State secret log auditing system

Abstract

Embodiments of the present application relate to the technical field of data analysis, and particularly relate to a national secret log auditing system. The national secret log auditing system first collects operation behavior record sequences generated in the running process of a national secret application system, the sequences being composed of log entries containing identity verification information, resource access path information and state transition description information. Then, the operation behavior record sequences are subjected to context semantic correlation analysis to obtain semantic element extraction results and semantic dependency relationships. Then, multi-level compliance verification is performed based on a national secret security auditing rule system to generate log entry level compliance judgment conclusions and cross-entry level abnormal behavior pattern recognition reports. Finally, a national secret log security auditing result set is constructed according to the judgment conclusions and the recognition reports, including risk level evaluation results, violation evidence chain correlation graphs and security reinforcement strategy suggestion lists, effectively improving the accuracy and comprehensiveness of national secret log auditing.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and more specifically, to a national cryptographic log auditing system. Background Technology

[0002] With the rapid development of information technology, national cryptographic application systems have been widely used in various key areas, and their security and compliance are of paramount importance. During operation, these systems generate a large number of operational records, which contain various information about the system's operation and are crucial for auditing the system's security and compliance, as well as identifying potential security threats.

[0003] In existing technologies, the auditing of national cryptographic logs mainly focuses on simple log collection and basic rule matching. This often results in incomplete audit information, lack of contextual analysis, and imperfect compliance verification mechanisms, making it difficult to meet the growing security auditing needs of national cryptographic application systems. Summary of the Invention

[0004] In view of this, the present invention provides a national cryptographic log auditing system.

[0005] This invention provides a national cryptographic log auditing system, which is used for: The system collects a sequence of operation behavior records generated during the operation of the national cryptographic application system. The sequence of operation behavior records consists of log entries generated in chronological order. Each log entry contains the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process. The operation behavior record sequence is subjected to contextual semantic association parsing to obtain the semantic element extraction result of each log entry and the semantic dependency relationship between adjacent log entries. The semantic element extraction result includes operation intention category identifier, resource permission matching feature and state transition sequence feature. The semantic dependency relationship is used to characterize the degree of association between different log entries at the business logic level. Based on the national cryptographic security audit rule system, the semantic element extraction results and semantic dependencies are subjected to multi-level compliance verification processing to generate log entry-level compliance judgment conclusions and cross-entry-level abnormal behavior pattern identification reports. The compliance judgment conclusions include compliance status labels and non-compliance risk point descriptions, and the abnormal behavior pattern identification reports include abnormal pattern type codes and temporal distribution characteristics of pattern occurrence. Based on the compliance judgment conclusions and abnormal behavior pattern identification reports, a national cryptographic log security audit result set is constructed. The national cryptographic log security audit result set includes risk level assessment results, violation evidence chain association graphs, and a list of security hardening strategy recommendations.

[0006] This invention provides a method for auditing national cryptographic logs, applied to a national cryptographic log auditing system. The method includes: The system collects a sequence of operation behavior records generated during the operation of the national cryptographic application system. The sequence of operation behavior records consists of log entries generated in chronological order. Each log entry contains the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process. The operation behavior record sequence is subjected to contextual semantic association parsing to obtain the semantic element extraction result of each log entry and the semantic dependency relationship between adjacent log entries. The semantic element extraction result includes operation intention category identifier, resource permission matching feature and state transition sequence feature. The semantic dependency relationship is used to characterize the degree of association between different log entries at the business logic level. Based on the national cryptographic security audit rule system, the semantic element extraction results and semantic dependencies are subjected to multi-level compliance verification processing to generate log entry-level compliance judgment conclusions and cross-entry-level abnormal behavior pattern identification reports. The compliance judgment conclusions include compliance status labels and non-compliance risk point descriptions, and the abnormal behavior pattern identification reports include abnormal pattern type codes and temporal distribution characteristics of pattern occurrence. Based on the compliance judgment conclusions and abnormal behavior pattern identification reports, a national cryptographic log security audit result set is constructed. The national cryptographic log security audit result set includes risk level assessment results, violation evidence chain association graphs, and a list of security hardening strategy recommendations.

[0007] The present invention also provides a national cryptographic log auditing system, comprising: a memory for storing program instructions and data; and a processor for coupling with the memory to execute the instructions in the memory to implement the method described above.

[0008] The present invention also provides a computer storage medium comprising instructions that, when executed on a processor, implement the above-described method.

