Intelligent prediction method and system applied to system log security audit

Abstract

The invention provides an intelligent prediction method and system applied to system log security audit, and the method comprises the steps: firstly obtaining a historical log data set of a power monitoring system, carrying out the event correlation modeling, generating a log event correlation model, generating a security event prediction rule library based on the log event correlation model through a rule mining algorithm, and carrying out the prediction of the security event. And then obtaining a real-time log data stream, inputting the log event association model to obtain a real-time event association result, matching the real-time event association result with the rule base to generate an abnormal event prediction result, finally generating a security audit report according to the abnormal event prediction result, sending the security audit report to the power monitoring terminal, and updating rule base parameters according to feedback information. Therefore, the abnormal event in the power monitoring system can be predicted in advance, and the intelligent level and the safety guarantee capability of system safety auditing are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power monitoring, in particular to an intelligent prediction method and system applied to system log security audit. BACKGROUND

[0002] In the field of power monitoring systems, with the promotion of smart grid construction, the system scale continues to expand, covering a large number of power equipment, network nodes and business systems. These components will continuously generate massive system log data during operation, which records key information such as operation time, operation subject, operation object and operation result, and is an important data source reflecting the system running state and security condition.

[0003] At present, the security audit method of the power monitoring system for system logs is relatively backward. Most of them use manual periodic viewing and analysis method. The above method is low in efficiency, and the analysis result is greatly influenced by the experience and subjective factors of the analyst, so it is difficult to comprehensively and accurately find the hidden security problems in the logs. Although some automatic audit tools can filter and count the logs, they lack the ability to mine the deep correlation between the log data. For some abnormal operations that seem independent but have potential correlation, the traditional method is difficult to identify, and it is also impossible to predict the possible security incidents in advance. In the face of increasingly complex and variable network security threats, the traditional audit method cannot prevent in time and effectively. Once a security incident occurs, it may seriously affect the stable operation of the power system, and even cause serious consequences such as large-area power failure. SUMMARY

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present application, the embodiments of the present application provide an intelligent prediction method applied to system log security audit, which comprises: acquiring a historical log data set of a power monitoring system, performing event correlation modeling processing on the historical log data set to generate a log event correlation model; based on the log event correlation model, extracting frequent patterns and regularizing representation of the event correlation path through a rule mining algorithm to generate a security event prediction rule library; acquiring a real-time log data stream of the power monitoring system, inputting the real-time log data stream into the log event correlation model for event type matching and attribute correlation verification to obtain a real-time event correlation result; matching the real-time event correlation result with the security event prediction rule library to generate an abnormal event prediction result; generating a security audit report according to the abnormal event prediction result, integrating the event type, risk level and correlation path, sending the security audit report to a power monitoring terminal, and updating the rule parameters of the security event prediction rule library based on the abnormal event processing information fed back by the security audit report.

[0005] In still another aspect, the embodiments of the present application also provide an intelligent prediction system applied to system log security audit, comprising a processor, a machine readable storage medium, the machine readable storage medium is connected with the processor, the machine readable storage medium is used for storing programs, instructions or codes, and the processor is used for executing the programs, instructions or codes in the machine readable storage medium to realize the above method.

[0006] Based on the above aspects, the embodiments of the present application can present the internal relations and occurrence rules between various events in the system running process by acquiring the historical log data of the power monitoring system to construct a log event correlation model, performing systematic analysis and correlation analysis on the events in the historical log, and avoiding the limitations of the traditional method of isolated processing of log data. The security event prediction rule base is generated by using a rule mining algorithm based on the log event correlation model, and the representative and predictive value security rules are extracted. Then, the real-time log data stream is acquired and input into the log event correlation model for event type matching and attribute correlation verification, which can capture the current running state and event correlation of the system in real time, reflect the dynamic changes of the system in time, match the real-time event correlation result with the security event prediction rule base to generate the abnormal event prediction result, so that the operation and maintenance personnel can take measures before the security event occurs, effectively reduce the influence of the security event on the system, generate a security audit report according to the abnormal event prediction result and send it to the power monitoring terminal, so as to facilitate the operation and maintenance personnel to quickly understand the system security status and develop countermeasures. At the same time, the security event prediction rule base is updated according to the feedback abnormal event processing information, so as to adapt to the changes of the system running state and the evolution of the security threat, and continuously optimize the prediction capability. BRIEF DESCRIPTION OF DRAWINGS

[0007] Figure 1 is the execution flow diagram of the intelligent prediction method applied to system log security audit provided by the embodiments of the present application.

[0008] Figure 2 is the schematic diagram of exemplary hardware and software components of the intelligent prediction system applied to system log security audit provided by the embodiments of the present application. DETAILED DESCRIPTION

[0009] The present application will be described in detail below with reference to the accompanying drawings, Figure 1 is the flow diagram of the intelligent prediction method applied to system log security audit provided by an embodiment of the present application, and the intelligent prediction method applied to system log security audit will be described in detail below.

[0010] Step S110: Obtain a historical log data set of the power monitoring system, perform event correlation modeling processing on the historical log data set, and generate a log event correlation model.

[0011] In this embodiment, the power monitoring system covers multiple components such as substation monitoring equipment, power transmission line monitoring devices, and power distribution automation terminals. These components continuously generate various types of log data during operation, including device startup, parameter adjustment, state switching, fault alarm, and other information. The historical log data set is a summary of all log data generated by these components in the past period of time.

[0012] To perform event correlation modeling processing on the historical log data set, the log data needs to be comprehensively parsed first, and then the correlation between events needs to be mined. Finally, a model that can reflect the correlation rules between events is constructed.

[0013] Step S111: Perform log event parsing processing on the historical log data set, read the text content of each log entry, identify the format type of the log entry, extract the event type identifier and event attribute information according to the pre-set field for the structured format log entry, and perform entity recognition and key information extraction on the unstructured format log entry using natural language processing technology to obtain the event type identifier and event attribute information of each log entry. The event attribute information includes event occurrence time, event source device identifier, event operation type, and event state description.

[0014] In the power monitoring system, the log entry format in the historical log data set is diverse. Some devices generate structured format logs, such as the logs of some intelligent circuit breakers, which can record information according to a fixed field format. However, some old devices or specific operations may generate unstructured text logs, such as manual operation records input by operation and maintenance personnel.

[0015] For example, step S1111: read each log entry in the historical log data set, load the text content of the log entry into the memory buffer, read the text content by line, identify the start identifier and end identifier of each line of text content, and determine the text range of a single log entry.

[0016] The memory buffer allocates independent storage space for each log entry to avoid content confusion between different log entries. The start identifier can be a specific character combination, such as "[LOG_START]", and the end identifier can be "[LOG_END]". When reading line by line, check whether each line contains the start identifier. When the start identifier is encountered, start recording the log content until the end identifier is read to determine the text range of a single log entry. For example, the start identifier of a certain log is "<LOG_BEGIN>", and the end identifier is "<LOG_END>". When "<LOG_BEGIN> Device A startup success <LOG_END>" is read, it can be determined that the text range of this log is "Device A startup success".

[0017] Step S1112: Format type identification is performed on the text content of a single log entry. It is checked whether the text content contains a preset structured delimiter. When the text content contains a structured delimiter, it is determined to be a structured format log entry. When the text content does not contain a structured delimiter, it is determined to be an unstructured format log entry.

[0018] The preset structured delimiter can be a comma, a semicolon, a vertical bar, etc. For example, a certain log content is "2023-10-0108:00:00, Device B, closing operation, success", which contains a comma as a delimiter, so it is determined to be a structured format log entry. The log content "Device C appears abnormal, needs to be repaired" does not contain a preset structured delimiter, so it is determined to be an unstructured format log entry.

[0019] Step S1113: Field extraction processing is performed on the structured format log entry. According to the preset field separation rule, the log entry text content is split into multiple fields with the structured delimiter as the boundary. Each field corresponds to a preset field name. The field value of the field name as the event type identifier is extracted as the event type identifier, and the field value of the field name as the event occurrence time, event source device identifier, event operation type, and event state description is extracted as the event attribute information.

[0020] The preset field separation rule will clearly indicate the field order corresponding to each delimiter. For example, for the structured log "2023-10-01 08:00:00, Device B, closing operation, success", the preset rule is to separate in the order of "event occurrence time, event source device identifier, event operation type, event state description, event type identifier". Then the fields obtained after splitting are the event occurrence time "2023-10-01 08:00:00", the event source device identifier "Device B", the event operation type "closing operation", the event state description "success", and the event type identifier if there are subsequent fields.

[0021] Step S1114: text preprocessing is performed on the unstructured format log entry, a word segmentation tool in natural language processing technology is used to perform word segmentation processing on the text content of the log entry, stop words and meaningless characters are removed, and meaningful words are retained to form a word segmentation result.

