Context-aware audit log intelligent analysis method based on large language model

Abstract

The invention provides a context-aware audit log intelligent analysis method based on a large language model, and the method comprises the steps: collecting an access audit log of a server cluster, carrying out the standardization processing of an operation description in the log, and generating structured log data; performing semantic analysis on the operation description in the structured log data by utilizing a large language model, extracting an implicit behavior pattern and generating a semantic vector; constructing a multi-dimensional feature vector in combination with context information such as user identity, resource attributes and behavior statistics in an operation time window; automatically generating an access control rule through a rule generation model based on the multi-dimensional feature vector, and verifying the robustness of the rule by simulating an attack scene; and deploying the access control rule passing the verification to a target system, and outputting corresponding security alarm information. According to the embodiment of the invention, the detection precision and dynamic adaptability of audit log analysis can be improved, and the false alarm rate and the manual maintenance cost are reduced.

Description

Technical Field

[0001] This application relates to the field of network security and intelligent audit log analysis technology, and in particular to a context-aware intelligent audit log analysis method based on a large language model. Background Technology

[0002] Audit log analysis, as a key component of network security protection systems, is widely used in complex IT environments such as cloud computing, big data, and distributed cluster servers.

[0003] With increasingly sophisticated cyberattacks, especially the frequent occurrence of Advanced Persistent Threats (APTs) and zero-day vulnerability attacks, traditional log analysis techniques are no longer sufficient to meet the demands of dynamic threat detection. Among related technologies, a preliminary log analysis framework has been constructed through the collaborative operation of static rule matching, basic machine learning models, and log collection systems. Specifically, this system covers the entire process from log collection and feature extraction to risk identification, including key stages such as log preprocessing, behavioral pattern recognition, rule matching, and alert generation. However, existing log analysis methods directly employ predefined rule bases or shallow machine learning models without fully integrating contextual information such as user identity, resource attributes, and time series. Furthermore, they lack deep semantic understanding of unstructured log text, which may lead to high false positive rates, delayed rule updates, blind spots in attack pattern recognition, or difficulty adapting to the behavioral baselines of different user groups in multi-tenant scenarios, thus affecting overall security protection efficiency and the real-time performance of system response. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the first objective of this invention is to propose a context-aware intelligent analysis method for audit logs based on a large language model.

[0006] The second objective of this invention is to propose a context-aware intelligent analysis device for audit logs based on a large language model.

[0007] The third objective of this invention is to provide an electronic device.

[0008] The fourth objective of this invention is to provide a computer-readable storage medium.

[0009] The fifth objective of this invention is to provide a computer program product.

[0010] To achieve the above objectives, a first aspect of this invention proposes a context-aware intelligent analysis method for audit logs based on a large language model, comprising: S1, collecting access audit logs from a server cluster and standardizing the operation descriptions in the logs to generate structured log data; S2, using a large language model to perform semantic parsing on the operation descriptions in the structured log data, extracting implicit behavioral patterns and generating semantic vectors; S3, combining contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window to construct a multi-dimensional feature vector; S4, based on the multi-dimensional feature vector, automatically generating access control rules through a rule generation model, and verifying the robustness of the rules through simulated attack scenarios; S5, deploying the verified access control rules to the target system and outputting corresponding security alert information.

[0011] In one embodiment of the present invention, step S1, collecting access audit logs of the server cluster and standardizing the operation descriptions in the logs to generate structured log data, further includes: S11, collecting raw log records through API interfaces or log files; S12, cleaning up noisy data in the operation descriptions and normalizing semantically similar operation descriptions into a unified operation type.

[0012] In one embodiment of the present invention, step S2, which uses a large language model to perform semantic parsing on the operation descriptions in the structured log data, extracts implicit behavior patterns and generates semantic vectors, further includes: S21, using a pre-trained large language model to perform preliminary semantic vector extraction on the operation descriptions; and S22, fine-tuning the pre-trained model based on an annotated attack log dataset to enhance the ability to identify implicit malicious behavior.

[0013] In one embodiment of the present invention, step S3, which combines contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window to construct a multidimensional feature vector, further includes: S31, dynamically adjusting the weights of user identity, resource attributes, and time series information according to the tenant's industry type; and S32, concatenating the weighted contextual information with the semantic vector to generate a multidimensional feature vector for rule generation.

[0014] In one embodiment of the present invention, the method further includes: S6, pushing the security alarm information to the visualization monitoring module and displaying it in a hierarchical manner according to the alarm level; S7, generating a visualization report based on the alarm information for operation and maintenance personnel to perform risk behavior tracing and system hardening analysis.

[0015] To achieve the above objectives, a second aspect of the present invention proposes a context-aware audit log intelligent analysis device based on a large language model, comprising: a log collection and standardization module, used to collect access audit logs from a server cluster and standardize the operation descriptions in the logs to generate structured log data; a semantic parsing and vector generation module, used to perform semantic parsing on the operation descriptions in the structured log data using a large language model, extracting implicit behavioral patterns and generating semantic vectors; a context feature construction module, used to construct multi-dimensional feature vectors by combining contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window; a rule generation and verification module, used to automatically generate access control rules based on the multi-dimensional feature vectors through a rule generation model, and verify the robustness of the rules through simulated attack scenarios; and a rule deployment and alarm output module, used to deploy the verified access control rules to the target system and output corresponding security alarm information.

[0016] In one embodiment of the present invention, the log collection and standardization module is further configured to: collect raw log records through API interfaces or log files to clean up noisy data in the operation descriptions, and normalize semantically similar operation descriptions into a unified operation type.

