above transformation converts the operation type sequence, which may originally contain complex textual descriptions, into a more concise and regular encoding sequence. When comparing it with the template encoding sequence in the future, it can reduce the interference caused by text processing, speed up the comparison, and improve the efficiency of the entire pattern matching process.

[0073] Step S1342: Obtain the encoded sequence of the feature operation sequence in the potential risk pattern as the template encoded sequence.

[0074] The feature operation sequence contained in the potential risk pattern is extracted from the preset security rule base. Then, the feature operation sequence is converted into the corresponding encoding sequence according to the same encoding rule as the behavior sub-fragment operation type sequence conversion. This encoding sequence is used as the template encoding sequence.

[0075] In the security rule base of the power monitoring system, each potential risk pattern has a clear sequence of characteristic operations. For example, for the potential risk pattern of unauthorized access sequence, its characteristic operation sequence may include operations such as attempting to log in to an unauthorized account, unauthorized access to the power equipment control interface, and unauthorized downloading of sensitive power data. For these characteristic operations, corresponding codes are generated according to predefined coding rules, and then a template coding sequence is formed.

[0076] Step S1343: Compare the operation type encoding sequence with the template encoding sequence bit by bit, and check whether the operation type encoding sequence contains the complete encoding combination of the template encoding sequence.

[0077] Using the template encoding sequence as a reference, starting from the beginning of the operation type encoding sequence, each bit is compared with the corresponding position in the template encoding sequence. Each time a bit is compared, if the current bit matches, the comparison continues to the next bit; if they do not match, the comparison restarts from the next position in the operation type encoding sequence with the beginning of the template encoding sequence.

[0078] During the alignment process, it is necessary to completely cover all positions in the operation type encoding sequence to ensure that no segment that may contain a complete combination of template encoding sequences is missed. For example, if the operation type encoding sequence is long, there may be multiple positions where there is a partial match with the template encoding sequence. These positions need to be checked one by one to see if they can form a complete match.

[0079] Step S1344: When there is a continuous coding segment in the operation type coding sequence that is completely consistent with the template coding sequence, record the start and end positions of the coding segment.

[0080] During the bit-by-bit comparison process, once a continuous coding segment in the operation type coding sequence is found to be completely consistent with the template coding sequence, the start and end positions of that coding segment in the operation type coding sequence are immediately recorded.

[0081] The start position refers to the position number of the first code in the operation type coding sequence within the continuous coding segment, while the end position is the position number of the last code in the continuous coding segment within the operation type coding sequence. Recording this positional information helps in subsequent analysis and verification of the matched operation type sequences, clarifying which operations in the behavioral sub-segments constitute the part that matches the potential risk pattern characteristic operation sequence.

[0082] For example, in a power monitoring system, if the template encoding sequence corresponds to the characteristic operation of the cross-node abnormal jump sequence, when a continuous encoding segment that is completely consistent with it is found in the operation type encoding sequence of a certain behavior sub-segment, its start and end positions are recorded to facilitate subsequent viewing of the specific operation corresponding to the encoding segment.

[0083] Step S1345: Check whether the operation type encoding outside the encoding segment contains operation types that do not appear in the template encoding sequence. If so, further verify whether the operation type belongs to the preset ignoreable type.

[0084] After identifying a continuous coding segment that is completely consistent with the template coding sequence, examine other codes in the operation type coding sequence other than that coding segment to determine whether the operation type corresponding to these codes has appeared in the template coding sequence.

[0085] If an operation type code does not appear in the template coding sequence, it is necessary to check whether the operation type belongs to the default list of negligible types. In power monitoring systems, negligible types can be routine system status queries, normal log recordings, and other operations that do not affect risk mode judgment.

[0086] This step helps to eliminate irrelevant operations that do not affect the matching of potential risk patterns, ensuring the accuracy of the judgment and avoiding misjudgments of operation type mismatch due to the presence of some irrelevant operations.

[0087] Step S1346: When there are no non-negligible additional operation types and the length of the complete encoded segment is consistent with the length of the template encoded sequence, determine that the operation type sequence matches the feature operation sequence.

[0088] If, after checking the operation types outside the coding segment, no additional operation types that cannot be ignored are found, and the length of the previously determined continuous coding segment that is completely consistent with the template coding sequence is the same as the length of the template coding sequence, then it can be determined that the operation type sequence of the behavior sub-segment matches the feature operation sequence in the potential risk pattern.

[0089] This criterion ensures the rigor of the matching, eliminating interference from irrelevant but non-negligible operations and guaranteeing that the matched encoded segment is consistent with the template in length, thereby accurately determining whether the operation type conforms to the characteristics of a potential risk pattern.

[0090] In power monitoring systems, only when both of these conditions are met can the operation type of a behavioral sub-segment be considered to match the characteristic operation sequence of a potential risk pattern.

[0091] Step S1347: Repeat the above comparison process for the feature operation sequences of all potential risk patterns until the matching pattern corresponding to the behavioral sub-segment is determined.

[0092] For all potential risk patterns in the security rule base, their feature operation sequences are converted into template encoding sequences one by one, and then compared with the operation type encoding sequence of the current behavior sub-segment according to the above steps S1341 to S1346.

[0093] During the comparison process, each potential risk pattern is checked sequentially until a potential risk pattern that matches the operation type sequence of the behavior sub-segment is found, or after traversing all potential risk patterns, it is determined that there is no matching pattern.

[0094] By comparing each potential risk pattern one by one, it is possible to comprehensively check whether the behavioral sub-segments conform to the operational type characteristics of any potential risk pattern, ensuring that no possible risk pattern is overlooked and improving the comprehensiveness of risk identification.

[0095] In power monitoring systems, there may be multiple potential risk patterns, such as unauthorized access sequences and resource abuse sequences. Only by comparing each pattern can the risk pattern corresponding to the behavioral sub-segment be accurately determined.

[0096] Step S1348: If the behavior sub-fragment matches multiple potential risk patterns at the same time, sort them according to the priority of the potential risk patterns and select the potential risk pattern with the highest priority as the matching result.

[0097] When the operation type sequence of a behavior sub-segment matches the feature operation sequences of multiple potential risk patterns, it is necessary to filter them according to the preset priority order of potential risk patterns.

[0098] Prioritization is typically based on factors such as the potential severity of harm caused by a risk pattern and the probability of its occurrence. In power monitoring systems, the risk posed by abnormal jump sequences across nodes may be of a higher severity and therefore has a higher priority than some other risk patterns.

[0099] The highest priority potential risk pattern is selected as the matching result for the behavioral sub-segment, arranged from highest to lowest priority. This ensures that when multiple possible risk patterns exist, the risk with the higher degree of harm is prioritized, facilitating timely and targeted measures by the safety management center.