[0022] The word segmentation tool splits the unstructured text into individual words. For example, for "Equipment C appears abnormal, needs timely maintenance", the word segmentation result is "Equipment C", "appears", "abnormal", "needs", "timely", and "maintenance". The stop words include "appears", "needs", and "timely", which have no actual business meaning, and the meaningless characters can be punctuation marks such as ", ". After removing these, the retained word segmentation result is "Equipment C", "abnormal", and "maintenance".

[0023] Step S1115: performing entity recognition processing on the word segmentation result, using a pre-trained named entity recognition model to perform entity annotation on the word segmentation result, and identifying entities representing event types, entities representing times, entities representing device identifiers, entities representing operation types, and entities representing state descriptions.

[0024] The pre-trained named entity recognition model is trained on a large amount of power monitoring field text and can accurately identify related entities. For the word segmentation result "Equipment C", "abnormal", and "maintenance", the model will label "Equipment C" as an entity representing a device identifier, "abnormal" as an entity representing a state description, and "maintenance" as an entity representing an operation type. If there is time information in the text, such as "2023-10-01 09:00 Equipment D fault", the model will label "2023-10-01 09:00" as an entity representing a time.

[0025] Step S1116: extracting key information according to the entity recognition result, taking the entity content representing the event type as the event type identifier, taking the entity content representing the time as the event occurrence time, taking the entity content representing the device identifier as the event source device identifier, taking the entity content representing the operation type as the event operation type, and taking the entity content representing the state description as the event state description, and combining to form event attribute information.

[0026] In the example of "Equipment C appears abnormal, needs timely maintenance", if "abnormal event" is identified as an entity representing an event type, the event type identifier is "abnormal event"; "Equipment C" is the event source device identifier; "maintenance" is the event operation type; and "abnormal" is the event state description. If there is a time entity, it is taken as the event occurrence time, and the event attribute information is combined.

[0027] Step S1117: Standardize the extracted event type identifier, and uniformly convert event type identifiers with different expressions but the same meaning into elements in a preset standard event type identifier set.

[0028] There may be different expressions of the same event type in the power monitoring system, such as "device failure", "device failure" and "device abnormal shutdown", which all represent the event type of device failure. If such events are uniformly specified as "device failure event" in the preset standard event type identifier set, the above different expressions will be uniformly converted into "device failure event".

[0029] Step S1118: Perform data cleaning processing on the extracted event attribute information to obtain the event type identifier and event attribute information of each log entry.

[0030] The data cleaning processing includes checking whether the event occurrence time conforms to the standard format, uniformly converting different formats such as "2023 / 10 / 01" and "10-01-2023" to "2023-10-01" format, checking whether the event source device identifier is unique and valid, removing duplicate or invalid identifiers, and ensuring that the event operation type and event state description are clear and unambiguous. After processing, the standard event type identifier and event attribute information are obtained.

[0031] Step S112: Classify and aggregate the log entries according to the event type identifier, traverse all log entries, group log entries with the same event type identifier into the same event type group, and count the number of log entries included in each event type group to obtain multiple event type groups.

[0032] Traverse all log entries processed in the historical log data set, and view the event type identifier of each log one by one. For example, all log entries with event type identifier "device startup event" are grouped into "device startup event", and log entries with event type identifier "device failure event" are grouped into "device failure event". Count the number of log entries in each group, such as "device startup event" group has several entries, and "device failure event" group has several entries, forming multiple event type groups.

[0033] Step S113: Perform correlation analysis processing on the event attribute information in each event type group, extract the event attribute information of all log entries in the same event type group, calculate the co-occurrence frequency in the time dimension and the correlation strength in the space dimension of different event attribute information, and determine the correlation relationship between different event attribute information according to the co-occurrence frequency and the correlation strength.

[0034] Taking the "device failure event" group as an example, the event attribute information of all log entries in the group is extracted, including the event occurrence time of each log, the event source device identifier, the event operation type, and the event state description. In the time dimension, the co-occurrence frequency of the failure events of different device identifiers in the same or similar time period is calculated, that is, the co-occurrence frequency; in the spatial dimension, the physical connection relationship or functional association relationship between different device identifiers is analyzed to determine the association strength. For example, device E and device F are adjacent devices on the same power transmission line, and their failure events often occur at the same time or successively, with a high co-occurrence frequency and a large spatial association strength, so it is determined that there is a strong association relationship between the event attribute information of the two devices.

[0035] Step S114: Constructing an event association network based on the association relationship, taking the event type identifier as the network node, taking the association relationship between the event attribute information as the directed edge between the nodes, setting the weight value of the directed edge according to the strength of the association relationship, and generating an initial event association network.

[0036] Various event type identifiers are taken as nodes in the network, such as "device startup event", "device failure event", "parameter adjustment event", etc. If the "parameter adjustment event" often leads to the occurrence of the "device startup event", a directed edge is established between the "parameter adjustment event" node and the "device startup event" node, with the direction from the "parameter adjustment event" to the "device startup event". The weight value is set according to the strength of the association relationship between the two, and the stronger the association, the greater the weight value. In this way, an initial event association network containing multiple nodes and directed edges is constructed.

[0037] Step S115: Performing network structure optimization processing on the initial event association network, traversing all directed edges in the initial event association network, calculating the weight value of each directed edge, removing the directed edges with a weight value lower than a preset threshold, and retaining the directed edges with a weight value higher than the preset threshold to obtain an optimized event association network.

[0038] The preset threshold is set according to actual business requirements and historical data association. Each directed edge in the initial event association network is traversed to calculate its weight value. For the directed edges with a weight value lower than the preset threshold, it is indicated that the association between the corresponding two event types is weak, and they are removed; the directed edges with a weight value higher than the preset threshold are retained. For example, a directed edge from the "device self-check event" to the "device failure event" has a weight value lower than the threshold, indicating that the device self-check event and the device failure event are weakly associated, and it is removed, thereby obtaining an optimized event association network with a more simplified structure and a closer association.

[0039] Step S116: Model verification processing is performed on the optimized event correlation network, a part of log entries are randomly selected from the historical log data set as a verification data set, the verification data set is input into the optimized event correlation network for event correlation prediction, the predicted event correlation relationship is extracted, and the actual event correlation relationship in the verification data set is compared, the matching degree of the correlation relationship is calculated, and when the matching degree reaches a preset standard, the optimized event correlation network is determined as a log event correlation model.

[0040] A set of log entries with a set proportion is randomly selected from the historical log data set as a verification data set, for example, 30% of the log entries are selected. These log entries are input into the optimized event correlation network, and the network will predict the correlation between events according to the existing nodes and directed edges. The predicted correlation relationship is compared with the actual existing correlation relationship in the verification data set, and the matching degree of the two is calculated. If the matching degree reaches a preset standard, such as the matching degree exceeds 80%, it is considered that the optimized event correlation network can accurately reflect the correlation between events, and it is determined as a log event correlation model; if the preset standard is not reached, the network structure optimization processing is returned to be performed again.

[0041] Step S120: Based on the log event correlation model, a rule mining algorithm is used to extract frequent patterns and regularize representations of event correlation paths, and a security event prediction rule library is generated.

[0042] The log event correlation model has clearly defined the correlation and strength between different event types, and the rule mining algorithm will mine the frequently occurring event correlation paths based on this model, and convert these paths into rules that can be used to predict security events, and then form a rule library.

[0043] Step S121: A set of event correlation paths is extracted from the log event correlation model, all nodes and directed edges in the log event correlation model are traversed, the directed edge connection relationship between nodes is tracked, and all possible event correlation paths are extracted, each event correlation path contains a plurality of event type identifiers arranged in chronological order.

[0044] Each node in the log event correlation model is traversed, starting from each node, the connection relationship with other nodes is tracked along the direction of the directed edge. For example, starting from the "parameter adjustment event" node, passing through the directed edge to the "device startup event" node, and then from the "device startup event" node to the "device running normally event" node through the directed edge, an event correlation path "parameter adjustment event--device startup event--device running normally event" is formed. In this way, all possible event correlation paths are extracted, and the event type identifiers in each path are arranged in chronological order.

[0045] Step S122: Perform frequent path mining processing on the event correlation path set, count the number of occurrences of each event correlation path in the historical log data set, calculate the ratio of the number of occurrences of each event correlation path to the total number of event correlation path sets, and determine the event correlation path with a ratio higher than the preset frequency threshold as a frequent event correlation path as a candidate rule path.