[0017] To achieve the above objectives, a third aspect of the present invention provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0018] The memory stores computer-executed instructions;

[0019] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0020] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0021] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0022] The methods, apparatus, electronic devices, and computer-readable storage media of the present invention can improve the accuracy of identifying hidden risks in audit logs, reduce false alarm rates, and enhance the system's adaptability to new types of attacks by dynamically generating and verifying access control rules. Attached Figure Description

[0023] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a context-aware intelligent analysis method for audit logs based on a large language model, according to an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram of the structure of a context-aware intelligent analysis device for audit logs based on a large language model, according to an embodiment of the present invention. Detailed Implementation

[0026] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0027] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0028] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0029] Figure 1 This is a flowchart of a context-aware intelligent analysis method for audit logs based on a large language model, according to an embodiment of the present invention.

[0030] like Figure 1 As shown, the context-aware intelligent analysis method for audit logs based on a large language model includes the following steps:

[0031] S1. Collect access audit logs from the server cluster and standardize the operation descriptions in the logs to generate structured log data.

[0032] Specifically, this step, "collecting access audit logs from the server cluster and standardizing the operation descriptions in the logs to generate structured log data," is the basic data preparation step for the entire intelligent audit log analysis system. Its technical implementation involves key technical processes such as log collection, data cleaning, text normalization processing, and structure conversion.

[0033] At the technical implementation level, the log collection module retrieves access audit logs from the server cluster in real time or in batches through standardized interfaces (such as Syslog, API interfaces, Kafka message queues, or log file polling mechanisms). The collected logs typically contain key fields such as user identity, operation time, resource type, and operation description. To ensure data quality, the system first performs noise cleanup, including removing duplicate logs, invalid characters, and illegal timestamp formats. Simultaneously, the operation description field is standardized. For example, semantically similar operation descriptions such as "modify file," "edit file," and "update file" are unified and normalized to "file modification" to eliminate semantic ambiguity caused by the heterogeneity of log sources.

[0034] At the parameter level, standardization must adhere to a unified semantic mapping table, which can be built based on industry standards (such as ISO / IEC 27001, NIST SP 800-53) or enterprise-defined strategies. During normalization, the system can set a similarity threshold for operation descriptions (e.g., based on Levenshtein distance or the BERT semantic similarity model, setting the threshold to 0.85) to determine whether operations should be merged into the same operation type. Furthermore, timestamps must be uniformly converted to the ISO 8601 standard format (YYYY-MM-DDTHH:MM:SSZ) and time zone corrected to ensure the accuracy of time series analysis.

[0035] At the application level, this step is widely applicable to scenarios with high security auditing requirements, such as multi-tenant cloud environments, financial systems, and e-commerce platforms. For example, in e-commerce platforms, the system needs to collect user operation logs such as order placement, payment, and order modification, and normalize them into standard operation types such as "order creation," "payment processing," and "order modification" to provide high-quality input for subsequent LLM semantic analysis and context awareness.

[0036] The technical value of this step lies in transforming the raw logs into a dataset with a unified format through structured processing, providing a reliable data foundation for subsequent semantic parsing and context fusion based on a large language model, significantly improving the analysis efficiency and accuracy of the entire system, while reducing the risk of misjudgment caused by inconsistent log formats.

[0037] Furthermore, step S1 also includes:

[0038] S11 collects raw log records through API interfaces or log files.

[0039] Specifically, the step of "collecting raw log records through API interfaces or log files" is the core link of the log collection and preprocessing process in this invention. Its technical implementation principle is based on the standardized log collection mechanism in distributed systems, aiming to provide structured and high-quality raw data input for subsequent LLM semantic parsing and context-aware analysis.

[0040] At the technical implementation level, this step supports two mainstream log collection methods: one is to pull log data in real time from the auditing system of the server cluster through standardized API interfaces (such as RESTful API, gRPC interface, etc.); the other is to read log files on local or remote servers through log file polling mechanisms (such as log collection tools like Logstash, Fluentd, etc.). The API interface collection method is suitable for modern cloud platforms or middleware systems with open log interfaces, enabling low-latency, high-throughput log acquisition; while the log file collection method is suitable for traditional server environments and supports various log formats (such as JSON, CSV, Syslog, Apache log formats, etc.). During the collection process, the system needs to perform preliminary log cleaning, including removing invalid characters, filtering duplicate records, and identifying and processing abnormal encoding formats, to ensure the data quality for subsequent processing.

[0041] At the parameter level, the system supports configuring the collection frequency (e.g., a maximum collection rate of 1000 logs per second), log format parsing rules (e.g., regular expression matching, JSON schema validation), data transmission protocols (e.g., HTTPS, Kafka, RabbitMQ, etc.), and log storage paths (e.g., HDFS, S3, local file system, etc.). Furthermore, to improve collection efficiency, the system can be configured with a log buffer queue and a batch commit mechanism, such as performing batch commits every 100 logs or every 5 seconds, to reduce network transmission overhead.

[0042] At the application level, this step is widely applicable to multi-tenant cloud environments, enterprise-level server clusters, and IoT device auditing systems. In a multi-tenant architecture, the system must support tenant-level log isolation and access control to ensure that the data collection process complies with data privacy and security compliance requirements (such as GDPR, ISO 27001, etc.).