[0100] Step S1349: Store the matching results and the information of the encoded segments involved in the matching process in the matching log.

[0101] After determining the matching result of the behavior segment, the matching result (i.e. the corresponding potential risk pattern) and the information such as the start and end positions of the encoded segments recorded during the matching process are stored together in the matching log.

[0102] The matching log records the matching status of all behavioral sub-segments in chronological order, which facilitates the subsequent tracing and auditing of the risk pattern recognition process.

[0103] Step S135: Check whether the resource access list exceeds the resource access threshold set by the potential risk mode. The resource access threshold includes the access frequency of the same resource and the access types of cross-category resources.

[0104] After comparing the operation type sequence with the characteristic operation sequence, it is necessary to check the resource access status of the behavior sub-segments. First, extract the resource access list from the behavior sub-segment. This resource access list contains resource information related to all operations in the behavior sub-segment.

[0105] Then, the resource access thresholds set in the potential risk mode are retrieved, including the access frequency threshold for the same resource and the access type threshold for cross-category resources. In a power monitoring system, the same resource may be an important power data server, and its access frequency threshold is set according to normal business needs; cross-category resources may include power equipment control resources, user information resources, etc., and their access type threshold will limit the number of categories that are allowed to be accessed during normal operation.

[0106] The actual access frequency of the same resource in the resource access list of the behavior sub-fragment is compared with the corresponding access frequency threshold. At the same time, the actual number of access types of cross-category resources is counted and compared with the corresponding access type threshold to determine whether the threshold is exceeded.

[0107] Step S136: Count the number of node switching involved in the behavior sub-segment and determine whether it meets the node jump constraint in the potential risk mode. The node jump constraint includes the maximum number of allowed cross-network segment jumps.

[0108] Track all nodes involved in the operations within the behavior sub-segment, and count the total number of times the operating entity switches from one node to another within the time range of the behavior sub-segment, especially the number of node jumps across network segments.

[0109] In power monitoring systems, nodes may be distributed across different network segments, such as the local network segment of a substation or the network segment of a dispatch center. The node hop constraint in the potential risk mode sets a maximum allowed number of cross-network segment hops. This is because excessive cross-network segment hops may indicate abnormal operation paths, increasing security risks.

[0110] The number of cross-network segment hops obtained from the statistics is compared with the maximum number of cross-network segment hops set in the potential risk mode. If the actual number of hops is less than or equal to the maximum allowed number, it meets the node hop constraint; if it is greater than the maximum allowed number, it does not meet the constraint.

[0111] Step S137: When the operation type matches, the resource access does not exceed the threshold, and the node jump meets the constraints, mark the behavior sub-segment as a candidate behavior segment.

[0112] Based on the judgment results of steps S134 to S136, the behavior sub-segment is marked as a candidate behavior segment only when the three conditions are met simultaneously: the operation type matches the characteristic operation sequence of the potential risk pattern, the resource access list does not exceed the set resource access threshold, and the number of node jumps meets the node jump constraint.

[0113] The simultaneous fulfillment of these three conditions indicates that the behavior sub-segment conforms to the characteristics of a potential risk pattern in terms of operation type, resource access, and node jump, and thus poses a potential security risk.

[0114] Step S138: Repeat the above matching process for all behavior sub-segments, summarize all candidate behavior segments that meet the conditions, perform deduplication on the summarized candidate behavior segments, merge segments with completely identical content, retain the time information of the first appearance, and then classify the deduplicated candidate behavior segments according to the risk mode type to form a classification candidate list.

[0115] Following steps S132 to S137, each behavioral sub-segment obtained from the dynamic behavioral chain segmentation is matched and analyzed one by one.

[0116] When summarizing all candidate behavior fragments that meet the criteria, fragments with completely identical content may appear. These fragments may be due to duplicate operations or system delays. In this case, it is necessary to deduplicate these fragments, retaining only the time information of their first appearance, to avoid duplicate analysis.

[0117] After deduplication, candidate behavior segments are categorized and organized according to the potential risk pattern types they match, forming a category candidate list. For example, in a power monitoring system, candidate behavior segments matching unauthorized access sequences are grouped into one category, while those matching cross-node abnormal jump sequences are grouped into another category, and so on.

[0118] The formation of a categorized candidate list facilitates targeted processing and analysis of different types of potential risks, thereby improving the efficiency of cybersecurity analysis.

[0119] Step S140: Perform reverse source tracing analysis on the candidate behavior segment, track the preceding related logs and subsequent derived logs of the candidate behavior segment in the streaming log sequence, and construct a risk diffusion map.

[0120] After obtaining the candidate classification list, a reverse source tracing analysis is performed for each candidate behavior segment. First, the position of the candidate behavior segment in the entire streaming log sequence is determined. Starting from this position, the preceding log entries that may be associated with it are traced backward, while the subsequent derived log entries that may be triggered by it are traced backward.

[0121] Pre-event logs refer to log entries that have some kind of relationship with the candidate action segment before it occurs. These relationships may include resource sharing, operational entity association, etc. Subsequent derivative logs refer to log entries generated after the candidate action segment has occurred, influenced by it. For example, logs generated by other operations triggered by changes in resource status caused by operations in the candidate action segment.

[0122] By tracking these preceding and subsequent derived logs, the relationships between them are identified and then presented graphically to construct a risk diffusion map. In power monitoring systems, the risk diffusion map clearly shows the path and scope of potential risks from their inception to their spread.

[0123] Step S141: Determine the time interval and starting operation record entry of the candidate behavior segment in the streaming log sequence.

[0124] To perform reverse source tracing analysis on candidate behavior segments, it is first necessary to determine the specific location of the segment in the streaming log sequence. By examining the relevant information of the candidate behavior segment, the trigger time of the operation record entries it contains can be determined, thereby obtaining the time interval of the segment, that is, the time period between the earliest and latest trigger times in the segment.

[0125] Simultaneously, identify the first operation record entry in the candidate behavior segment and use it as the starting operation record entry. The starting operation record entry is the starting point for reverse tracing; all preceding related logs will be searched around this entry.

[0126] Step S142: Trace backward from the starting operation record entry to find the preceding log entry that has a resource association or subject association with the starting operation record entry. The resource association refers to sharing access to the same resource, and the subject association refers to the operation subject having a permission inheritance relationship.

[0127] Starting with the initial operation record, search backwards in the streaming log sequence for log entries generated before it, in chronological order. For each found log entry, determine whether it has a resource association or a subject association with the initial operation record.

[0128] The method for determining resource association is to check whether two log entries involve access to the same resource. For example, in a power monitoring system, if the initial operation record entry involves accessing the real-time data resource of a certain substation, and a preceding log entry also accesses the real-time data resource, then the two are associated with resources.