[0046] Count the number of occurrences of each event correlation path in the historical log data set, for example, the path "parameter adjustment event - device startup event - device normal operation event" occurs several times, "device abnormal event - device shutdown event - fault repair event" occurs several times, etc. Calculate the ratio of the number of occurrences of each path to the total number of all paths, and determine the path with a ratio higher than the preset frequency threshold as a frequent event correlation path. For example, the preset frequency threshold is 10%, and the ratio of a certain path is 15%, which is considered as a candidate rule path.

[0047] Step S123: Perform path decomposition processing on the candidate rule path, and split each candidate rule path into a pre-event sequence and a subsequent event identifier. The pre-event sequence contains other event type identifiers in the candidate rule path except the last event type identifier, and the subsequent event identifier is the last event type identifier of the candidate rule path.

[0048] Step S1231: Traverse each candidate rule path in the candidate rule path set, and represent the candidate rule path as an ordered list of event type identifiers. Each element in the ordered list is an event type identifier, and the order of the elements corresponds to the time sequence of event occurrence.

[0049] Each candidate rule path is presented in the form of an ordered list, for example, the candidate rule path "parameter adjustment event - device startup event - device normal operation event" is represented as an ordered list [parameter adjustment event, device startup event, device normal operation event], where the order of the elements is consistent with the time sequence of event occurrence.

[0050] Step S1232: Determine the length of the ordered list, count the number of event type identifiers contained in the ordered list, when the length of the ordered list is 1, mark the candidate rule path as an invalid path and exclude it, when the length of the ordered list is greater than 1, perform path decomposition operation.

[0051] Count the number of event type identifiers in the ordered list, i.e. the length of the ordered list. If the length of the ordered list of a certain candidate rule path is 1, such as [device failure event], it cannot be split into a pre-event sequence and a subsequent event identifier, so it is marked as an invalid path and excluded. For an ordered list with a length greater than 1, such as a list with a length of 3, perform decomposition operation.

[0052] Step S1233: Extract all elements in the ordered list except the last one, combine them in the order in the original ordered list to form a pre-event sequence, which is an ordered sub-list of event type identifiers.

[0053] For the ordered list [parameter adjustment event, device startup event, device running normally event], the last element is "device running normally event", and the remaining elements are "parameter adjustment event" and "device startup event". Combine them in the original order to form a pre-event sequence [parameter adjustment event, device startup event].

[0054] Step S1234: Extract the last element in the ordered list as a subsequent event identifier, which is a single event type identifier.

[0055] The last element of the above ordered list is "device running normally event", which is taken as the subsequent event identifier.

[0056] Step S1235: Store the pre-event sequence and the subsequent event identifier in association, create a path decomposition mapping table, store the unique identifier of the candidate rule path as the key and the pre-event sequence and the subsequent event identifier as the value in the mapping table, so that each candidate rule path corresponds to a unique pre-event sequence and subsequent event identifier.

[0057] Assign a unique identifier to each candidate rule path, such as path ID. In the path decomposition mapping table, the path ID is the key and the corresponding value is the pre-event sequence and subsequent event identifier obtained by path decomposition. For example, the path ID P001 corresponds to the pre-event sequence [parameter adjustment event, device startup event] and the subsequent event identifier "device running normally event".

[0058] Step S1236: Check the integrity of the pre-event sequence, traverse each event type identifier in the pre-event sequence, query the preset event type dictionary, verify whether the event type identifier exists in the event type dictionary, and when there is an event type identifier that does not exist, mark the corresponding candidate rule path as an abnormal path and exclude it, so that all event type identifiers in the pre-event sequence are valid identifiers.

[0059] The preset event type dictionary contains all valid event type identifiers in the power monitoring system. Traverse each identifier in the pre-event sequence, such as [parameter adjustment event, device startup event], query the event type dictionary, and confirm that both identifiers exist in the dictionary. If a pre-event sequence contains "unknown event" and the identifier is not in the event type dictionary, the corresponding candidate rule path is marked as an abnormal path and excluded.

[0060] Step S1237: Format standardization processing is performed on the decomposed preceding event sequence and the subsequent event identifier, the preceding event sequence is converted into a string format separated by a set separator, and the subsequent event identifier is converted into a string format.

[0061] The set separator can be “|”, and the preceding event sequence [parameter adjustment event, device startup event] is converted into the string format “parameter adjustment event | device startup event”. The subsequent event identifier “device running normally event” is directly converted into the string format “device running normally event”. Through the above format standardization processing, the preceding event sequence and the subsequent event identifier can maintain a consistent format in the subsequent rule generation and matching process, facilitating data storage, transmission, and comparison operations.

[0062] Step S124: Based on the decomposed preceding event sequence and the subsequent event identifier, a security event prediction rule is generated, the event attribute information corresponding to each event type identifier in the preceding event sequence is extracted, these event attribute information is combined to form a rule precondition, a pre-set abnormal event definition library is queried to obtain the abnormal risk level corresponding to the subsequent event identifier, the subsequent event identifier and the abnormal risk level are combined to form a rule conclusion, a unique rule identifier and a rule generation timestamp are added to each rule, and an initial security event prediction rule is generated.

[0063] For the preceding event sequence “parameter adjustment event | device startup event”, the event attribute information corresponding to each event type identifier is extracted. The attribute information corresponding to “parameter adjustment event” can include the parameter name adjusted, the parameter value range before and after adjustment, the execution user of the adjustment operation, etc.; the attribute information corresponding to “device startup event” can include the startup duration, the voltage and current range at startup, whether the startup is successful, etc. These attribute information is combined to form a rule precondition, for example, “parameter adjustment event (the parameter name is voltage threshold, the adjusted value is in a specific range) and device startup event (the startup duration is in a specific range, the startup is successful)”.

[0064] The pre-set abnormal event definition library is queried, and the abnormal event definition library stores the abnormal risk level corresponding to each event type identifier. For example, if the subsequent event identifier is “device overload event”, the abnormal event definition library can define the corresponding abnormal risk level as high risk; if the subsequent event identifier is “device slight alarm event”, the corresponding abnormal risk level can be low risk. The subsequent event identifier “device running normally event” and the corresponding abnormal risk level (assuming no risk) are combined to form a rule conclusion, i.e., “the subsequent event is device running normally event, and the abnormal risk level is no risk”.

[0065] Add a unique rule identifier to each generated rule, such as rule ID R001, and record the timestamp of rule generation, such as "2023-10-05 14:30:00", thereby generating an initial security event prediction rule.

[0066] Step S125: Perform rule filtering processing on the initial security event prediction rules, apply the initial security event prediction rules to the test data set in the historical log data set, count the number of correct predictions and the total number of predictions for each rule, calculate the prediction accuracy, count the ratio of the number of abnormal events in the test data set covered by the rule to the total number of abnormal events in the test data set, calculate the rule coverage, and select the initial security event prediction rules with prediction accuracy and coverage rate higher than the preset threshold.

[0067] A portion of the historical log data set is divided as a test data set, for example, 20% of the log data. Apply each initial security event prediction rule to the test data set. For each rule, when the log entry in the test data set meets its rule precondition, the rule will predict the corresponding subsequent event and abnormal risk level. Compare the prediction results with the actual events and risk levels in the test data set, count the number of correct predictions and the total number of predictions, and the rule prediction accuracy is the ratio of the number of correct predictions to the total number of predictions.

[0068] At the same time, count the number of abnormal events in the test data set covered by each rule, i.e. the number of test data sets that meet the rule preconditions and actually occur corresponding abnormal events, and the rule coverage is the ratio of this number to the total number of abnormal events in the test data set.

[0069] The preset prediction accuracy threshold and coverage rate threshold are, for example, 70% and 60% respectively. Select the initial security event prediction rules with prediction accuracy higher than 70% and coverage rate higher than 60%, which have better prediction effect and application scope.

[0070] Step S126: Store the filtered security event prediction rules according to the abnormal risk level, create a rule storage directory, store the security event prediction rules with the same abnormal risk level in the same directory, establish a rule index table, and generate a security event prediction rule library with the event type identifier and event attribute information in the rule precondition as the index key.

[0071] Create different rule storage directories, such as "high-risk rule directory", "medium-risk rule directory", "low-risk rule directory" and "no-risk rule directory". Store the filtered security event prediction rules in the corresponding directory according to the abnormal risk level in the rule conclusion, for example, store the rules with high-risk level in the "high-risk rule directory".

[0072] The index table is established, and the index keywords include the event type identifiers and the event attribute information in the rule precondition. For example, the precondition of a rule contains a "parameter adjustment event" and a "device startup event" and corresponding attribute information, and the two event type identifiers and the related attribute information are used as the index keywords to record the storage path and the rule identifier of the rule in the index table. Through the above method, when a rule related to a specific event type and attribute needs to be queried, the corresponding rule can be quickly retrieved from the rule library to generate a security event prediction rule library.