[0043] The technical value of this step lies in providing reliable, real-time, and structured raw data input for the entire intelligent analysis system, which forms the foundation for subsequent LLM semantic parsing and context-aware analysis. Through flexible data collection methods and preprocessing mechanisms, the system can adapt to different log sources and formats, providing high-quality data support for subsequent semantic modeling and rule generation, thereby improving the accuracy and real-time response capability of the overall analysis system.

[0044] S12, perform noise data cleaning on the operation description and normalize semantically similar operation descriptions into a unified operation type.

[0045] Specifically, the step of "cleaning up noisy data in the operation descriptions and normalizing semantically similar operation descriptions into a unified operation type" is a key step in the log preprocessing stage of this invention. Its technical implementation principle is based on natural language processing and semantic normalization algorithms, aiming to improve the accuracy and consistency of subsequent semantic parsing by a large language model. In some implementations, this step first cleans the operation description field in the original audit logs, removing irrelevant characters, spaces, special symbols, duplicate records, and invalid log entries. For example, regular expressions are used to match illegal characters or redundant information, and deduplication is performed using log timestamps and user identity fields to ensure data quality. Furthermore, for unstructured operation descriptions (such as "modify file," "edit file," "update file," etc.), semantic normalization technology is used to map semantically similar operations to a unified operation type label, such as normalizing them to "file modification" or "file edit." This process calculates the semantic similarity between operation descriptions based on word vector models (such as Word2Vec, BERT, etc.), sets a similarity threshold (e.g., cosine similarity ≥ 0.85), and triggers a normalization operation when the similarity exceeds the threshold. Optionally, the system can also introduce a predefined normalization mapping table and combine it with the LLM fine-tuning model for context-aware dynamic matching to adapt to the semantic differences in business operations among different tenants. In specific implementations, this step needs to support multi-language log processing and meet the requirements of standards such as ISO 8601 time format and RFC 5424 log standards. This step plays a role in data cleaning and standardization in the system, providing high-quality, structured input for subsequent LLM semantic parsing, thereby significantly improving the accuracy and generalization ability of log analysis, especially in the unified processing of logs in multi-tenant, multi-business scenarios.

[0046] S2, using a large language model to perform semantic parsing on the operation descriptions in the structured log data, extracting implicit behavioral patterns and generating semantic vectors.

[0047] Specifically, the step of "using a large language model to perform semantic parsing on the operation descriptions in the structured log data, extracting implicit behavioral patterns and generating semantic vectors" is one of the core links in the context-aware log analysis of this invention. Its technical implementation principle is based on natural language processing and deep learning technology. It aims to perform deep semantic modeling on unstructured or semi-structured operation description text through a large language model, thereby identifying potential abnormal behavior patterns and converting them into semantic vectors that can be used for subsequent analysis.

[0048] At the technical implementation level, this step first performs semantic parsing on the "Operation Description" field in the preprocessed structured log data. Operation descriptions are typically natural language text, such as "modify configuration file" or "access database table," and their semantics are complex and ambiguous. This invention employs an LLM model based on the Transformer architecture (such as ChatGPT, DeepSeek, and the Llama series) to perform context-aware semantic modeling of the operation description through the model's self-attention mechanism and multi-layer encoder structure. The model input is a standardized text sequence, and the output is a high-dimensional semantic vector (e.g., 768 dimensions or higher). This vector can represent the semantic features of the operation behavior, including operation intent, behavior type, and potential risk level.

[0049] Furthermore, to enhance the model's ability to identify malicious behavior, this invention introduces a fine-tuning training mechanism based on the pre-trained model. The fine-tuning dataset consists of manually annotated attack logs, covering typical attack patterns such as unauthorized access, abnormal file operations, and SQL injection. During the fine-tuning process, the cross-entropy loss function is used for optimization. After training, the model can more accurately identify the abnormal behavior hidden in the logs, improving its ability to detect zero-day attacks and advanced persistent threats.

[0050] Regarding parameter settings, the input sequence length of the LLM model is typically set to 512 tokens to ensure the integrity of the context describing the operation. The semantic vectors output by the model are normalized (e.g., L2 normalization) to improve the accuracy of similarity calculation in the vector space. Furthermore, to improve computational efficiency, quantization compression (e.g., INT8 quantization) and distributed inference frameworks (e.g., TensorRT, ONNX Runtime) can be used during the model inference phase.

[0051] This step is widely applicable in practical applications for server cluster audit log analysis in multi-tenant environments, especially in security-sensitive industries such as finance, e-commerce, and government, where it can effectively identify malicious behaviors disguised as normal operations. For example, in e-commerce systems, LLM can identify semantic patterns such as "high-frequency orders" and "abnormal refund requests," providing semantic support for subsequent dynamic rule generation.

[0052] From a technical perspective, this step, through deep semantic parsing, significantly improves the accuracy and generalization ability of log analysis, reduces the reliance of traditional rule systems on human experience, and provides high-quality semantic feature input for the context-aware analysis module. It is a key technical support for realizing intelligent log analysis and dynamic strategy generation.

[0053] Furthermore, step S2 also includes:

[0054] S21. A pre-trained large language model is used to perform preliminary semantic vector extraction on the operation description.

[0055] This step aims to extract preliminary semantic vectors from the operation description text in the audit logs using a pre-trained large language model, thereby transforming unstructured log information into structured semantic features that can be used for subsequent context-aware analysis. This process is one of the core components of the entire intelligent analysis system. Its technical implementation is based on natural language processing and deep learning techniques, mapping text to a high-dimensional vector space through semantic embedding, providing a foundation for subsequent multi-dimensional feature fusion and dynamic rule generation.