[0129] The method for determining subject association is to check whether there is a permission inheritance relationship between the operating subjects of two log entries. For example, if one operating subject is a sub-account of another operating subject, and the sub-account inherits some permissions from the parent account, then the log entries corresponding to these two operating subjects have subject association.

[0130] Collect all preceding log entries that have resource or subject associations, and use them as the objects of subsequent analysis.

[0131] Step S143: Collect all preceding log entries, analyze the correlation strength between the preceding log entries and candidate behavior segments, and sort them from high to low correlation strength to form a preceding associated log chain.

[0132] After collecting all preceding log entries, it is necessary to analyze the correlation strength between each preceding log entry and the candidate behavior fragment. The correlation strength analysis will take into account a variety of factors, such as the importance of shared resources, the length of time intervals, and the tightness of permission relationships.

[0133] In power monitoring systems, if the preceding log entries and candidate behavior fragments share core power equipment control resources, their correlation strength is relatively high. If the time interval between the two is short, it indicates a close temporal connection, and the correlation strength will also be high. If the permission inheritance relationship between the operating entities is direct and comprehensive, it will also increase the correlation strength.

[0134] Based on the correlation strength obtained from the analysis, all preceding log entries are sorted from high to low, forming an ordered preceding correlation log chain. This log chain can clearly show the correlation path tracing back from the candidate behavior fragment, and log entries with high correlation strength are more likely to be direct preceding factors leading to the generation of the candidate behavior fragment.

[0135] Step S1431: For each preceding log entry, extract the number of shared resources between the preceding log entry and the candidate behavior fragment start operation record entry. The more shared resources there are, the closer the association is.

[0136] For each preceding log entry, compare the resources involved with the resources involved in the candidate behavior segment's initial operation record entry, and count the number of resources accessed by both, i.e., the number of shared resources.

[0137] In power monitoring systems, shared resources may include power data storage servers, equipment control interfaces, user authentication databases, etc. The more shared resources there are, the greater the overlap in resource access between two log entries, and the stronger the correlation between them.

[0138] For example, if a pre-log entry and a start operation record entry both access the power data storage server, the device control interface, and the user authentication database, while another pre-log entry only shares the power data storage server resource with the start operation record entry, then the former has a larger number of shared resources and a tighter connection.

[0139] Step S1432: Calculate the time difference between the trigger time of the preceding log entry and the trigger time of the starting operation record entry. The smaller the time difference, the stronger the time correlation.

[0140] Obtain the trigger time of each preceding log entry and the trigger time of the candidate behavior segment start operation record entry, and then calculate the difference between these two times, i.e., the time difference.

[0141] The time difference is calculated by subtracting the trigger time of the preceding log entry from the trigger time of the initial operation record entry, and the result is a positive value. In a power monitoring system, if the trigger time of the preceding log entry is very close to the trigger time of the initial operation record entry, it indicates that the two are strongly correlated in time, and the preceding log entry may have a more direct impact on the initial operation.

[0142] For example, if a preceding log entry occurs shortly before the start operation log entry is triggered, and another occurs much earlier, then the former has a stronger temporal correlation with the start operation log entry.

[0143] Step S1433: Determine the permission relationship between the operation subject of the preceding log entry and the operation subject of the starting operation record entry.

[0144] Examine the permission configurations of the operation subjects in the preceding log entries and the operation subjects in the starting operation record entries to determine the permission relationship between them. Permission relationships may include various scenarios such as permission inheritance, permission sharing, and permission independence.

[0145] In a power monitoring system, if the operating entity of a preceding log entry is the superior of the operating entity of the starting operation record entry, and the starting operation entity inherits some permissions from the preceding operation entity, then the two have a permission-sharing relationship; if the permission scopes of the two do not overlap and belong to different permission systems, and there is no permission transfer or associated configuration between them, then they are determined to have an independent permission relationship.

[0146] When determining permission relationships, the permission management module interface of the power monitoring system needs to be called to extract the permission lists of the two operating entities. The permission lists contain information such as the types of operations each entity can execute, the scope of resources it can access, and the system parameters it can modify. By comparing each item in the permission list, it is determined whether there are any overlapping, conflicting, or completely independent relationships.

[0147] For example, if the permission list of the preceding operator includes permission to modify the configuration of a certain type of protection device, and the permission list of the initiating operator also includes permission to modify the configuration of that type of protection device, and both permissions originate from the same preset protection device management permission group, then a permission-sharing relationship can be established. If the permission list of the initiating operator explicitly marks the permission to modify the configuration of that type of protection device as inherited from the preceding operator, then a permission inheritance relationship exists. If the preceding operator only has monitoring permissions for the acquisition terminal, while the initiating operator only has management permissions for the scheduling server, and the two types of permissions belong to different permission branches with no associated settings, then a permission independent relationship exists.

[0148] Step S1434: Determine the association strength ranking criteria for each preceding log entry by comprehensively considering the number of shared resources, the time difference, and the permission relationship.

[0149] The determination of the ranking criteria for association strength needs to comprehensively consider three factors: the quantity of shared resources, the time difference, and the permission relationship. First, a relative weight should be assigned to each factor. The weight setting should be based on the security characteristics of the power monitoring system. The impact of the permission relationship on the association strength can be set to the highest weight, because the permission relationship between operating entities often directly reflects the continuity and relevance of the operation. The quantity of shared resources is the second highest weight, and the time difference has a relatively low weight, but it still needs to be considered as an important reference.

[0150] In the specific calculation, the basic association score is first determined based on the number of shared resources; the more shared resources, the higher the basic association score. Then, the basic association score is adjusted based on the time difference. The smaller the time difference, the larger the adjustment coefficient, meaning a stronger amplification effect on the basic association score; conversely, the larger the time difference, the smaller the adjustment coefficient, which may even lower the basic association score. Finally, the adjusted score is corrected based on permission relationships. If there is a permission inheritance relationship, the correction coefficient is the highest; next is the permission sharing relationship; and the correction coefficient for independent permission relationships is the lowest, which may even weaken the score.

[0151] By comprehensively calculating the above multiple factors, the association strength score of each preceding log entry is obtained, and this association strength score is used as the ranking basis. The higher the score, the stronger the association between the preceding log entry and the candidate behavior segment, and the higher the ranking in the preceding associated log chain.

[0152] Step S1435: Sort the preceding log entries in descending order according to the association strength sorting criteria to form an ordered preceding association log chain.

[0153] Based on the association strength score calculated for each preceding log entry, all preceding log entries are ranked from highest to lowest. During the ranking process, if two or more preceding log entries have the same association strength score, their time difference is further compared, with the preceding log entry with the smaller time difference ranked first; if the time difference is also the same, the number of shared resources is compared, with the one with more shared resources ranked first; if all the above conditions are the same, the ranking order is randomly determined.