[0009] The national cryptographic log auditing system of this invention comprehensively collects the operation behavior record sequence during the operation of the national cryptographic application system during the data acquisition phase. This includes the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process, reflecting the true state of system operation and operational details. Then, the operation behavior record sequence is deeply analyzed to obtain the semantic element extraction results of each log entry and the semantic dependencies between adjacent log entries. The semantic element extraction results include operation intent category identifiers, resource permission matching features, and state transition sequence features, which can accurately depict the essence and characteristics of the operation; the semantic dependencies reveal the close connection between different log entries at the business logic level, enabling auditors to understand log data from a semantic perspective, uncover the business logic and potential risks hidden behind the data, and improve the understanding and analysis capabilities of log data. Further multi-level compliance verification processing, based on the national cryptographic security audit rule system, comprehensively verifies the semantic element extraction results and semantic dependencies, generating compliance judgment conclusions at the log entry level and abnormal behavior pattern identification reports at the cross-entry level. The compliance assessment results clearly define whether each log entry is compliant and the risk points of non-compliance, providing a basis for timely detection and correction of violations. The abnormal behavior pattern identification report identifies potential abnormal behavior patterns through abnormal pattern type coding and the temporal distribution characteristics of pattern occurrence, which helps to provide early warning and prevent security risks. The multi-level verification method can ensure the comprehensiveness and accuracy of the audit, effectively avoiding missed detections and misjudgments.

[0010] Finally, based on the compliance assessment conclusions and the abnormal behavior pattern identification report, a national cryptographic log security audit result set is constructed, including risk level assessment results, violation evidence chain correlation graphs, and a security hardening strategy recommendation list. The risk level assessment results intuitively reflect the degree of risk in the national cryptographic logs, helping auditors quickly determine risk priorities; the violation evidence chain correlation graph clearly displays the evidence chain of violations, providing strong evidentiary support for investigating and handling violations; and the security hardening strategy recommendation list provides targeted security hardening measures based on the identified risks and abnormal patterns, enabling timely remediation of security vulnerabilities and improving the security of national cryptographic application systems.

[0011] In conclusion, this national cryptographic log auditing system has comprehensively improved the quality and efficiency of national cryptographic log auditing. Attached Figure Description

[0012] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0013] Figure 1 This is a flowchart illustrating the steps of a national cryptographic log auditing method provided in an embodiment of the present invention.

[0014] Figure 2 This is a structural block diagram of a national cryptographic log auditing system provided in an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the present invention will now be described in conjunction with the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present invention. It should be noted that the terms "first," "second," etc., in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0016] Please see Figure 1 , Figure 1 This is a flowchart illustrating a national cryptographic log auditing method provided in an embodiment of the present invention. The method is applied to a national cryptographic log auditing system and may further include steps 110-140.

[0017] Step 110: Collect the sequence of operation behavior records generated during the operation of the national cryptographic application system. The sequence of operation behavior records consists of log entries generated in chronological order. Each log entry contains the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process.

[0018] In the context of national cryptographic logging auditing, national cryptographic application systems continuously generate various operational behaviors during runtime, which are recorded in the form of log entries. For example, in a financial transaction system involving national cryptographic encryption, when a user logs in, the system records the authentication information of the initiating entity (i.e., the user), such as username and password verification results; it also records the resource access path information of the target object, such as the path to the account balance query interface that the user attempts to access after logging in; and it records the state transition description information of the operation execution process, such as the state change from inputting information to successful or failed verification during the login process. These log entries are arranged in chronological order to form a sequence of operation behavior records.

[0019] Step 120: Perform contextual semantic association parsing on the operation behavior record sequence to obtain the semantic element extraction results of each log entry and the semantic dependency relationship between adjacent log entries. The semantic element extraction results include operation intent category identifier, resource permission matching features and state transition sequence features. The semantic dependency relationship is used to characterize the degree of association between different log entries at the business logic level.

[0020] Step 121: Perform structured semantic parsing on each log entry in the operation behavior record sequence to extract the text content of the operation subject field, operation object field, operation type field, and status description field.

[0021] In the aforementioned financial transaction system's national cryptographic log auditing scenario, structured semantic parsing is performed on each log entry in the collected sequence of operational behavior records. Taking a log entry of a user's transfer operation as an example, the parsed data includes: the operation subject field (the user's identity information initiating the transfer); the operation object field (the target account information); the operation type field ("transfer" operation); and the status description field (the status at each stage of the transfer process, such as text content like "transfer request submitted," "transfer in progress," and "transfer successful"). Through this structured semantic parsing, key information can be extracted from the log entries.

[0022] Step 122: Call the national cryptographic semantic segmentation tool to perform domain-adaptive segmentation on the text content, and generate a segmentation result set containing national cryptographic professional terms. Each segmentation unit in the segmentation result set carries a domain semantic tag.