[0056] In some implementations, this step first preprocesses the collected raw audit logs, including noise filtering and standardization and normalization of operation descriptions (e.g., unifying "modify file" and "edit file" into "filemodification") to improve the consistency of model input. Subsequently, the operation description text is input into a pre-trained LLM model (e.g., ChatGPT, DeepSeek, Llama), which uses the model's Transformer architecture to perform context-aware encoding on a word-by-word or sentence-by-sentence basis, outputting a fixed-dimensional semantic vector (e.g., 768 dimensions or higher). This model has learned language patterns from a large-scale general corpus during training and possesses strong semantic understanding capabilities. Furthermore, to enhance the ability to identify malicious behavior, this invention introduces fine-tuning training based on the pre-trained model, using labeled attack log datasets (e.g., corpora containing scenarios such as APT attacks and zero-day vulnerability attacks) for targeted training to optimize the model's performance in a specific security semantic space.

[0057] In terms of model selection, an LLM model with over 1 billion parameters is optionally used to ensure sufficient semantic expressive power. The length of the input text is typically limited to 512 tokens to balance processing efficiency and semantic integrity. The output semantic vector dimension is generally 768–4096, depending on the architecture of the selected model. During fine-tuning, cross-entropy loss is used for optimization, with training batch sizes set to 32–128, a dynamically adjusted learning rate initially set to 2e-5, and an early stopping mechanism to prevent overfitting. Model evaluation metrics include semantic similarity, classification accuracy, and F1 score to measure its ability to identify malicious behavior.

[0058] This step is widely used in audit log analysis systems across scenarios such as cluster servers, cloud platforms, and government / enterprise gateways. For example, in e-commerce platforms, textual information describing user actions, such as "create an order" or "modify payment method," can be extracted using LLM semantic vectors and then fused with contextual information such as user identity, operation time, and resource sensitivity to identify abnormal behavior patterns. In financial systems, operation descriptions such as "check account balance" or "transfer operation" can be used to help identify unauthorized access or abnormal transaction behavior through semantic vector extraction.

[0059] This step transforms previously difficult-to-process unstructured text into semantically meaningful vectors, providing high-quality input features for subsequent context-aware analysis and dynamic rule generation. This method significantly improves the ability to identify implicitly risky behaviors, especially when facing malicious actions disguised as normal operations, demonstrating superior semantic generalization compared to traditional rule matching and basic machine learning methods. Furthermore, the semantic vector extraction process exhibits good scalability, supporting differentiated semantic modeling in multi-tenant scenarios.

[0060] S22, The pre-trained model is fine-tuned based on the labeled attack log dataset to enhance its ability to identify hidden malicious behaviors.

[0061] Specifically, the step of "fine-tuning the pre-trained model based on the labeled attack log dataset to enhance the ability to identify hidden malicious behaviors" is the core technical implementation link of the LLM semantic parsing module in this invention. It aims to improve the semantic understanding ability and malicious behavior identification accuracy of the large language model in the audit log analysis scenario through domain-specific fine-tuning strategies.

[0062] At the technical implementation level, this step employs transfer learning, using pre-trained large language models (such as ChatGPT and DeepSeek) as the base model, and fine-tuning the model by introducing a manually annotated attack log dataset. This dataset contains a large number of real or simulated malicious behavior log samples, covering typical attack scenarios such as APT attacks, zero-day exploits, spoofing operations, and abnormal access patterns. Each sample is annotated with meta-information such as attack type, attack stage, attacker identity, target resources, and operational context, which guides the model to learn the semantic features and contextual associations of attack behavior. During fine-tuning, the model optimizes its parameters through backpropagation to minimize the loss function (such as cross-entropy loss), thereby improving its ability to identify hidden malicious behaviors.

[0063] At the parameter level, the model input uses tokenized text, with a maximum sequence length set to 512 to balance log text integrity and computational efficiency. Furthermore, the model output layer typically employs a multi-label classification structure, supporting joint prediction of various attack types (such as unauthorized access, abnormal logins, and data breaches).

[0064] At the application level, this step is widely used in server cluster audit log analysis systems in multi-tenant environments. The finely tuned LLM model can more accurately identify complex attack patterns such as "malicious behavior disguised as normal operation" and "high-frequency access within abnormal time windows," making it particularly suitable for security-sensitive industries such as finance, e-commerce, and government. For example, in e-commerce scenarios, the model can identify covert order-brushing behavior where users place orders through multiple IP addresses, thereby improving the system's response capability to new types of attacks.

[0065] In terms of technical effectiveness, this step significantly improves the model's semantic parsing ability for unstructured log text, enhancing the accuracy and recall rate for identifying hidden malicious behavior. By introducing a context-aware mechanism and fine-tuning training, the model can dynamically adapt to the behavioral baselines of different tenants, reducing false positive rates and improving the intelligence level and practical value of the log analysis system.

[0066] S3 combines contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window to construct a multi-dimensional feature vector.

[0067] This step is the core component of the context-aware analysis module of this invention, aiming to construct a multi-dimensional feature vector for risk identification and rule generation by fusing multi-dimensional contextual information. Its technical implementation principle is based on a deep integration of feature engineering and context-aware mechanisms, improving the context sensitivity and accuracy of behavior recognition in audit log analysis through the collaborative processing of structured and unstructured data.