[0073] Step S130: Obtain the real-time log data stream of the power monitoring system, input the real-time log data stream into the log event association model for event type matching and attribute association verification, and obtain the real-time event association result.

[0074] The power monitoring system will generate log data in real time during operation, forming a real-time log data stream. These real-time data need to be processed and matched and verified with the existing log event association model to determine the association relationship between real-time events.

[0075] Step S131: Real-time receive the real-time log data stream through the log collection interface of the power monitoring system, perform stream parsing processing on the real-time log data stream, read each real-time log entry in turn according to the log entry receiving order, identify the format type of each real-time log entry, and extract the real-time event type identifier and the real-time event attribute information of the real-time log entry.

[0076] The log collection interface is connected with each component of the power monitoring system, and real-time receives the log data transmitted from these components. The stream parsing processing adopts the row-by-row reading mode and processes each real-time log entry according to the receiving order.

[0077] For each real-time log entry, identify whether it is structured or unstructured, and the identification method is consistent with that in step S1112. For the real-time log entry in structured format, extract the real-time event type identifier and the real-time event attribute information according to the preset field; for the real-time log entry in unstructured format, adopt the method similar to steps S1114 to S1118 to perform word segmentation, entity recognition, key information extraction, standardization processing and data cleaning, and obtain the real-time event type identifier and the real-time event attribute information.

[0078] For example, a structured real-time log "2023-10-05 15:00:00, device G, split operation, failure" is received, and the real-time event type identifier is extracted as "operation failure event", and the real-time event attribute information includes event occurrence time "2023-10-05 15:00:00", event source device identifier "device G", event operation type "split operation", and event status description "failure".

[0079] Step S132: Standardizing the real-time event attribute information, referring to the format requirements of the event attribute information in the log event association model, uniformly converting the event occurrence time format, event source device identifier format, event operation type representation, and event status description field in the real-time event attribute information.

[0080] The event attribute information in the log event association model has a unified format specification, for example, the event occurrence time format is "YYYY-MM-DDHH:MM:SS", the event source device identifier format is "device + capital letter + number" (such as device A1), the event operation type representation is "close", "split", "start", "stop", etc. Standard vocabulary, and the event status description field is "success", "failure", "normal", "abnormal", etc.

[0081] When standardizing the real-time event attribute information, if the real-time event occurrence time is "2023 / 10 / 05 3:00PM", it is converted to "2023-10-05 15:00:00"; if the event source device identifier is "G device", it is converted to "device G"; if the event operation type representation is "disconnect the switch", it is converted to "split"; if the event status description is "not successful", it is converted to "failure".

[0082] Step S133: Input the real-time event type identifier into the log event association model, traverse all nodes in the log event association model, find the target node with the same real-time event type identifier, extract all associated edge information of the target node, and the associated edge information includes the association direction, the associated event type identifier, and the associated attribute constraint condition.

[0083] The real-time event type identifier "operation failure event" is input into the log event association model, all nodes in the model are traversed, and the same target node as the "operation failure event" is found. There can be multiple association edges for the target node, for example, one association edge has an association direction pointing to the "device failure event" node, an association event type identifier of "device failure event", and an association attribute constraint condition of "event occurrence time interval within a specific range and event source device identifier being the same"; another association edge has an association direction from the "parameter error event" node, an association event type identifier of "parameter error event", and an association attribute constraint condition of "event source device identifier being the same and event operation type being related".

[0084] Step S134: Based on the association edge information, the real-time event attribute information is associated and verified, the event occurrence time, event source device identifier, event operation type, and event state description in the real-time event attribute information are compared with the association attribute constraint condition, and it is checked whether the real-time event attribute information meets the requirement of the association attribute constraint condition. When the requirement is met, it is determined that there is an association relationship between the real-time events.

[0085] Step S1341: The association attribute constraint condition is extracted from the association edge information, the attribute constraint field in the association edge information is parsed, the event occurrence time constraint range, event source device identifier allowed set, event operation type allowed set, and event state description matching mode are obtained, the event occurrence time constraint range is a time interval, the event source device identifier allowed set is a set of multiple device identifiers, the event operation type allowed set is a set of multiple operation types, and the event state description matching mode is a regular expression.

[0086] For the association edge with an association direction pointing to the "device failure event" node, the attribute constraint field is parsed to obtain an event occurrence time constraint range of "a specific time period before and after the real-time event occurrence time", an event source device identifier allowed set of "{device G, device H, device I}", an event operation type allowed set of "{switch off, switch on}", and an event state description matching mode of a regular expression of "failure | exception".

[0087] Step S1342: The event occurrence time in the real-time event attribute information is extracted, the event occurrence time is converted into the format of a time stamp, and it is checked whether the time stamp is within the event occurrence time constraint range. When the time stamp is within the event occurrence time constraint range, it is determined that the event occurrence time meets the constraint condition.

[0088] The event occurrence time in the real-time event attribute information is "2023-10-05 15:00:00", which is converted into a corresponding timestamp. If the event occurrence time constraint range is "2023-10-05 14:50:00 to 2023-10-05 15:10:00" corresponding to the timestamp interval, and the real-time timestamp is within the interval, it is determined that the event occurrence time meets the constraint condition.

[0089] Step S1343: Extract the event source device identifier in the real-time event attribute information, check whether the device identifier exists in the allowed set of event source device identifiers, and when the device identifier exists in the allowed set, determine that the event source device identifier meets the constraint condition.

[0090] The real-time event source device identifier is "device G", the event source device identifier allowed set is "{device G, device H, device I}", and "device G" exists in the set, so it is determined that the event source device identifier meets the constraint condition.

[0091] Step S1344: Extract the event operation type in the real-time event attribute information, check whether the operation type exists in the allowed set of event operation types, and when the operation type exists in the allowed set, determine that the event operation type meets the constraint condition.

[0092] The real-time event operation type is "opening operation", the event operation type allowed set is "{opening, closing}", and "opening operation" belongs to the set, so it is determined that the event operation type meets the constraint condition.

[0093] Step S1345: Extract the event state description in the real-time event attribute information, and use the regular expression corresponding to the event state description matching pattern to perform pattern matching on the event state description. When the matching is successful, it is determined that the event state description meets the constraint condition.

[0094] The real-time event state description is "failure", the event state description matching pattern is the regular expression "failure | exception", and "failure" matches the regular expression successfully, so it is determined that the event state description meets the constraint condition.

[0095] Step S1346: Count the number of event occurrence times, event source device identifiers, event operation types, and event state descriptions that meet the constraint condition. When all attributes meet the constraint condition, it is determined that the real-time event attribute information meets the associated attribute constraint condition.

[0096] In the above example, the event occurrence time, event source device identifier, event operation type, and event state description all meet the constraint condition, so it is determined that the real-time event attribute information meets the associated attribute constraint condition.

[0097] Step S1347: Determine the association relationship between real-time events according to the satisfaction of the association attribute constraint condition. When the real-time event attribute information satisfies the association attribute constraint condition, it is determined that there is an association relationship between the real-time event and the corresponding event in the log event association model, the direction of the association relationship is from the real-time event to the corresponding event in the log event association model, and the strength of the association relationship is a preset association strength value.

[0098] Since the real-time event attribute information satisfies the association attribute constraint condition, it is determined that the current "operation failure event" is associated with the "device failure event" in the log event association model, the direction of the association relationship is from the "operation failure event" to the "device failure event", and the strength of the association relationship is determined according to the weight value of the association edge in the log event association model, for example, it is preset to be medium strength.

[0099] Step S135: Construct a real-time event association sequence according to the association relationship between real-time events, arrange the real-time event type identifiers with the association relationship in chronological order, form a real-time event type identifier sequence, and connect the real-time event attribute information corresponding to each real-time event type identifier in the association order to form an event attribute information association chain.

[0100] With the continuous reception and processing of real-time log data streams, multiple real-time events with association relationships can be generated. For example, "parameter error event", "operation failure event" and "device failure event" are received in sequence, and they have an association relationship, arranged in chronological order to form a real-time event type identifier sequence [parameter error event, operation failure event, device failure event].

[0101] The real-time event attribute information corresponding to each event type identifier is connected in the association order, such as the attribute information of the "parameter error event" is (time T1, device G, parameter setting error, abnormality), the attribute information of the "operation failure event" is (time T2, device G, opening operation, failure), and the attribute information of the "device failure event" is (time T3, device G, no operation, failure). Connect them to form an event attribute information association chain: (T1, device G, parameter setting error, abnormality) -- (T2, device G, opening operation, failure) -- (T3, device G, no operation, failure).

[0102] Step S136: integrity check processing is performed on the real-time event type identification sequence and the event attribute information association chain, whether there is a continuous event type identification missing condition in the real-time event type identification sequence is checked, whether there is a property field break condition in the event attribute information association chain is checked, if there is a missing or break, the previous and subsequent associated log entries in the real-time log data stream are queried for supplementation, and a real-time event association result containing the real-time event type identification sequence and the corresponding event attribute information association chain is generated.