[0154] After the arrangement is completed, an ordered chain of preceding related log entries is formed, with each log entry in the chain arranged sequentially according to its degree of association with the candidate behavioral segment. This arrangement helps to prioritize preceding log entries with high association strength in subsequent source tracing analysis, thereby improving the efficiency and accuracy of source tracing.

[0155] Step S1436: Mark the key association elements of each log entry in the preceding associated log chain. The key association elements include shared resources, time difference, or permission relationship.

[0156] For each log entry in the preceding associated log chain, analyze and mark the elements that play a major role in the association strength calculation. If the association strength score of a log entry is mainly determined by the number of shared resources, that is, the number of shared resources is much greater than that of other preceding log entries, then mark its key association element as a shared resource and record the specific name of the shared resource.

[0157] If the time difference plays a dominant role in the association strength calculation, that is, the time difference of the log entry is much smaller than that of other entries and contributes the most to the improvement of the association strength score, then the key association element is marked as the time difference, and the specific time difference value is recorded.

[0158] If the permission relationship is the main factor determining the current association strength of the log entry, such as the existence of permission inheritance relationship which greatly increases the correction coefficient, then the key association element is marked as a permission relationship, and the specific permission relationship type is recorded.

[0159] By marking key correlation elements, subsequent analysts can quickly understand the core reasons why each preceding log entry is associated with the candidate behavior fragment.

[0160] Step S1437: Calculate the association strength decay rate between adjacent log entries in the preceding associated log chain, whereby the association strength decay rate is used to represent the degree of weakening of the association during the tracing process.

[0161] The correlation strength decay rate is calculated as follows: (Correlation strength score of the previous log entry - Correlation strength score of the next log entry) ÷ Correlation strength score of the previous log entry. The larger the value of the calculated result, the more significant the weakening of the correlation strength between the two adjacent log entries; the smaller the value, the lower the degree of correlation weakening and the more stable the correlation.

[0162] During the calculation process, each pair of adjacent log entries in the preceding associated log chain needs to be calculated sequentially to obtain a series of association strength decay rates. These decay rates reflect the changing trend of association strength during the tracing process. If the decay rate suddenly increases at a certain position, it may indicate that there is a significant break or turning point in the tracing clues at that node. It is necessary to focus on the log entries before and after that node to analyze whether there are any anomalies or undiscovered associated elements.

[0163] Step S1438: Bind the sorted preceding associated log chain with the identifier of the candidate behavior segment and store it in the traceability chain database.

[0164] To facilitate subsequent querying and management, the sorted preceding related log chains are bound to the unique identifiers of their corresponding candidate behavior segments. During the binding process, it is ensured that each preceding related log chain accurately corresponds to its respective candidate behavior segment.

[0165] During storage, preceding associated log chains are categorized and stored in the traceability chain database according to the identifiers of candidate behavior fragments. Simultaneously, the storage time is recorded for each preceding associated log chain to facilitate data lifecycle management. The traceability chain database employs a distributed storage architecture to improve data access efficiency and reliability, meeting the power monitoring system's needs for storing and querying large amounts of log data.

[0166] Step S144: Track backwards from the termination operation record entry of the candidate behavior fragment to find subsequent log entries affected by the termination operation record entry within a preset time range. The operations affected by the termination operation record entry include operations triggered by resource status changes and operations triggered by permission transfers.

[0167] First, a preset time range is determined. This preset time range is set according to the operation response characteristics and risk propagation speed of the power monitoring system to ensure that it can cover all subsequent operations that may be affected by the termination operation record entries.

[0168] Starting with the termination operation record entry, retrieve log entries from the streaming log sequence whose trigger times fall within a preset time range. For each retrieved log entry, determine whether it was affected by the termination operation record entry. If the subsequent log entry's operation was triggered by a change in the resource status involved in the termination operation record entry—for example, if the termination operation modified the parameters of a data acquisition point, causing subsequent read operations on that data acquisition point to change their results, and thus triggering other adjustment operations—then that subsequent log entry is considered an affected log entry.

[0169] If the permissions obtained by the operator of a subsequent log entry are passed from the operator of the termination operation record entry, for example, if the operator of the termination operation grants a user specific permissions and that user subsequently uses these permissions to perform certain operations, then the log entries corresponding to these operations are also considered as affected subsequent log entries.

[0170] During the search process, the operation background and triggering reason of each subsequent log entry must be compared one by one to ensure that all affected log entries are accurately identified and to avoid missing any possible clues of risk spread.

[0171] Step S145: Arrange the subsequent log entries in chronological order to form a subsequent derived log chain. Each derived log entry in the subsequent derived log chain is marked with its influence path on the candidate behavior fragment.

[0172] The identified subsequent log entries are arranged in chronological order of their trigger times to form a chain of derived log entries. During arrangement, if two log entries have the same trigger time, they are arranged according to their order of appearance in the streaming log sequence.

[0173] For each log entry in the subsequent derived log chain, mark its impact path with the candidate behavior segment. The marking of the impact path must record in detail the intermediate links and relationships from the termination operation log entry to the subsequent log entry. For example, if the termination operation log entry modifies the setting of a protection device, causing the protection device to generate an alarm signal during subsequent operation, which in turn triggers the operation and maintenance personnel to check, then the impact path of the log entry for the operation and maintenance personnel's check is marked as "termination operation - protection device setting modification - protection device alarm - operation and maintenance personnel check".

[0174] By marking the impact path, it is possible to demonstrate the process by which risk spreads from candidate behavioral fragments to subsequent operations.

[0175] Step S146: Using the candidate behavior fragment as the core node, the preceding associated log chain as the source tracing branch and the subsequent derived log chain as the diffusion branch, a risk diffusion graph containing node association weights is constructed.

[0176] The risk diffusion graph is constructed with candidate behavior segments as its core, connecting the preceding related log chains and the subsequent derived log chains as the source tracing branches and diffusion branches, respectively, to the core node. Each log entry is represented as a node in the risk diffusion graph, and the connections between nodes represent the relationships between log entries.

[0177] Each connection between nodes is assigned a correlation weight, the magnitude of which is determined based on the correlation strength score or the degree of influence. In the tracing branch, the correlation weight between the preceding log entry and the core node is set according to the correlation strength score of the preceding log entry; the higher the score, the greater the correlation weight. The correlation weight between adjacent preceding log entries is determined with reference to the correlation strength decay rate; the smaller the decay rate, the greater the correlation weight.

[0178] In the diffusion branch, the association weight between the core node and subsequent log entries is set according to the degree of influence. The more direct and significant the influence, the greater the association weight. The association weight between subsequent log entries is determined according to the transmission relationship of the influence path. The fewer the transmission links, the greater the association weight.