[0068] In some implementations, this step first extracts key contextual information from the preprocessed audit logs, including but not limited to user identity (such as user role, permission level, and organization), resource attributes (such as resource type, sensitivity level, and access path), and behavioral statistics within the operation time window (such as operation frequency, number of consecutive operations, and operation interval time distribution). User identity information can be obtained through LDAP, RBAC (role-based access control) systems, or user behavior databases; resource attributes are labeled and quantified according to resource classification standards (such as the information classification system in ISO / IEC 27001); and behavioral statistics are calculated in real-time using sliding time windows (such as 5 minutes or 10 minutes), and feature extraction is performed using statistical indicators such as mean, variance, maximum value, minimum value, and operation sequence length.

[0069] Furthermore, to construct multi-dimensional feature vectors, the system employs a feature concatenation and weighted fusion strategy. In the feature concatenation stage, the three types of information are mapped to numerical or categorical feature vectors. For example, user roles can be encoded as one-hot vectors, resource sensitivity can be mapped to a 0-5 level value, and operation frequency can be normalized to a standardized value within the [0,1] interval. In the weighted fusion stage, the system dynamically adjusts the weight coefficients of each dimension of features based on industry characteristics or tenant configurations. For instance, the financial industry can assign a higher weight to resource sensitivity (e.g., 0.4), while the e-commerce industry can increase the weight of time-series features (e.g., 0.35) to adapt to the risk identification needs of different business scenarios.

[0070] The technical value of this step lies in its significant enhancement of semantic understanding of user behavior by introducing multi-dimensional contextual features, effectively distinguishing between normal operations and potentially malicious behavior. For example, when detecting unauthorized administrator operations, the system not only analyzes the semantic features of the operation description but also combines the user's permission level with behavioral patterns within the operation's time window, thereby avoiding misjudging system maintenance actions as attacks. Furthermore, this multi-dimensional feature vector serves as input to the subsequent dynamic rule generation module, providing a data foundation for adaptive rule adjustments and improving the system's real-time responsiveness and policy flexibility.

[0071] Further, step S3 includes:

[0072] S31, dynamically adjust the weights of user identity, resource attributes, and time series information based on the tenant's industry type.

[0073] Specifically, the step of "dynamically adjusting the weights of user identity, resource attributes, and time series information based on the tenant's industry type" is a key technical step in the context-aware analysis module of this invention. Its core lies in improving the accuracy and scenario adaptability of audit log analysis through a context information weighting mechanism in a multi-tenant scenario. In some implementations, this step is achieved by constructing an industry feature mapping table and a context feature weighting engine. The industry feature mapping table predefines the differences in sensitivity to context features such as user identity, resource attributes, and time series for different industries (e.g., finance, e-commerce, healthcare, manufacturing). The weighting engine dynamically loads the corresponding weight configuration based on the current tenant's industry type and performs weighted fusion during feature vector construction.

[0074] From a technical implementation perspective, this step first obtains the current tenant's industry classification label (such as "Finance", "E-commerce", etc.) through the tenant management interface. Then, it calls a predefined industry feature weight configuration file (JSON or YAML format) to extract parameters such as user identity weight (α), resource attribute weight (β), and time series weight (γ). During feature vector construction, the system concatenates the semantic vector generated by LLM with structured context features such as user identity, resource attributes, and time series, and performs a linear combination using a weighting function. Furthermore, the system supports fine-tuning of the weight parameters through an online learning mechanism to adapt to dynamic changes in the tenant's business model.

[0075] At the parameter level, user identity weight (α) typically ranges from [0.1, 0.5], with 0.4 for the financial industry and 0.2 for the e-commerce industry; resource attribute weight (β) ranges from [0.2, 0.6], with 0.5 for the medical industry and 0.3 for the manufacturing industry; and time series weight (γ) ranges from [0.3, 0.7], with 0.6 for the e-commerce industry and 0.3 for the financial industry. These parameters can be adjusted according to industry security standards (such as ISO 27001 and NIST SP 800-53), and their impact on false positive and false negative rates can be verified through A / B testing.

[0076] In application scenarios, this step is widely applicable to multi-tenant cloud platforms, SaaS service systems, and government-enterprise joint cloud environments. For example, in the financial industry, the system will increase its sensitivity to "access to confidential resources" and "unauthorized operations," while in e-commerce scenarios, it will pay more attention to behavioral characteristics such as "high-frequency orders" and "abnormal access time windows." By dynamically adjusting the weights, the system can more accurately identify industry-specific abnormal behaviors, thereby improving the targeting and effectiveness of risk detection.

[0077] The technical benefits of this step are that it significantly enhances the system's context awareness and multi-tenant adaptability, effectively reduces the false alarm rate, and improves the intelligence level of log analysis. By introducing an industry feature weighting mechanism, the system can automatically adapt to the behavioral baselines of different tenants, enabling more refined risk identification and control strategy generation. This provides high-quality feature input for the subsequent dynamic rule generation module, thereby enhancing the overall system's security protection capabilities and response efficiency.

[0078] S32 concatenates the weighted context information with the semantic vector to generate a multidimensional feature vector for rule generation.

[0079] Specifically, the step of "concatenating the weighted context information with the semantic vector to generate a multidimensional feature vector for rule generation" is the core processing step in the context-aware analysis module of this invention. Its technical implementation principle is based on feature fusion and weighting mechanism, aiming to improve the context awareness capability and behavior recognition accuracy of audit log analysis.