[0103] The real-time event type identification sequence [parameter error event, operation failure event, device fault event] is checked to see if there is an event type identification that should appear according to the association relationship but does not appear, for example, whether there should be a "parameter verification event" between the "parameter error event" and the "operation failure event", if there is a missing, the log entries before and after the time period in the real-time log data stream are queried to see if there is a missing "parameter verification event" log, if there is, it is supplemented into the sequence.

[0104] The event attribute information association chain is checked to see if the attribute fields of each event are complete and whether there is a condition that the attribute fields (such as event occurrence time, device identifier, etc.) of a certain event are missing, i.e., the attribute field is broken. If the event occurrence time field of the "operation failure event" is found to be missing, the original log entry corresponding to the event is queried to supplement the complete event occurrence time.

[0105] After integrity check and supplementation, the final real-time event association result is generated, containing a complete real-time event type identification sequence and a corresponding event attribute information association chain.

[0106] Step S140: match the real-time event association result with the security event prediction rule library to generate an abnormal event prediction result.

[0107] The real-time event association result reflects the association between the current real-time events, which is matched with the rules in the security event prediction rule library to predict possible abnormal events.

[0108] Step S141: load all security event prediction rules from the security event prediction rule library, parse the rule preconditions and rule conclusions of each security event prediction rule, extract the event type identification and event attribute information constraints in the rule preconditions, and construct a rule index table with event type identification as the index key.

[0109] Load all rules from each directory of the safety event prediction rule library, for example, load rule R002 from the "high-risk rule directory", whose rule precondition is "parameter error event (parameter type is voltage parameter, error type is out of range) and operation failure event (operation type is opening, state is failure)", and whose rule conclusion is "subsequent event is device failure event, and abnormal risk level is high risk".

[0110] Extract the event type identifiers "parameter error event" and "operation failure event" in the rule precondition, as well as the corresponding event attribute information constraints (such as parameter type, error type, operation type, state, etc.). Construct a rule index table, taking the combination of event type identifiers as the index key, such as "parameter error event | operation failure event", and the index value as the corresponding rule identifier, rule precondition and rule conclusion, etc.

[0111] Step S142: Extract the real-time event type identifier sequence and event attribute information association chain from the real-time event association result, match the real-time event type identifier sequence with the index key in the rule index table, filter out the safety event prediction rules whose index key matches any continuous event type identifier combination in the real-time event type identifier sequence, and form a candidate matching rule set.

[0112] Extract the real-time event type identifier sequence [parameter error event, operation failure event, device failure event] and the corresponding event attribute information association chain from the real-time event association result. Compare any continuous event type identifier combination in the sequence with the index key in the rule index table, such as the continuous combination "parameter error event | operation failure event" matching the index key "parameter error event | operation failure event", and the corresponding rule R002 is filtered out and added to the candidate matching rule set.

[0113] Step S143: Perform precondition comparison processing on each safety event prediction rule in the candidate matching rule set, extract the event attribute information constraints in the rule precondition, traverse the event attribute information association chain, compare the event attribute information in the event attribute information association chain with the event attribute information constraints in the rule precondition field by field, calculate the matching degree of each field, and weight and sum the matching degrees of all fields to obtain the field matching degree total.

[0114] For the candidate matching rule R002, extract the event attribute information constraints in its rule precondition, including that the event occurrence time needs to be within ten minutes after the device starts, the event source device identifier belongs to the power line monitoring device set, the event operation type is "parameter modification", and the event state description contains "temporary adjustment".

[0115] The event attribute information association chain in the real-time event association result is traversed, and the association chain contains attribute information of events A to C in chronological order. The attribute information of event A is: event occurrence time T1 (five minutes after the device is started), event source device identifier D1 (belongs to a power line monitoring device set), event operation type "parameter modification", and event status description "temporary adjustment of voltage threshold". The attribute information of event B is: event occurrence time T2 (twelve minutes after the device is started), event source device identifier D2 (belongs to a power distribution automation terminal set), event operation type "state query", and event status description "normal response". The attribute information of event C is: event occurrence time T3 (eight minutes after the device is started), event source device identifier D1 (belongs to a power line monitoring device set), event operation type "parameter modification", and event status description "temporary adjustment of current threshold".

[0116] Each event attribute in the event attribute information association chain is compared with the precondition constraint of rule R002 field by field. For event A: event occurrence time T1 meets "within ten minutes after the device is started", the matching degree is 1; event source device identifier D1 belongs to the specified set, the matching degree is 1; event operation type "parameter modification" is consistent with the constraint, the matching degree is 1; and event status description contains "temporary adjustment", the matching degree is 1. The weighted coefficients of the four fields are 0.3, 0.2, 0.3, and 0.2 respectively, and the weighted sum is 1x0.3+1x0.2+1x0.3+1x0.2=1.

[0117] For event B: event occurrence time T2 exceeds the "within ten minutes" constraint, the matching degree is 0; event source device identifier D2 does not belong to the specified set, the matching degree is 0; event operation type does not match the constraint, the matching degree is 0; and event status description does not contain the specified content, the matching degree is 0. The weighted sum is 0.

[0118] For event C: event occurrence time T3 meets the constraint, the matching degree is 1; event source device identifier D1 meets the requirement, the matching degree is 1; event operation type is consistent, the matching degree is 1; and event status description contains the specified content, the matching degree is 1. The weighted sum is also 1.

[0119] The total sum of the field matching degrees of all events is summarized, the total sum of event A and event C is 1, and the total sum of event B is 0. The overall field matching degree total is still 1 after being averaged according to the number of valid events in the association chain.

[0120] Step S144: Determine the rule matching state according to the field matching degree total, compare the field matching degree total with the preset matching threshold, and when the field matching degree total is higher than the preset matching threshold, determine that the security event prediction rule matches successfully.

[0121] The preset matching threshold is set according to the safety level requirement of the power monitoring system, and in the embodiment, the threshold is 0.7. The field matching degree sum of the rule R002 is 1, which is higher than 0.7, and therefore it is determined that the rule R002 is matched successfully. If the field matching degree sum of a rule is 0.6, which is lower than the threshold, it is determined that the matching fails.

[0122] Step S145: generating the basic information of the abnormal event based on the rule conclusion of the matched security event prediction rule, extracting the subsequent event identifier and the abnormal risk level in the rule conclusion, mapping the subsequent event identifier to the corresponding abnormal event type, and establishing the corresponding relationship between the abnormal event type and the abnormal risk level.

[0123] The subsequent event identifier "device overload warning" and the abnormal risk level "medium risk" are extracted from the rule conclusion of the matched rule R002. The event type mapping table is queried, and the abnormal event type corresponding to the "device overload warning" is "abnormal rise of power transmission line load". Therefore, the corresponding relationship of "abnormal rise of power transmission line load-medium risk" is established.

[0124] Step S146: extracting the event association path corresponding to the matched security event prediction rule from the real-time event association result, and cutting the real-time event type identifier sequence to form the abnormal event association path according to the matching part of the rule precondition event type identifier sequence in the order of event occurrence time.

[0125] Step S1461: extracting the event type identifier sequence in the rule precondition from the matched security event prediction rule, determining the number and arrangement order of the event type identifiers, and forming the target event sequence.

[0126] The precondition event type identifier sequence of the rule R002 is [parameter adjustment event, state monitoring event], which contains 2 event type identifiers, and the arrangement order is that the parameter adjustment event is in the front and the state monitoring event is in the back, forming the target event sequence.

[0127] Step S1462: extracting the real-time event type identifier sequence and the corresponding event occurrence time from the real-time event association result, wherein the real-time event type identifier sequence is a list of event type identifiers arranged in the order of event occurrence time.

[0128] The real-time event type identifier sequence is [device start event, parameter adjustment event, state monitoring event, data upload event], and the corresponding event occurrence times are T0, T1, T2 and T3 respectively, which are arranged in the order of time.

[0129] Step S1463: Traverse the real-time event type identifier sequence to find a continuous sub-sequence matching the target event sequence. Starting from the beginning of the real-time event type identifier sequence, continuously extract sub-sequences of the same length as the target event sequence, and compare each continuous sub-sequence with the target event sequence to check if the number and order of event type identifiers are exactly the same.

[0130] Starting from the beginning of the real-time event type identifier sequence, extract a continuous sub-sequence of length 2: [device startup event, parameter adjustment event], and compare it with the target sequence [parameter adjustment event, status monitoring event]. The number is the same, but the order and identifier are different, so it does not match. Next, extract [parameter adjustment event, status monitoring event], and compare it with the target sequence. The number and order are exactly the same, so it matches successfully.