[0179] The risk diffusion map is stored using a graphical data structure, which facilitates subsequent traversal, analysis, and visualization, and can intuitively present the source path and diffusion trend of risks.

[0180] Step S147: Determine the degree of association of each node in the risk diffusion diagram based on the association strength and time decay relationship. The degree of association is used to represent the possibility of risk transmission.

[0181] The determination of the degree of association tightness comprehensively considers the association strength and the time decay relationship. For nodes in the tracing branch, the degree of association tightness is mainly based on their association strength score with the core node. The higher the score, the higher the degree of association tightness. At the same time, the time decay factor is considered in combination with the time difference. The larger the time difference, the more obvious the weakening effect of time decay on the degree of association tightness.

[0182] For nodes in a diffusion branch, the degree of association is mainly based on their association weight with the core node. The greater the association weight, the higher the degree of association. At the same time, the time interval from the core node to the node is also considered. The longer the time interval, the more the degree of association decreases due to time decay.

[0183] The degree of correlation is represented by a relative value. The higher the degree of correlation, the higher the probability of risk transmission between the node and the core node; conversely, the lower the degree of correlation, the lower the probability of risk transmission. By determining the degree of correlation, we can focus on nodes with high correlation when analyzing risk diffusion maps and assess their role in risk transmission.

[0184] Step S148: Add attribute labels to each node in the risk diffusion diagram. The attribute labels include the operating subject, the resources involved, and the triggering time.

[0185] For each node in the risk diffusion diagram, i.e., each log entry, extract its corresponding operation subject, involved resources, and trigger time information, and add them to the node as attribute tags. The operation subject tag records information such as the user account, process identifier, or device identifier that performed the operation; the involved resource tag records the specific resources involved in the operation, such as server name, database table, port, etc.; and the trigger time tag records the specific time point when the operation occurred.

[0186] Adding attribute tags makes the information for each node more complete, making it easier to quickly understand the basic situation of each node when analyzing the risk diffusion map.

[0187] Step S149: Perform loop detection on the risk diffusion map. If there is a circular association between nodes, mark it as an abnormal loop and record it separately in the loop list.

[0188] Loop detection employs either a depth-first search (DFS) or breadth-first search (BFS) algorithm to traverse all nodes and connections in the risk diffusion graph. During the traversal, the access paths of nodes are tracked. If a path originating from a certain node, passes through a series of connected nodes, and then returns to that node, forming a circular association, a loop is determined to exist.

[0189] For detected loops, further analysis is needed to determine whether they belong to normal operating procedures. In power monitoring systems, some normal periodic operations may form loops, but in most cases, cyclical associations between nodes may indicate abnormal operating logic or risk propagation paths, and therefore are marked as abnormal loops.

[0190] Record all relevant information about abnormal loops, including the nodes involved, connections, and formation time, in a separate loop list. Maintaining this loop list will facilitate in-depth analysis of the anomalies and help identify potential security risks.

[0191] Step S1410: Store the completed risk diffusion map and loop list in the database, and index and associate them according to the identifier of the candidate behavior segments.

[0192] The completed risk diffusion map and loop list need to be stored in a dedicated database. During storage, the candidate behavior segments are indexed and associated according to their unique identifiers to ensure that each candidate behavior segment can be accurately mapped to its risk diffusion map and loop list.

[0193] The database employs an efficient indexing mechanism for fast data retrieval and retrieval. Simultaneously, it sets reasonable storage expiration dates for data and regularly cleans up expired data to free up storage space.

[0194] Step S150: Generate a security analysis report containing risk source nodes, diffusion paths and a list of affected resources based on the risk diffusion map, and push the security analysis report to the security management center.

[0195] Based on the completed risk diffusion map, extract key information, including risk source nodes, risk diffusion paths, and affected resources, and integrate them into a security analysis report. The security analysis report must use a standardized and clear format to ensure that personnel in the security control center can quickly understand the report content.

[0196] Once generated, the report is transmitted to the security control center via an encrypted channel. During the transmission process, the security control center's receiving permissions must be verified to ensure the security and accuracy of the report transmission. After receiving the report, the security control center can take appropriate security control measures based on its content to promptly prevent and address cybersecurity risks.

[0197] Step S151: Traverse the source branches of the risk diffusion graph, identify the node corresponding to the preceding log entry with the highest correlation strength and located at the beginning of the chain, and determine the node as the risk source node.

[0198] Traverse the source tracing branches of the risk diffusion graph, i.e., the preceding related log chains, and examine the association strength score of each preceding log entry. In the source tracing branches, the preceding log entries with the highest association strength are usually most closely associated with the candidate behavior segments and are important clues for risk tracing.

[0199] At the same time, check the position of the preceding log entry in the tracing branch. If it is at the beginning of the chain, that is, there are no other preceding log entries before it, then the node corresponding to the log entry is identified as the risk source node.

[0200] In determining the source node of a risk, if multiple preceding log entries with the same correlation strength and all at the starting position exist, their attribute tags, such as the operating entity and involved resources, are further analyzed and judged to select the node most likely to be the source of the risk. After determining the source node of the risk, its detailed information is recorded, including the operating entity, operating behavior, involved resources, and trigger time.

[0201] Step S152: Starting from the risk source node, trace along the associated links in the risk diffusion graph to the candidate behavior fragment, and then extend to the end node of the subsequent derived log chain to form the main path of risk diffusion.

[0202] Starting from the identified risk source node, the risk diffusion diagram is used to trace the links between nodes sequentially to the core node of the candidate behavior segment. During the tracing process, connection paths with high association weights are prioritized to ensure that the resulting path is the main channel for risk transmission.

[0203] The candidate behavior fragment continues along the associated links of the diffusion branch until the terminal node of the subsequent derived log chain. The terminal node is the node corresponding to a log entry in the diffusion branch that has no subsequent associated nodes.

[0204] The complete path from the risk source node to the end node is recorded, forming the main risk propagation path. The main risk propagation path clearly shows the entire process of risk arising from the source, passing through candidate behavior segments, and then spreading to other nodes, and is one of the core contents of the security analysis report.

[0205] Step S153: Mark the operation behavior description and resource interaction information of each node in the main path of risk diffusion to form diffusion path details.

[0206] For each node in the main risk propagation path, extract its operational behavior description and resource interaction information. The operational behavior description includes the specific content and purpose of the operation, such as "modifying the protection device settings" or "reading data acquisition terminal information"; the resource interaction information includes the name of the resource involved in the operation, the interaction type (such as read, modify, delete, etc.), and the interaction result.

[0207] This information is then labeled onto the corresponding nodes and organized according to their order in the main path to form the diffusion path details. The diffusion path details provide a detailed representation of the specific operations and resource interactions at each node during the risk transmission process.