[0080] At the technical implementation level, this step first performs feature weighting processing on the context information extracted from the logs. Context information includes user identity (such as user role and permission level), resource attributes (such as resource type and sensitivity level), and time-series features (such as operation frequency and behavioral statistics within the access time window). This information is typically in the form of structured fields. The system uses a feature weighting module to weight each dimension of the features, and the weight coefficients can be dynamically adjusted based on industry characteristics, tenant behavior baselines, or historical attack patterns. For example, in the financial industry, the weight for resource sensitivity can be set to 0.4, the weight for user identity to 0.3, and the weight for time series to 0.3; while in e-commerce scenarios, the weight for time series can be increased to 0.5 to more sensitively capture high-frequency abnormal operations.

[0081] Subsequently, the system concatenates the weighted context feature vector with the semantic vector output by the LLM semantic parsing module. The semantic vector is typically a high-dimensional dense vector (e.g., 768 dimensions or higher), obtained by semantically encoding unstructured text (such as operation descriptions and error messages) in the logs using a large language model. The concatenation operation can employ simple vector concatenation or more complex tensor fusion methods to construct a comprehensive multi-dimensional feature vector containing both semantic and contextual features, which serves as input to the subsequent rule generation model.

[0082] In terms of parameter metrics, the dimension of the context feature vector is typically 10-20, covering key indicators such as user behavior statistics, resource sensitivity scores, and operation frequency within a time window. The dimension of the semantic vector depends on the LLM model used; for example, models based on BERT or ChatGPT typically have an output dimension of 768 or higher. The concatenated multidimensional feature vector can reach a dimension of over 788, providing a rich input feature space for rule generation models.

[0083] This step is widely applicable in practical applications for audit log analysis systems in multi-tenant environments, especially in industries with high requirements for security and behavioral pattern recognition, such as finance, e-commerce, and government. By integrating semantic and contextual information, the system can more accurately distinguish between normal operations and potential threat behaviors, such as identifying unauthorized operations disguised as system maintenance or distributed fraudulent activities.

[0084] In terms of technical effectiveness, this step significantly improves the context awareness and semantic understanding depth of log analysis, enhancing the accuracy and adaptability of rule generation. Through a dynamic weighting mechanism, the system can automatically adjust the weight of contextual information based on the behavioral characteristics of different tenants, thereby achieving more refined risk identification and rule customization, effectively reducing false alarm rates and improving the real-time response capability of threat detection.

[0085] S4. Based on the multidimensional feature vector, access control rules are automatically generated through a rule generation model, and the robustness of the rules is verified by simulating attack scenarios.

[0086] Specifically, the step of "automatically generating access control rules based on the multi-dimensional feature vector through a rule generation model and verifying the robustness of the rules through simulated attack scenarios" is the core link in realizing dynamic policy generation and security verification in this invention. Its technical implementation principle integrates rule extraction algorithms in machine learning with security attack and defense simulation technology, and has a high degree of intelligence and automation.

[0087] At the technical implementation level, this step first relies on the multi-dimensional feature vector generated by the preceding module. This vector consists of dimensions such as user identity (e.g., user role, permission level), resource attributes (e.g., resource sensitivity level, access type), and time-series features (e.g., operation frequency, behavioral statistics within the access time window). These features are weighted and fused through a context-aware analysis module to form a structured input. The rule generation model typically uses decision trees or rule-based ensemble learning methods (e.g., RuleFit, OneR) to perform pattern recognition and rule induction on the multi-dimensional feature vector. By learning the differences between normal and abnormal behaviors in historical logs, the model automatically generates access control rules with logical expression capabilities, such as: "IF user role is 'ordinary user' AND resource sensitivity is 'confidential' AND access count > 5 times within 5 minutes THEN is marked as high-risk behavior."

[0088] At the parameter level, the training of the rule generation model relies on the standardization of feature vectors, including feature normalization (such as Min-Max Scaling), discretization (such as dividing the frequency of consecutive operations into low, medium, and high levels), and feature importance ranking (such as evaluating the contribution of each dimension to rule generation through SHAP values). Simulated attack scenarios are achieved by generating adversarial examples. The sample data is based on real logs but perturbed, such as modifying IP addresses, adjusting operation time intervals, and forging user identities, to test the generated rules' ability to identify and resist interference in the face of complex attack patterns. During the validation process, the system uses metrics such as F1-score, accuracy, and recall to evaluate rule performance and ensure its effectiveness in real-world environments.

[0089] At the application level, this step is widely applicable to the security management of server clusters in multi-tenant environments, such as finance, e-commerce, and government industries that are sensitive to access behavior. For example, in e-commerce platforms, the system can automatically generate access control rules against malicious order placement and verify the robustness of the rules by simulating order placement behavior from multiple IP addresses, thereby effectively identifying and blocking abnormal access.

[0090] Furthermore, this step, by introducing dynamic rule generation and simulation verification mechanisms, significantly improves the real-time performance and adaptability of access control policies, solving the problem that traditional static rules are unable to cope with new types of attacks. Its technical value lies in achieving a shift from "passive response" to "active defense," enhancing the system's security capabilities and intelligence level.

[0091] S5 deploys the verified access control rules to the target system and outputs the corresponding security alert information.

[0092] Specifically, the step of "deploying the verified access control rules to the target system and outputting the corresponding security alarm information" is the final step in the dynamic rule generation and verification process of this invention. Its technical implementation principle is based on the collaborative mechanism between the rule engine and the system integration interface, which ensures that the generated access control rules can be applied to the actual business system efficiently and securely, and trigger alarms in a timely manner when abnormal behavior occurs.