[0023] The extracted text content of the operation subject field, operation object field, operation type field, and status description field is processed using a dedicated semantic word segmentation tool for Chinese cryptographic algorithms. In the context of Chinese cryptographic algorithms in financial transaction systems, terms like "Chinese cryptographic encryption algorithm" and "key management" are specialized terms. The word segmentation tool segments the text content into words; for example, "using Chinese cryptographic encryption algorithm to encrypt transfer data" is segmented into word units such as "using," "Chinese cryptographic encryption algorithm," "to," "transfer data," "perform," and "encrypt." Each word unit carries a domain semantic tag; for example, "Chinese cryptographic encryption algorithm" is marked with a semantic tag related to Chinese cryptographic algorithms.

[0024] Step 123: Construct a semantic representation vector for log entries based on the word segmentation result set. The dimension of the semantic representation vector corresponds to the number of domain semantic tag types in the word segmentation result set.

[0025] A semantic representation vector for log entries is constructed based on the word segmentation result set. In the auditing of national cryptographic logs in financial transaction systems, the domain semantic tags in the word segmentation result set include those related to national cryptographic algorithms, financial transactions, and account management, among others. Therefore, the dimension of the log entry semantic representation vector corresponds to the number of these domain semantic tags. For example, a log entry about a user changing their account password will have its semantic representation vector assigned values ​​to the corresponding dimensions based on the domain semantic tags corresponding to each word segmentation unit in the log entry, thus forming a vector that represents the semantics of the log entry.

[0026] Step 124: Calculate the cosine similarity between the semantic representation vectors of adjacent log entries, and use the cosine similarity as the initial semantic dependency coefficient.

[0027] After obtaining the semantic representation vector of each log entry, the cosine similarity between the semantic representation vectors of adjacent log entries is calculated. Taking two adjacent log entries in a financial transaction system where a user first logs in and then checks their account balance as an example, the cosine similarity between their semantic representation vectors is used to measure their semantic similarity. This cosine similarity serves as the initial semantic dependency coefficient, which can initially reflect the degree of correlation between these two adjacent log entries at the business logic level. If the cosine similarity is high, it indicates that these two log entries are semantically similar and may also be closely related in terms of business logic.

[0028] Step 125: Analyze the consistency characteristics of adjacent log entries in the operation subject field, operation object field, and operation type field, and perform weighted adjustment on the initial semantic dependency coefficient to generate a semantic dependency relationship that represents the degree of closeness of business logic association.

[0029] After calculating the initial semantic dependency coefficient, the consistency characteristics of adjacent log entries in the operation subject, operation object, and operation type fields are further analyzed. In a financial transaction system, if two adjacent log entries have the same user as the operation subject, a certain relationship between the operation objects (e.g., querying the account balance first, then performing a transfer operation on the same account), and a logical order in the operation types, then the initial semantic dependency coefficient will be adjusted with weights. Higher consistency characteristics in these fields indicate a tighter business logic connection, thus appropriately increasing the initial semantic dependency coefficient to generate a more accurate semantic dependency relationship that characterizes the tightness of the business logic connection.

[0030] Step 126: Perform intent category identification processing on the word segmentation result set of each log entry to determine the operation intent category identifier.

[0031] The intent category identification process is performed on the word segmentation result set of each log entry. In the national cryptographic log audit of the financial transaction system, taking a log entry of a user's investment product purchase operation as an example, by analyzing its word segmentation result set, the operation intent category is identified as "investment product purchase", and the corresponding operation intent category identifier is determined. This identifier can clearly identify the operation intent represented by the log entry.

[0032] Step 127: Extract terminology units related to resource permissions from the word segmentation result set and generate resource permission matching features.

[0033] Extract terminology units related to resource permissions from the word segmentation result set. In financial transaction systems, terms such as "advanced account permissions" and "setting investment product purchase permissions" are all terminology units related to resource permissions. Taking a log entry of a user attempting to access restricted account information as an example, extract terminology units such as "restricted account" and "access permission" to generate resource permission matching features. These features can reflect whether the operation complies with the corresponding resource permission requirements.

[0034] Step 128: Convert the text content of the state description field into state transition sequence features, wherein the state transition sequence features include a state type sequence and a state transition probability distribution.

[0035] The text content of the status description field is converted into a status transition sequence feature. In a financial transaction system, taking a log entry of a user's loan application as an example, the text content of the status description field might be "Loan application submitted," "Loan under review," "Loan approved," "Loan disbursed," or "Loan disbursed successfully." These status text contents are converted into status transition sequence features, including a status type sequence (i.e., the various status types arranged in order) and a status transition probability distribution, such as the probability of transitioning from "Loan application submitted" to "Loan under review," and from "Loan under review" to "Loan approved." These status transition sequence features can more clearly demonstrate the status changes during the operation execution process.