[0208] Step S154: Extract the resource identifiers involved in all nodes in the risk diffusion graph, and form the original resource list after deduplicating the resource identifiers.

[0209] Traverse all nodes in the risk diffusion graph and collect the resource identifiers involved in each node, including various resources accessed, modified, created, or deleted by the operating entity, such as servers, databases, files, ports, etc.

[0210] The collected resource identifiers are deduplicated, meaning duplicate resource identifiers are removed to ensure that each resource appears only once in the original resource list. The deduplicated original resource list contains all the unique resources involved in the risk diffusion map and serves as the basis for subsequent screening of affected resources.

[0211] Step S155: Query the resource attribute library to obtain the resource attributes of each resource in the original resource list. The resource attributes include resource type, resource importance level, and network partition information to which the resource belongs.

[0212] The resource attribute database stores detailed attribute information for all resources in the power monitoring system. Based on the resource identifiers in the original resource list, the database is queried to obtain the resource type for each resource, such as computing resources, storage resources, and network resources; the resource importance level, such as core resources, important resources, and general resources, with the importance level determined by the resource's role and scope of influence within the system; and the network partition information to which the resource belongs, i.e., the network area where the resource is located, such as control area, non-control area, and management information area.

[0213] The obtained resource attributes will be used to filter the original resource list and determine the list of affected resources.

[0214] Step S156: Filter the original resource list according to the resource attributes of the resources, retain the target resources that meet the preset categories, and form an affected resource list.

[0215] Based on the resource type, importance level, and network partition information in the resource attributes, and combined with preset filtering criteria, the original resource list is filtered. Preset categories typically include core resources and resources located in critical network partitions.

[0216] During the screening process, the resource types related to the core functions of the power monitoring system are first screened out based on resource type; then, resources marked as high importance are retained based on resource importance level, as these resources are often directly related to the stable operation and data security of the power monitoring system; finally, resources located in critical network partitions are included in the preliminary screening results by referring to the network partition information to which the resources belong.

[0217] Step S1561: Extract the number of associated nodes for each resource in the risk diffusion graph. The number of associated nodes is the total number of nodes that have an access relationship with the resource. The number of associated nodes is calculated by accumulating the node association weights in the risk diffusion graph.

[0218] For each resource in the original resource list, the total number of nodes that have an access relationship with that resource in the risk diffusion graph is counted one by one. During the counting process, it's not a simple count, but rather an accumulation based on the association weights between the nodes. For example, if a resource is accessed by two nodes, one with a higher association weight and the other with a lower weight, then when calculating the number of associated nodes, these two weights need to be added together and included in the count of associated nodes to more accurately reflect the tightness of the association between the resource and the node.

[0219] Step S1562: Divide the resource clusters according to the resource type. The same resource cluster contains resources of the same type. Calculate the resource interaction frequency of each resource cluster in the risk diffusion graph. The resource interaction frequency is the ratio of the total number of times resources within the resource cluster are accessed by different nodes to the time difference.

[0220] Resources in the original resource list are grouped according to their resource type, forming different resource clusters. Each cluster contains resources of the same type. For each cluster, the total number of times each resource is accessed by different nodes is counted, and the start and end times of these accesses are recorded to calculate the time difference. The total number of accesses is then divided by the time difference to obtain the resource interaction frequency of that cluster, which measures the activity level of that type of resource during risk diffusion.

[0221] Step S1563: Determine the resource cluster threshold corresponding to the preset category. The resource cluster threshold is associated with the resource importance level and the network partition information to which the resource belongs.

[0222] Based on preset categories, the threshold for each resource cluster is determined by combining the resource's importance level and its network partition information. For resource clusters with high importance levels and located in critical network partitions, the corresponding threshold will be set relatively low, because if such resources are affected, it may cause serious consequences, requiring more stringent screening; while for resource clusters with low importance levels and located in non-critical network partitions, the threshold will be relatively high.

[0223] Step S1564: Filter resource clusters whose resource interaction frequency exceeds the threshold of the corresponding resource cluster, and mark the resources in the resource cluster as the first filtered resources.

[0224] The resource interaction frequency of each resource cluster is compared with the set threshold for that resource cluster. If the resource interaction frequency of a certain resource cluster exceeds the corresponding threshold, it indicates that the resource cluster is relatively active in the risk diffusion process and may be greatly affected. Therefore, all resources in the resource cluster are marked as the first screening resources.

[0225] Step S1565: Check the network partition information of the first filtered resource, and extract the network topology distance between the partition where the first filtered resource is located and the network partition where the risk source node is located. The network topology distance is the number of routing hops between the two network partitions.

[0226] Obtain the network partition information of each of the first-selected resources, and simultaneously determine the network partition where the risk source node is located. By querying the network topology of the power monitoring system, calculate the routing hop count between the partition where each first-selected resource is located and the partition where the risk source node is located. Use this as the network topology distance between the two; the closer the distance, the greater the likelihood that the resource is affected by the risk spread.

[0227] Step S1566: Retain the first set of filtered resources whose network topology distance is less than the preset distance value to form the second set of filtered resources.

[0228] A preset distance value is set, and resources in the first filter whose network topology distance is less than this preset distance value are retained to form the second filter resource set. This step is to further narrow down the filtering scope, focusing on resources that are closer to the source of risk in terms of network topology and are more likely to be directly affected.

[0229] Step S1567: Sort the resources in the second filtered resource set according to the product of the resource importance level and the number of associated nodes, delete the resources that are ranked after a preset ratio, and the remaining resources form the target resource set.

[0230] For each resource in the second set of selected resources, its importance level is multiplied by the number of associated nodes to obtain a comprehensive evaluation index. Resources are then sorted from highest to lowest according to this index. A preset ratio is set, and resources ranking below this ratio are deleted. The remaining resources form the target resource set, which consists of resources that are highly susceptible to risk and are considered critical.

[0231] Step S1568: Bind the resource identifiers in the target resource set with the corresponding resource attributes, the number of associated nodes, and the network topology distance to generate a list of affected resources.

[0232] The identifier of each resource in the target resource set is associated with its corresponding resource attributes (including resource type, resource importance level, network partition, etc.), the number of associated nodes, and the network topology distance, and an affected resource list is formed.

[0233] Figure 2 The illustration shows exemplary hardware and software components of a network security analysis system 100 based on system log audit analysis, which can implement the ideas of this application, according to some embodiments of this application. For example, processor 120 can be used in the network security analysis system 100 based on system log audit analysis and to perform the functions in this application.

[0234] For example, a network security analysis system 100 based on system log audit analysis may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the network security analysis system 100 based on system log audit analysis may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to these program instructions. The network security analysis system 100 based on system log audit analysis also includes an I / O interface 150 between the computer and other input / output devices.