[0093] In some implementations, this step first synchronizes the validated rules to the target system's access control engine via a rule deployment interface (such as a REST API, Kafka message queue, or configuration management tool). The deployment process must adhere to standardized protocols, such as using YAML or JSON to encapsulate the rule content, ensuring the rules are structured and parsable. The rule deployment module supports a hot update mechanism, allowing new rules to be dynamically loaded and applied without interrupting system operation, thus achieving zero-downtime policy adjustments.

[0094] Furthermore, after the rules are deployed, the system will monitor the audit log stream in real time and match each log entry with the deployed access control rules. The matching process is typically based on a rule engine (such as Drools, Apache NiFi, or a custom decision tree-based rule matcher), and its core is to logically judge multi-dimensional feature vectors (including user identity, resource sensitivity, and behavioral statistics within a time window) against the rule conditions. For example, if a user performs more than 5 "file modification" operations on "confidential" resources within 5 minutes, the system will trigger a high-risk alert.

[0095] At the parameter level, alarm outputs must meet certain threshold settings and response latency requirements. Alarm information typically includes fields such as timestamp, user ID, operation type, resource path, matching rule ID, and risk level (e.g., low, medium, high), and is sent to the visualization monitoring module or security operations center via standardized protocols (e.g., Syslog, JSON over HTTP). Alarm response latency should be controlled within milliseconds to ensure rapid response to real-time attacks.

[0096] In practical applications, this step is widely applicable to environments requiring granular access control and real-time risk response, such as multi-tenant cloud platforms, financial systems, and e-commerce platforms. For example, in an e-commerce platform, the system can automatically deploy access control rules for "high-frequency ordering" behavior and immediately output alerts when anomalies are detected to prevent malicious order-brushing behavior from impacting business operations.

[0097] The technical value of this step lies in the fact that by rapidly deploying the rules generated by LLM semantic analysis and context-aware mechanisms to the target system, a closed-loop control from log analysis to security response is achieved, which significantly improves the system's real-time defense capabilities and policy flexibility, while reducing the complexity of manual configuration and maintenance.

[0098] The context-aware intelligent audit log analysis method based on a large language model in this invention improves the detection accuracy and dynamic adaptability of audit log analysis, reduces false alarm rate and maintenance cost, and enables customized risk identification and real-time rule updates in multi-tenant scenarios.

[0099] Furthermore, after executing step S5, the present invention can also push the security alarm information to the visualization monitoring module and display it in a graded manner according to the alarm level.

[0100] Specifically, this step involves pushing security alert information to the visualization monitoring module and displaying it in a tiered manner according to the alert level. This is a key step in realizing risk visualization and tiered response in the log intelligent analysis system of this invention. In some implementations, this step asynchronously transmits the alert information from the dynamic rule generation module to the visualization monitoring module through message queues (such as Kafka, RabbitMQ) or real-time stream processing frameworks (such as Apache Flink, Spark Streaming), ensuring low latency and high throughput processing of the alert information. The alert information is usually encapsulated in structured JSON format, including fields such as timestamp, user identity, resource type, operation description, risk score, and alert level (such as low risk, medium risk, high risk, severe risk).

[0101] At the parameter level, alarm levels are classified based on a comprehensive score of multi-dimensional feature vectors. The scoring model can use a weighted linear combination or a decision tree-based classifier output. The alarm level thresholds can be configured as follows: low risk (0-30 points), medium risk (31-60 points), high risk (61-90 points), and severe risk (91-100 points). The alarm information push frequency can be dynamically adjusted according to system load and alarm urgency. For example, high-risk and above alarms are pushed in real time (delay <1 second), while medium- and low-risk alarms can be pushed in batches (once every 30 seconds) to optimize system resources.

[0102] In application scenarios, the visualization monitoring module is typically deployed in an enterprise-level security operations center or cloud platform management console, supporting access via web or mobile devices. Alarm information is displayed on the front end using visualization components such as dashboards, heatmaps, and time-series graphs. Different alarm levels are distinguished using color coding (e.g., green, yellow, orange, red) and sound / pop-up alarm mechanisms, facilitating rapid response by security personnel. Furthermore, the system supports multi-tenant isolated display; each tenant can configure independent alarm display templates and notification policies to meet the differentiated needs of various industries such as finance, e-commerce, and government.

[0103] The technical effect of this step is that, through the hierarchical display of structured alarm information, the traceability and response efficiency of security incidents are significantly improved, false alarm interference is reduced, and the real-time monitoring capability and multi-tenant adaptability of the system are enhanced, thereby achieving precise and visual control over access behavior of cluster servers.

[0104] Furthermore, the present invention can also generate visual reports based on the alarm information, which can be used by operation and maintenance personnel to trace the source of risk behavior and analyze system hardening.

[0105] In terms of implementation, the system first categorizes and aggregates alarm information according to predefined classification criteria (such as risk level, attack type, user role, resource sensitivity, etc.). Then, it uses a data visualization engine (such as ECharts, Kibana, or a custom D3.js charting library) to transform the structured data into multi-dimensional visual reports. Report content includes, but is not limited to, time series graphs, user behavior heatmaps, resource access frequency distribution maps, and risk behavior correlation graphs. In some implementations, the system supports multi-tenant isolated display, with each tenant's alarm data presented independently in the visualization interface, ensuring data privacy and access control. Furthermore, the system introduces a context-aware mechanism to correlate alarm information with contextual information such as user identity, resource attributes, and operation paths, constructing a behavior chain graph to assist operations and maintenance personnel in tracing and analyzing the source of the problem.