[0131] Step S1464: When a matching continuous sub-sequence is found, record the starting index and ending index of the sub-sequence in the real-time event type identifier sequence, extract the corresponding event occurrence time according to the starting index and ending index, and determine the time range of the event association path.

[0132] The starting index of the matching sub-sequence [parameter adjustment event, status monitoring event] in the real-time sequence is 1, and the ending index is 2. The corresponding event occurrence times are T1 and T2, so the time range of the event association path is T1 to T2.

[0133] Step S1465: Extract the corresponding part in the real-time event type identifier sequence according to the starting index and ending index to form the event type identifier sub-sequence of the abnormal event association path.

[0134] Extract the event type identifier with index 1 to 2 to get the sub-sequence [parameter adjustment event, status monitoring event] as the event type identifier sub-sequence of the abnormal event association path.

[0135] Step S1466: Extract the event attribute information corresponding to each event type identifier in the event type identifier sub-sequence of the abnormal event association path, extract the attribute information segment corresponding to the event type identifier sub-sequence from the event attribute information association chain, combine the event type identifier sub-sequence and the corresponding attribute information segment to form a complete abnormal event association path, which contains event type identifiers and corresponding event attribute information arranged in chronological order of event occurrence time.

[0136] In the event type identifier sub-sequence, the attribute information corresponding to the parameter adjustment event is: event occurrence time T1, device identifier D1, operation content "adjust voltage threshold", and state description "temporary effect"; the attribute information corresponding to the state monitoring event is: event occurrence time T2, device identifier D1, operation content "load monitoring", and state description "value overrun". The information is intercepted from the event attribute information association chain as attribute information segments, combined with the event type identifier sub-sequence, and forms a complete abnormal event association path.

[0137] Step S147: integrate the abnormal event type, abnormal risk level, and abnormal event association path, store them in a structured data format, create an event basic information field to store the abnormal event type, a risk information field to store the abnormal risk level, and a path information field to store the abnormal event association path, and generate an abnormal event prediction result.

[0138] The integrated information is stored in JSON format, the value of the event basic information field "event_type" is "abnormal load rise of power transmission line", the value of the risk information field "risk_level" is "medium risk", and the value of the path information field "path" is an array containing the event type identifier sub-sequence and the corresponding attribute information segments. Thus, a complete abnormal event prediction result is generated.

[0139] Step S150: generate a security audit report according to the abnormal event prediction result, integrate the event type, risk level, and association path, send the security audit report to the power monitoring terminal, and update the security event prediction rule library based on the abnormal event processing information fed back by the security audit report.

[0140] Step S151: parse the abnormal event prediction result, extract the event basic information field, risk information field, and path information field in the abnormal event prediction result, and obtain the abnormal event type, abnormal risk level, and abnormal event association path.

[0141] The JSON format abnormal event prediction result generated in step S147 is parsed, the abnormal event type "abnormal load rise of power transmission line" is obtained from the "event_type" field, the abnormal risk level "medium risk" is obtained from the "risk_level" field, and the event type identifier sub-sequence and attribute information segments contained in the abnormal event association path are obtained from the "path" field.

[0142] Step S152: query the preset security handling plan library, retrieve the corresponding abnormal event handling suggestion and standard response process according to the abnormal event type and abnormal risk level, the abnormal event handling suggestion contains event troubleshooting steps, fault positioning method, and system recovery measures, and the standard response process contains processing step sequence, responsibility department allocation, and processing time limit requirement.

[0143] The safety contingency plan database stores response plans for various abnormal events. Based on "abnormal increase in transmission line load" and "medium risk," the corresponding handling suggestions are retrieved: the event investigation steps are "1. Check the current load data of the line; 2. Analyze parameter adjustment records; 3. Detect the operating status of relevant equipment"; the fault location method is "locate the overload section through the load monitoring system and pinpoint the specific device by combining equipment identification"; the system recovery measures are "temporarily reduce the output power of related equipment to limit load growth." The standard response process is "1. The maintenance team arrives at the scene within 30 minutes of receiving the alarm; 2. The technical department simultaneously monitors the data remotely; 3. Submit a report within 1 hour after handling is completed," the responsible department is "Transmission Line Maintenance Team One," and the handling time limit is "complete preliminary handling within 4 hours."

[0144] Step S153: Integrate the abnormal event type, abnormal risk level, abnormal event association path, abnormal event handling suggestions and standard response process to generate a security audit report. Create an event details module to record the abnormal event type and abnormal event association path, create a risk assessment module to record the abnormal risk level, create a handling suggestion module to record abnormal event handling suggestions and standard response process, and use a preset report template to format and layout the content of each module.

[0145] The preset report template consists of three parts: title, body, and signature. The title is "Safety Audit Report of Power Monitoring System - Abnormal Increase in Transmission Line Load"; the body is divided into three modules: event details, risk assessment, and handling recommendations, each with corresponding information; the signature includes the generation time and system identifier. The layout uses clear hierarchical headings. The event details module lists event information along related paths in chronological order. The risk assessment module uses bold font to highlight the risk level, and the handling recommendations module lists the operational steps in bullet points.

[0146] Step S154: Send the security audit report to the power monitoring terminal, establish a secure communication connection with the power monitoring terminal, encrypt the security audit report, transmit it to the power monitoring terminal through the encrypted channel, receive the abnormal event handling feedback information returned by the power monitoring terminal, parse the abnormal event handling feedback information, extract the processing result status and rule optimization suggestions. The processing result status includes the processing completed status and the unprocessed status. The rule optimization suggestions include suggestions for adjusting the rule preconditions and suggestions for modifying the rule conclusion parameters.

[0147] The secure communication connection with the power monitoring terminal is established through the SSL / TLS protocol, the secure audit report is encrypted by using the AES algorithm, and the encryption key is dynamically generated through a key exchange mechanism. The encrypted report is transmitted to the terminal through a special encryption channel. The terminal returns feedback information after processing, and the processing result state is "processing completed state" and the rule optimization suggestion is "rule conclusion parameter modification suggestion: adjust the abnormal risk level to low risk" obtained by analyzing the information.

[0148] Step S155: According to the processing result state and the rule optimization suggestion, the corresponding security event prediction rule in the security event prediction rule library is located, when the processing result state is the unprocessed state and the rule optimization suggestion is the precondition adjustment, the event attribute information constraint threshold in the precondition of the corresponding rule is adjusted, when the processing result state is the processing completed state and the rule optimization suggestion is the conclusion parameter modification, the abnormal risk level parameter in the conclusion of the corresponding rule is updated.

[0149] According to the rule identification, the rule R002 is located, and since the processing result state is "processing completed state" and the suggestion is to modify the conclusion parameter, the abnormal risk level in the conclusion of the rule R002 is updated from "medium risk" to "low risk". If the feedback is the unprocessed state and the suggestion is to adjust the precondition, the event occurrence time constraint may be adjusted from "within ten minutes" to "within fifteen minutes".

[0150] Step S156: Record the update record of the update operation of the security event prediction rule library, store the update record to the rule update history database, complete the rule parameter update of the security event prediction rule library, and the update record includes the update time, the updated rule identification, the rule parameter value before updating and the rule parameter value after updating.

[0151] The content of the update record is: the update time "current system time", the updated rule identification "R002", the rule parameter value before updating "abnormal risk level: medium risk", and the rule parameter value after updating "abnormal risk level: low risk". The record is stored in the rule update history database in a structured format, and the database adopts a regular backup mechanism to ensure that the data is traceable.

[0152] Figure 2 A schematic diagram of exemplary hardware and software components of the intelligent prediction system 100 applied to system log security audit that can implement the idea of the present application is shown. For example, the processor 120 can be used in the intelligent prediction system 100 applied to system log security audit, and used to execute the functions in the present application.

[0153] For example, the intelligent prediction system 100 applied to system log security audit can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, a ROM, or a RAM, or any combination thereof. Exemplarily, the intelligent prediction system 100 applied to system log security audit can also include program instructions stored in a ROM, a RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The intelligent prediction system 100 applied to system log security audit also includes an I / O interface 150 between the computer and other input and output devices.

[0154] In addition, the embodiment of the present application further provides a readable storage medium, wherein computer executable instructions are preset in the readable storage medium, and when a processor executes the computer executable instructions, the intelligent prediction method applied to system log security audit is realized.

[0155] It should be noted that, in order to simplify the expression of the present application and to help the understanding of one or more embodiments of the present application, in the foregoing description of the embodiments of the present application, various features are sometimes incorporated into one embodiment, drawing or description thereof.