[0235] Furthermore, this embodiment of the invention also provides a readable storage medium, wherein computer-executable instructions are preset in the readable storage medium, and when the processor executes the computer-executable instructions, the network security analysis method based on system log audit analysis described above is implemented.

[0236] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A network security analysis method based on system log audit analysis, characterized in that, The method includes: Real-time capture of streaming log sequences generated by network nodes, wherein the streaming log sequences contain operation record entries generated sequentially in time order, and each operation record entry carries a node identifier, operation behavior description and trigger time information; The streaming log sequence is subjected to behavior chain weaving processing, which associates consecutive operation record entries belonging to the same operation subject into a dynamic behavior chain. The dynamic behavior chain includes the temporal connection relationship of operation behaviors and resource access links. Based on a preset security rule base, the dynamic behavior chain is pattern matched to identify candidate behavior segments that conform to potential risk patterns. The potential risk patterns include unauthorized access sequences, cross-node abnormal jump sequences, and resource abuse sequences. Reverse source tracing analysis is performed on the candidate behavior segments to track the preceding related logs and subsequent derived logs of the candidate behavior segments in the streaming log sequence, and a risk diffusion diagram is constructed. Based on the risk diffusion diagram, a security analysis report is generated that includes the risk source node, diffusion path, and list of affected resources, and the security analysis report is pushed to the security control center.

2. The network security analysis method based on system log audit analysis according to claim 1, characterized in that, The step of performing behavior chain weaving on the streaming log sequence, which associates consecutive operation record entries belonging to the same operation subject into a dynamic behavior chain, includes: Extract the operation subject identifier from each operation record entry in the streaming log sequence. The operation subject identifier includes the user account, process ID, and device MAC address. The streaming log sequence is split according to the operation subject identifier to obtain multiple subject-specific log streams. Each subject-specific log stream contains all operation record entries generated by the same operation subject. The log streams for each subject are sorted in ascending order based on the trigger time information to form a time-ordered sequence of subject operations; Parse the operation behavior descriptions of two adjacent operation record entries in each main operation sequence, determine whether the latter operation depends on the result of the former operation, and mark it as an associated operation pair if a dependency relationship exists. The consecutive associated operation pairs are chained together to form an initial behavior chain containing the temporal connection relationship of the operation behaviors, and the resource identifiers involved in each operation record entry in the initial behavior chain are extracted. The resource identifiers include file path, port number and database table name. Based on the access order of resource identifiers, resource access link information is embedded in the initial behavior chain to generate a dynamic behavior chain that includes temporal connections and resource access links. When a new operation record entry enters the subject's dedicated log stream, repeat the above steps to update the corresponding dynamic behavior chain. Perform an integrity check on the updated dynamic behavior chain to see if there are any broken related nodes. If so, re-check the dependencies between adjacent operation record entries. Store the verified dynamic behavior chain in the behavior chain database and manage it by partition according to the operation subject identifier and generation time.

3. The network security analysis method based on system log audit analysis according to claim 2, characterized in that, The process involves parsing the operation behavior descriptions of two adjacent operation record entries in each main operation sequence, determining whether the subsequent operation depends on the result of the preceding operation, and marking them as associated operation pairs if a dependency exists. Extract the operation behavior description of the Nth operation record entry in the main operation sequence, and determine the output resource identifier of the Nth operation record entry, wherein the output resource identifier is the resource generated or modified by the operation; Extract the operation behavior description of the N+1th operation record entry, and determine the input resource identifier of the N+1th operation record entry, wherein the input resource identifier is the resource that needs to be accessed for the operation; Compare the output resource identifier with the input resource identifier. If there is an intersection between the two, it is determined that the latter operation depends on the result of the former operation. If the output resource identifier and the input resource identifier do not overlap, check the operation result status code of the Nth operation and the triggering condition of the N+1th operation. If the success status code of the Nth operation is the triggering condition of the N+1th operation, it is determined that there is a dependency relationship. Mark the Nth and N+1th operation record entries that have a dependency relationship as an associated operation pair, and record the dependency type as resource dependency or state dependency; Repeat the above comparison process for all adjacent operation record entries in the main operation sequence until all associated operation pairs are marked.

4. The network security analysis method based on system log audit analysis according to claim 1, characterized in that, The process of performing pattern matching on the dynamic behavior chain based on a preset security rule base to identify candidate behavior segments that match potential risk patterns includes: Load a set of potential risk patterns from the security rule base. Each potential risk pattern includes a sequence of characteristic operations, a resource access threshold, and node jump constraints. The dynamic behavior chain is divided into multiple behavior sub-segments according to a fixed time window, and each behavior sub-segment contains operation record entries within a preset duration. Feature extraction is performed on each behavior sub-segment to obtain the operation type sequence, resource access list, and number of node switching involved in each behavior sub-segment; The operation type sequence is compared with the feature operation sequence in the potential risk pattern. When the operation type sequence contains all the operation types of the feature operation sequence and the order is consistent, the operation type is determined to be matched. Check whether the resource access list exceeds the resource access threshold set by the potential risk mode. The resource access threshold includes the access frequency of the same resource and the access types of cross-category resources. The number of node switching involved in the statistical behavior sub-segment is used to determine whether it meets the node jump constraint in the potential risk mode. The node jump constraint includes the maximum allowed number of cross-network segment jumps. When the operation type matches, the resource access does not exceed the threshold, and the node jump meets the constraints, the behavior sub-fragment is marked as a candidate behavior fragment. Repeat the above matching process for all behavioral sub-segments, summarize all candidate behavioral segments that meet the conditions, deduplicate the summarized candidate behavioral segments, merge segments with completely identical content, retain the time information of the first appearance, and then classify the deduplicated candidate behavioral segments according to risk mode type to form a category candidate list.

5. The network security analysis method based on system log audit analysis according to claim 4, characterized in that, The step of comparing the operation type sequence with the characteristic operation sequence in the potential risk pattern, and determining operation type matching when the operation type sequence contains all operation types of the characteristic operation sequence in the same order, includes: The sequence of operation types for the behavior sub-fragments is converted into a sequence of operation type codes, wherein each operation type in the sequence corresponds to a unique code; Obtain the encoded sequence of the feature operation sequence in the potential risk pattern, and use it as the template encoded sequence; Compare the operation type encoding sequence with the template encoding sequence bit by bit to check whether the operation type encoding sequence contains the complete encoding combination of the template encoding sequence; When there is a continuous coding segment in the operation type coding sequence that is completely consistent with the template coding sequence, record the start and end positions of the coding segment; Check whether the operation type encoding outside the encoding segment contains operation types that do not appear in the template encoding sequence. If so, further verify whether the operation type belongs to the preset ignoreable type. When there are no non-negligible additional operation types and the length of the complete encoded segment is the same as the length of the template encoded sequence, the operation type sequence is determined to match the feature operation sequence. Repeat the above comparison process for the feature operation sequences of all potential risk patterns until the matching pattern corresponding to the behavior sub-segment is determined. If a behavior segment matches multiple potential risk patterns simultaneously, the potential risk patterns are sorted by priority, and the potential risk pattern with the highest priority is selected as the matching result. The matching results and the information of the encoded segments involved in the matching process are stored in the matching log.