[0106] This step is widely applied to scenarios that require high security guarantees, such as cloud computing platforms, enterprise data centers, financial systems, e-commerce platforms, etc. For example, in an e-commerce platform, the system can display the warning information of malicious order brushing behavior in the form of a heat map, combined with the user IP distribution and the order placement time series, to help the security team quickly identify abnormal behavior patterns. In a financial system, the visualization report can display the access paths of highly sensitive resources, combined with user permissions and operation contexts, to assist auditors in judging whether there are risks of unauthorized access or data leakage. The system also supports integration with SIEM (Security Information and Event Management) platforms to achieve the linked display and response of warning information.

[0107] Through this step, the system has achieved an efficient transformation from raw warning data to structured and graphical analysis results, significantly improving the recognition efficiency and traceability ability of operation and maintenance personnel for risk behaviors. The visualization report not only reduces the complexity of log analysis but also reduces the false alarm rate through context-related analysis, improving the credibility of warnings. In addition, the system supports custom view templates and warning threshold configurations, enhancing its adaptability and practicality in different business scenarios and providing intuitive and operable data support for the formulation of subsequent system strengthening strategies.

[0108] To implement the above embodiments, the present invention also proposes a context-aware audit log intelligent analysis device based on a large language model. Figure 2 It is a schematic structural diagram of a context-aware audit log intelligent analysis device provided by an embodiment of the present invention. As Figure 2 shown, the device includes: <e

[0109] A log collection and standardization module 100, configured to collect access audit logs of a server cluster and perform standardization processing on the operation descriptions in the logs to generate structured log data;

[0110] A semantic parsing and vector generation module 200, configured to use a large language model to perform semantic parsing on the operation descriptions in the structured log data, extract implicit behavior patterns, and generate semantic vectors;

[0111] A context feature construction module 300, configured to construct a multi-dimensional feature vector by combining context information such as user identity, resource attributes, and behavior statistics within an operation time window;

[0112] A rule generation and verification module 400, configured to automatically generate access control rules through a rule generation model based on the multi-dimensional feature vector and verify the robustness of the rules by simulating attack scenarios;

[0113] A rule deployment and warning output module 500, configured to deploy the verified access control rules to a target system and output corresponding security warning information.

[0114] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0115] To implement the above embodiments, the present invention also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0116] To implement the above embodiments, the present invention also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0117] To implement the above embodiments, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0118] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0119] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0120] This invention is intended to provide implementation schemes for users to selectively prevent the use or access to personal information data. That is, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0121] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0122] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0123] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0124] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0125] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0126] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0127] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0128] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0129] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0130] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A context-aware intelligent analysis method for audit logs based on a large language model, characterized in that, include: S1. Collect access audit logs from the server cluster and standardize the operation descriptions in the logs to generate structured log data. S2, use a large language model to perform semantic parsing on the operation descriptions in the structured log data, extract implicit behavior patterns and generate semantic vectors; S3, combining contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window, constructs a multi-dimensional feature vector; S4. Based on the multidimensional feature vector, access control rules are automatically generated through a rule generation model, and the robustness of the rules is verified through simulated attack scenarios. S5 deploys the verified access control rules to the target system and outputs the corresponding security alert information.

2. The method as described in claim 1, characterized in that, S1, which involves collecting access audit logs from the server cluster and standardizing the operation descriptions in the logs to generate structured log data, also includes: S11 collects raw log records via API interface or log file; S12, perform noise data cleaning on the operation description and normalize semantically similar operation descriptions into a unified operation type.

3. The method as described in claim 1, characterized in that, S2, which utilizes a large language model to perform semantic parsing on the operation descriptions in the structured log data, extracts implicit behavioral patterns, and generates semantic vectors, further includes: S21, a pre-trained large language model is used to perform preliminary semantic vector extraction on the operation description; S22, The pre-trained model is fine-tuned based on the labeled attack log dataset to enhance its ability to identify hidden malicious behaviors.

4. The method as described in claim 1, characterized in that, The S3 method, which combines contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window to construct a multi-dimensional feature vector, also includes: S31, dynamically adjust the weights of user identity, resource attributes, and time series information based on the tenant's industry type; S32 concatenates the weighted context information with the semantic vector to generate a multidimensional feature vector for rule generation.

5. The method as described in claim 1, characterized in that, Also includes: The security alarm information is pushed to the visualization monitoring module and displayed in a hierarchical manner according to the alarm level; Visual reports are generated based on the alarm information, which are used by operations and maintenance personnel to trace the source of risk behaviors and analyze system hardening.

6. A context-aware intelligent analysis device for audit logs based on a large language model, characterized in that, include: The log collection and standardization module is used to collect access audit logs from the server cluster and standardize the operation descriptions in the logs to generate structured log data. The semantic parsing and vector generation module is used to perform semantic parsing on the operation descriptions in the structured log data using a large language model, extract implicit behavior patterns and generate semantic vectors. The context feature construction module is used to construct multi-dimensional feature vectors by combining contextual information such as user identity, resource attributes, and behavioral statistics within the operation time window; The rule generation and verification module is used to automatically generate access control rules based on the multidimensional feature vector through a rule generation model, and to verify the robustness of the rules through simulated attack scenarios. The rule deployment and alarm output module is used to deploy verified access control rules to the target system and output corresponding security alarm information.

7. The apparatus as claimed in claim 6, characterized in that, The log collection and standardization module is also used for: Raw log records can be collected via API interfaces or log files; The operation descriptions are cleaned of noisy data, and semantically similar operation descriptions are normalized into a unified operation type.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-5.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-5.

Images