Claims

1. An intelligent prediction method applied to security audit of system log, characterized in that, The method comprises: acquiring a historical log data set of a power monitoring system, performing event correlation modeling processing on the historical log data set, and generating a log event correlation model; based on the log event correlation model, performing frequent pattern extraction and regularized representation on the event correlation path through a rule mining algorithm, and generating a security event prediction rule library; acquiring a real-time log data stream of the power monitoring system, inputting the real-time log data stream into the log event correlation model for event type matching and attribute correlation verification, and obtaining a real-time event correlation result; matching the real-time event correlation result with the security event prediction rule library, and generating an abnormal event prediction result; integrating event types, risk levels and correlation paths according to the abnormal event prediction result to generate a security audit report, sending the security audit report to a power monitoring terminal, and updating the security event prediction rule library based on rule parameters of feedback abnormal event processing information of the security audit report. 2.The intelligent prediction method applied to security audit of system log according to claim 1, wherein, The method comprises: performing log event analysis processing on the historical log data set, reading the text content of each log entry, identifying the format type of the log entry, extracting event type identifiers and event attribute information from structured format log entries according to pre-set fields, performing entity recognition and key information extraction on unstructured format log entries using natural language processing technology, obtaining event type identifiers and event attribute information of each log entry, and the event attribute information includes event occurrence time, event source device identifier, event operation type and event state description; performing classification and aggregation processing on the log entries according to the event type identifiers, iterating through all the log entries, grouping the log entries with the same event type identifier into the same event type group, and counting the number of log entries included in each event type group to obtain a plurality of event type groups; performing correlation analysis processing on the event attribute information in each event type group, extracting the event attribute information of all log entries in the same event type group, calculating the co-occurrence frequency of different event attribute information in the time dimension and the correlation strength in the space dimension, and determining the correlation relationship between different event attribute information according to the co-occurrence frequency and the correlation strength; constructing an event correlation network based on the correlation relationship, taking the event type identifier as the network node, taking the correlation relationship between the event attribute information as the directed edge between the nodes, setting the weight value of the directed edge according to the strength of the correlation relationship, and generating an initial event correlation network; performing network structure optimization processing on the initial event correlation network, iterating through all the directed edges in the initial event correlation network, calculating the weight value of each directed edge, removing the directed edges with weight values lower than a pre-set threshold, and retaining the directed edges with weight values higher than the pre-set threshold to obtain an optimized event correlation network; The optimized event correlation network is subjected to model verification processing, a part of log entries are randomly selected from the historical log data set as a verification data set, the verification data set is input into the optimized event correlation network for event correlation prediction, the predicted event correlation relationship is extracted, compared with the actual event correlation relationship of the verification data set, the matching degree of the correlation relationship is calculated, and when the matching degree reaches a preset standard, the optimized event correlation network is determined as a log event correlation model. 3.The intelligent prediction method applied to security audit of system log according to claim 1, wherein, The log event correlation model is based on a rule mining algorithm for frequent pattern extraction and rule-based representation of the event correlation path, and generates a security event prediction rule library, including: An event correlation path set is extracted from the log event correlation model, all nodes and directed edges in the log event correlation model are traversed, the directed edge connection relationship between nodes is tracked, and all possible event correlation paths are extracted, each event correlation path containing a plurality of event type identifiers arranged in chronological order; The event correlation path set is subjected to frequent path mining processing, the number of times each event correlation path appears in the historical log data set is counted, and the ratio of the number of times each event correlation path appears to the total number of event correlation path sets is calculated. The event correlation path with a ratio higher than a preset frequency threshold is determined as a frequent event correlation path, which is used as a candidate rule path; The candidate rule path is subjected to path decomposition processing, each candidate rule path is split into a pre-event sequence and a subsequent event identifier, the pre-event sequence contains other event type identifiers in the candidate rule path except the last event type identifier, and the subsequent event identifier is the last event type identifier of the candidate rule path; Based on the decomposed pre-event sequence and subsequent event identifier, a security event prediction rule is generated, the event attribute information corresponding to each event type identifier in the pre-event sequence is extracted, these event attribute information is combined to form a rule precondition, the preset abnormal event definition library is queried to obtain the abnormal risk level corresponding to the subsequent event identifier, the subsequent event identifier and the abnormal risk level are combined to form a rule conclusion, a unique rule identifier and a rule generation timestamp are added to each rule, and an initial security event prediction rule is generated; The initial security event prediction rule is subjected to rule filtering processing, the initial security event prediction rule is applied to a test data set in the historical log data set, the number of times each rule is predicted correctly and the total number of predictions are counted, the rule prediction accuracy is calculated, the number of abnormal events covered by the rule in the test data set is counted, and the ratio of the total number of abnormal events in the test data set is calculated. The rule coverage rate is calculated, and the initial security event prediction rule with a prediction accuracy and coverage rate higher than a preset threshold is selected. The filtered security event prediction rule is classified and stored according to the abnormal risk level, a rule storage directory is created, security event prediction rules with the same abnormal risk level are stored in the same directory, a rule index table is established, event type identifiers and event attribute information in the rule precondition are used as index keywords, and a security event prediction rule library is generated.