6. The network security analysis method based on system log audit analysis according to claim 1, characterized in that, The reverse source tracing analysis of the candidate behavior segment, tracking the preceding related logs and subsequent derived logs of the candidate behavior segment in the streaming log sequence, and constructing a risk diffusion diagram includes: Determine the time interval and starting operation record entry of the candidate behavior segment in the streaming log sequence; Tracing back from the starting operation record entry, find the preceding log entry that has a resource association or subject association with the starting operation record entry. The resource association refers to shared access to the same resource, and the subject association refers to the operation subject having a permission inheritance relationship. Collect all preceding log entries, analyze the correlation strength between the preceding log entries and candidate behavior segments, and sort them from high to low correlation strength to form a preceding associated log chain; Tracing backward from the termination operation record entry of the candidate behavior segment, find subsequent log entries affected by the termination operation record entry within a preset time range, wherein the operations triggered by the termination operation record entry include operations triggered by resource status changes and operations triggered by permission transfer; The subsequent log entries are arranged in chronological order to form a subsequent derived log chain. Each derived log entry in the subsequent derived log chain is marked with its influence path with the candidate behavior segment. Using the candidate behavior fragment as the core node, the preceding associated log chain as the source tracing branch, and the subsequent derived log chain as the diffusion branch, a risk diffusion graph containing node association weights is constructed. The degree of association of each node in the risk diffusion diagram is determined based on the correlation strength and time decay relationship, and the degree of association is used to represent the probability of risk transmission. Add attribute labels to each node in the risk diffusion diagram. The attribute labels include the operating entity, the resources involved, and the triggering time. Perform loop detection on the risk diffusion map. If there is a circular association between nodes, mark it as an abnormal loop and record it separately in the loop list. The completed risk diffusion map and loop list are stored in the database and indexed and associated according to the identifier of the candidate behavior segments.

7. The network security analysis method based on system log audit analysis according to claim 6, characterized in that, The analysis of the correlation strength between the preceding log entries and the candidate behavior segments, and the sorting of the correlation strength from high to low to form a preceding correlated log chain, includes: For each preceding log entry, extract the number of shared resources between the preceding log entry and the candidate behavior fragment start operation record entry. The more shared resources there are, the closer the association is. Calculate the time difference between the trigger time of the preceding log entry and the trigger time of the starting operation record entry; the smaller the time difference, the stronger the time correlation. Determine the permission relationship between the operation subject of the preceding log entry and the operation subject of the starting operation record entry; The association strength ranking criteria for each preceding log entry are determined by combining the number of shared resources, the time difference, and the permission relationship. The preceding log entries are sorted in descending order according to the aforementioned association strength sorting criteria to form an ordered preceding associated log chain; In the preceding associated log chain, key association elements are marked for each log entry. These key association elements include shared resources, time differences, or permission relationships. Calculate the association strength decay rate between adjacent log entries in the preceding associated log chain, whereby the association strength decay rate is used to represent the degree of weakening of the association during the tracing process; The sorted preceding associated log chains are bound to the identifiers of candidate behavior segments and stored in the traceability chain database.

8. The network security analysis method based on system log audit analysis according to claim 1, characterized in that, The process of generating a security analysis report based on the risk diffusion map, including the risk source node, diffusion path, and list of affected resources, includes: Traverse the source branches of the risk diffusion graph, identify the node corresponding to the preceding log entry with the highest correlation strength and at the beginning of the chain, and determine the node as the risk source node; Starting from the risk source node, the risk spread is traced along the associated links in the risk diffusion graph to the candidate behavior fragment, and then extended to the end node of the subsequent derived log chain to form the main path of risk diffusion; The operational behavior description and resource interaction information of each node in the main risk diffusion path are marked to form diffusion path details; Extract the resource identifiers involved in all nodes of the risk diffusion graph, and form the original resource list after deduplicating the resource identifiers; Query the resource attribute library to obtain the resource attributes of each resource in the original resource list. The resource attributes include resource type, resource importance level, and network partition information to which the resource belongs. The original resource list is filtered according to the resource attributes of the resources, and target resources that meet the preset categories are retained to form an affected resource list; The detailed information of the risk source node, the details of the diffusion path, and the list of affected resources are integrated in a structured format to generate a security analysis report, which also includes a simplified visual description of the risk diffusion diagram. Add the report generation time and the corresponding candidate behavior segment identifier to the security analysis report.

9. The network security analysis method based on system log audit analysis according to claim 8, characterized in that, The step of filtering the original resource list based on the resource attributes of the resources, retaining target resources that meet the preset categories, and forming an affected resource list includes: Extract the number of associated nodes for each resource in the risk diffusion graph. The number of associated nodes is the total number of nodes that have access relationships with the resource. The number of associated nodes is calculated by accumulating the node association weights in the risk diffusion graph. Resource clusters are divided according to the resource type. The same resource cluster contains resources of the same type. The resource interaction frequency of each resource cluster in the risk diffusion graph is calculated. The resource interaction frequency is the ratio of the total number of times resources within the resource cluster are accessed by different nodes to the time difference. Determine the resource cluster threshold corresponding to the preset category, and associate the resource cluster threshold with the resource importance level and the network partition information to which the resource belongs; Resource clusters whose resource interaction frequency exceeds the threshold of the corresponding resource cluster are selected, and the resources in the resource cluster are marked as the first selected resources. Check the network partition information of the first-selected resources, and extract the network topology distance between the partition where each first-selected resource is located and the network partition where the risk source node is located. The network topology distance is the number of routing hops between the two network partitions. The first set of filtered resources whose network topology distance is less than a preset distance value is retained to form a second set of filtered resources; The resources in the second filtered resource set are sorted according to the product of the resource importance level and the number of associated nodes. Resources that are ranked after a preset ratio are deleted, and the remaining resources form the target resource set. The resource identifiers in the target resource set are bound to the corresponding resource attributes, the number of associated nodes, and the network topology distance to generate a list of affected resources.

10. A network security analysis system based on system log auditing and analysis, characterized in that, The system includes a processor and a memory, the memory being connected to the processor. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the network security analysis method based on system log audit analysis as described in any one of claims 1-9.

Images