4. The intelligent prediction method for security audit of system logs as claimed in claim 3 wherein, The path decomposition processing is performed on the candidate rule paths, each candidate rule path is split into a pre-event sequence and a subsequent event identifier, the pre-event sequence contains event type identifiers other than the last event type identifier in the candidate rule path, and the subsequent event identifier is the last event type identifier in the candidate rule path, and the path decomposition processing includes the following steps: Each candidate rule path in the candidate rule path set is traversed, and the candidate rule path is represented as an ordered list of event type identifiers, each element in the ordered list is an event type identifier, and the order of the elements corresponds to the time sequence of event occurrence; The length of the ordered list is determined, the number of event type identifiers contained in the ordered list is counted, when the length of the ordered list is 1, the candidate rule path is marked as an invalid path and excluded, and when the length of the ordered list is greater than 1, the path decomposition operation is performed; All elements except the last element in the ordered list are extracted, and are combined in the original order of the ordered list to form a pre-event sequence, which is an ordered sub-list of event type identifiers; The last element in the ordered list is extracted as a subsequent event identifier, which is a single event type identifier; The pre-event sequence and the subsequent event identifier are associated and stored to create a path decomposition mapping table, the unique identifier of the candidate rule path is used as a key, and the pre-event sequence and the subsequent event identifier are stored as values in the mapping table, so that each candidate rule path corresponds to a unique pre-event sequence and a subsequent event identifier; The integrity of the pre-event sequence is checked, each event type identifier in the pre-event sequence is traversed, a preset event type dictionary is queried, and it is verified whether the event type identifier exists in the event type dictionary, when there is an event type identifier that does not exist, the corresponding candidate rule path is marked as an abnormal path and excluded, so that all event type identifiers in the pre-event sequence are valid identifiers; The decomposed pre-event sequence and the subsequent event identifier are subjected to format standardization processing, the pre-event sequence is converted into a string format separated by a set separator, and the subsequent event identifier is converted into a string format. 5.The intelligent prediction method for security audit of system log according to claim 1, wherein, The real-time log data stream of the power monitoring system is obtained, the real-time log data stream is input into a log event association model for event type matching and attribute association verification, and a real-time event association result is obtained, including: The real-time log data stream is received in real time through a log collection interface of the power monitoring system, the real-time log data stream is subjected to stream parsing processing, each real-time log entry is read in order according to the log entry receiving order, the format type of each real-time log entry is identified, and the real-time event type identifier and real-time event attribute information of the real-time log entry are extracted; The real-time event attribute information is standardized, the event occurrence time format, the event source device identifier format, the event operation type representation and the event state description field in the real-time event attribute information are uniformly converted according to the format requirements of the event attribute information in the log event association model, the real-time event type identifier is input into the log event association model, all nodes in the log event association model are traversed, the target node with the same real-time event type identifier is found, all associated edge information of the target node is extracted, the associated edge information includes the association direction, the associated event type identifier and the associated attribute constraint condition; The real-time event attribute information is associated and verified based on the associated edge information, the event occurrence time, the event source device identifier, the event operation type and the event state description in the real-time event attribute information are compared with the associated attribute constraint condition respectively, whether the real-time event attribute information meets the requirements of the associated attribute constraint condition is checked, and when the requirements are met, it is determined that there is an association relationship between the real-time events; A real-time event association sequence is constructed according to the association relationship between the real-time events, the real-time event type identifiers with the association relationship are arranged in the order of event occurrence time, a real-time event type identifier sequence is formed, and the real-time event attribute information corresponding to each real-time event type identifier is connected in the association order to form an event attribute information association chain; The real-time event type identifier sequence and the event attribute information association chain are subjected to integrity checking processing, whether there is a continuous event type identifier missing condition in the real-time event type identifier sequence is checked, whether there is an attribute field break condition in the event attribute information association chain is checked, if there is a missing or break, the previous and subsequent associated log entries in the real-time log data stream are queried for supplementation, and a real-time event association result containing the real-time event type identifier sequence and the corresponding event attribute information association chain is generated. 6.The intelligent prediction method for security audit of system log according to claim 5, wherein, The real-time event attribute information is associated and verified based on the associated edge information, the event occurrence time, the event source device identifier, the event operation type and the event state description in the real-time event attribute information are compared with the associated attribute constraint condition respectively, whether the real-time event attribute information meets the requirements of the associated attribute constraint condition is checked, and when the requirements are met, it is determined that there is an association relationship between the real-time events, including: The associated attribute constraint condition is extracted from the associated edge information, the attribute constraint field in the associated edge information is parsed, the event occurrence time constraint range, the event source device identifier allowed set, the event operation type allowed set and the event state description matching mode are obtained, the event occurrence time constraint range is a time interval, the event source device identifier allowed set is a set of multiple device identifiers, the event operation type allowed set is a set of multiple operation types, and the event state description matching mode is a regular expression; The event occurrence time in the real-time event attribute information is extracted, the event occurrence time is converted into the format of a timestamp, whether the timestamp is within the event occurrence time constraint range is checked, and when the timestamp is within the event occurrence time constraint range, it is determined that the event occurrence time meets the constraint condition; extracting an event source device identifier in the real-time event attribute information, checking whether the device identifier exists in a permitted set of event source device identifiers, and determining that the event source device identifier satisfies a constraint condition when the device identifier exists in the permitted set; extracting an event operation type in the real-time event attribute information, checking whether the operation type exists in a permitted set of event operation types, and determining that the event operation type satisfies a constraint condition when the operation type exists in the permitted set; extracting an event state description in the real-time event attribute information, performing pattern matching on the event state description using a regular expression corresponding to an event state description matching mode, and determining that the event state description satisfies a constraint condition when the pattern matching is successful; counting a number of real-time events whose occurrence time, event source device identifier, event operation type, and event state description satisfy constraint conditions, and determining that the real-time event attribute information satisfies a correlation attribute constraint condition when all the attributes satisfy the constraint conditions; determining a correlation relationship between real-time events according to a satisfaction condition of the correlation attribute constraint condition, determining that a correlation relationship exists between the real-time event and a corresponding event in a log event correlation model when the real-time event attribute information satisfies the correlation attribute constraint condition, recording a direction and strength of the correlation relationship, the direction of the correlation relationship being from the real-time event to the corresponding event in the log event correlation model, and the strength of the correlation relationship being a preset correlation strength value. 7.The intelligent prediction method for security audit of system log according to claim 1, wherein, The matching of the real-time event correlation result with the security event prediction rule library to generate an abnormal event prediction result includes: loading all security event prediction rules from the security event prediction rule library, parsing rule preconditions and rule conclusions of each security event prediction rule, extracting an event type identifier and event attribute information constraints in the rule preconditions, and constructing a rule index table with the event type identifier as an index key; extracting a real-time event type identifier sequence and an event attribute information correlation chain from the real-time event correlation result, matching the real-time event type identifier sequence with the index keys in the rule index table, screening out security event prediction rules that match any continuous event type identifier combination in the index keys and the real-time event type identifier sequence, and forming a candidate matching rule set; performing precondition comparison processing on each security event prediction rule in the candidate matching rule set, extracting event attribute information constraints in the rule preconditions, traversing the event attribute information correlation chain, performing field-by-field comparison between event attribute information in the event attribute information correlation chain and the event attribute information constraints in the rule preconditions, calculating a matching degree of each field, and performing weighted summation on matching degrees of all fields to obtain a field matching degree total sum; determining a rule matching state according to the field matching degree total sum, comparing the field matching degree total sum with a preset matching threshold, and determining that the security event prediction rule matches successfully when the field matching degree total sum is higher than the preset matching threshold; The rule conclusion of the matched security event prediction rule is used to generate abnormal event basic information, the subsequent event identifier and abnormal risk level in the rule conclusion are extracted, the subsequent event identifier is mapped to a corresponding abnormal event type, and a corresponding relationship between the abnormal event type and the abnormal risk level is established; An event association path corresponding to the matched security event prediction rule is extracted from the real-time event association result, a part of the real-time event type identifier sequence that matches the rule precondition event type identifier sequence is intercepted according to the event occurrence time sequence, and an abnormal event association path is formed; The abnormal event type, the abnormal risk level and the abnormal event association path are integrated and stored in a structured data format, the event basic information field is created to store the abnormal event type, the risk information field is created to store the abnormal risk level, the path information field is created to store the abnormal event association path, and an abnormal event prediction result is generated. 8.The intelligent prediction method for security audit of system log according to claim 7, wherein, The abnormal event association path is formed by extracting an event type identifier sequence in a rule precondition from a matched security event prediction rule, determining the number and arrangement order of the event type identifiers, forming a target event sequence, extracting a real-time event type identifier sequence and corresponding event occurrence time from a real-time event association result, the real-time event type identifier sequence being an event type identifier list arranged in the order of event occurrence time, traversing the real-time event type identifier sequence to find a continuous subsequence that matches the target event sequence, sequentially intercepting continuous subsequences with the same length as the target event sequence from the start position of the real-time event type identifier sequence, comparing each continuous subsequence with the target event sequence to check whether the number and arrangement order of the event type identifiers are completely consistent, recording the start index and end index of the matched continuous subsequence in the real-time event type identifier sequence when the matched continuous subsequence is found, extracting the corresponding event occurrence time according to the start index and the end index to determine the time range of the event association path, and extracting the corresponding part of the real-time event type identifier sequence according to the start index and the end index to form an event type identifier subsequence of the abnormal event association path. The event type identifier subsequence of the abnormal event association path is extracted, the event attribute information corresponding to each event type identifier in the event type identifier subsequence is extracted, the attribute information segment corresponding to the event type identifier subsequence is intercepted from the event attribute information association chain, the event type identifier subsequence and the corresponding attribute information segment are combined to form a complete abnormal event association path, and the abnormal event association path includes event type identifiers and corresponding event attribute information arranged in the order of event occurrence time. ​ ​ ​ ​ ​ 9.The intelligent prediction method for security audit of system log according to claim 1, wherein, The security audit report is sent to the power monitoring terminal, and rule parameter updating of the security event prediction rule library is performed based on abnormal event processing information fed back by the security audit report, including: The abnormal event prediction result is analyzed, and event basic information fields, risk information fields and path information fields in the abnormal event prediction result are extracted to obtain abnormal event types, abnormal risk levels and abnormal event correlation paths; A preset security handling plan library is queried, and corresponding abnormal event handling suggestions and standard response processes are retrieved according to the abnormal event types and the abnormal risk levels, the abnormal event handling suggestions including event troubleshooting steps, fault positioning methods and system recovery measures, and the standard response processes including processing step sequences, responsibility department distribution and processing time limit requirements; The abnormal event types, the abnormal risk levels, the abnormal event correlation paths, the abnormal event handling suggestions and the standard response processes are integrated to generate a security audit report, an event detail module is created to record the abnormal event types and the abnormal event correlation paths, a risk assessment module is created to record the abnormal risk levels, a handling suggestion module is created to record the abnormal event handling suggestions and the standard response processes, and a preset report template is used to format and lay out the contents of each module; The security audit report is sent to the power monitoring terminal, a secure communication connection with the power monitoring terminal is established, the security audit report is subjected to data encryption processing, and is transmitted to the power monitoring terminal through an encrypted channel, abnormal event processing feedback information returned by the power monitoring terminal is received, the abnormal event processing feedback information is analyzed, processing result states and rule optimization suggestions are extracted, the processing result states include a processing completed state and an unprocessed state, and the rule optimization suggestions include rule precondition adjustment suggestions and rule conclusion parameter modification suggestions; According to the processing result states and the rule optimization suggestions, corresponding security event prediction rules in the security event prediction rule library are located, when the processing result state is the unprocessed state and the rule optimization suggestion is the precondition adjustment, the event attribute information constraint threshold in the corresponding rule precondition is adjusted, and when the processing result state is the processing completed state and the rule optimization suggestion is the conclusion parameter modification, the abnormal risk level parameter in the corresponding rule conclusion is updated; An update record of an update operation of the security event prediction rule library is recorded, the update record is stored in a rule update history database, rule parameter updating of the security event prediction rule library is completed, and the update record includes an update time, an updated rule identifier, a rule parameter value before updating and a rule parameter value after updating.

10. An intelligent prediction system for security audit of system logs, characterized in that, The application comprises a processor and a memory, the memory and the processor are connected, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to realize the intelligent prediction method for system log security audit in any one of claims 1-9.

Images