[0036] Step 129: Integrate the operation intent category identifier, resource permission matching feature, and state transition sequence feature to generate the semantic element extraction result for each log entry.

[0037] By fusing operation intent category identifiers, resource permission matching features, and state transition sequence features, semantic element extraction results are generated for each log entry. In the national cryptographic log auditing of financial transaction systems, for a log entry where a user performs a fund withdrawal operation, the operation intent category identifier "fund withdrawal," resource permission matching features (such as whether there is withdrawal permission), and state transition sequence features (such as withdrawal request submission, review, processing, completion, etc.) are fused together to form the semantic element extraction results for that log entry. This result can comprehensively reflect the semantic information of the log entry.

[0038] Step 130: Based on the national cryptographic security audit rule system, perform multi-level compliance verification processing on the semantic element extraction results and semantic dependencies, generate a compliance judgment conclusion at the log entry level and an abnormal behavior pattern identification report at the cross-entry level. The compliance judgment conclusion includes a compliance status label and a description of non-compliance risk points, and the abnormal behavior pattern identification report includes an abnormal pattern type encoding and the temporal distribution characteristics of the pattern occurrence.

[0039] Step 131: Load a subset of rules that match the current audit scenario from the national cryptographic security audit rule system. The subset of rules includes basic compliance rules, business logic rules, and anomaly detection rules.

[0040] In the scenario of auditing national cryptographic logs in financial transaction systems, a subset of rules matching the current audit scenario is loaded from the national cryptographic security audit rule system. Basic compliance rules may include compliance requirements for user authentication, compliance requirements for resource access permissions, etc.; business logic rules will stipulate the normal business processes and logical relationships of financial transaction operations, such as amount limits and time limits for transfer operations; anomaly detection rules are used to detect possible abnormal behavior patterns, such as frequent large-amount transfers.

[0041] Step 132: Perform a line-by-line matching and verification of the semantic element extraction results of each log entry with the basic compliance rules to generate a preliminary compliance judgment result at the log entry level.

[0042] Step 1321: Parse the rule condition expressions and rule conclusions in the basic compliance rules, and construct a rule matching tree structure.

[0043] The rule condition expressions and conclusions in the basic compliance rules are parsed to construct a rule matching tree structure. Taking a basic compliance rule concerning user login operations as an example in the audit of national cryptographic logs in financial transaction systems, the rule condition expression might be "Is the user authentication information correct?" or "Is the national cryptographic authentication method used?", with the rule conclusion being "Login compliant" or "Login non-compliant." Based on these conditions and conclusions, a rule matching tree structure is constructed. The root node represents the overall condition of the rule, and the next level nodes represent the specific condition branches. This tree structure allows for clearer matching and verification.

[0044] Step 1322: Match the operation intent category identifier in the semantic element extraction result of the log entry with the root node of the rule matching tree to determine the candidate rule branch.

[0045] The operation intent category identifier in the semantic element extraction result of the log entry is matched with the root node of the rule matching tree. In the above financial transaction system, if the operation intent category identifier of a log entry is "login", it is matched with the root node of the rule matching tree to determine the candidate rule branches related to the "login" operation, thereby narrowing the matching range and improving matching efficiency.

[0046] Step 1323: Extract the resource permission matching feature verification conditions corresponding to the candidate rule branches, and compare the resource permission matching features of the log entries with the verification conditions.

[0047] Extract the resource permission matching feature verification conditions corresponding to the candidate rule branches. In a financial transaction system, if a candidate rule branch relates to user account access permissions, the verification condition might be "whether the user has the access permission for this account." Compare the resource permission matching features of log entries with these verification conditions. For example, if a log entry shows a user attempting to access a restricted account, by comparing its resource permission matching features, determine whether the user has the corresponding access permission.

[0048] Step 1324: When the resource permission matching feature meets the verification conditions, continue matching the next level node of the rule matching tree; otherwise, mark it as potentially non-compliant.

[0049] If the resource permission matching characteristics of a log entry meet the verification conditions, the matching continues to the next level of the rule matching tree. In a financial transaction system, if the user has the corresponding account access permissions, the matching continues for other conditions of the login operation. If the resource permission matching characteristics do not meet the verification conditions, such as the user not having permission to access a restricted account, the log entry is marked as potentially non-compliant.

[0050] Step 1325: Perform a final verification on the state transition sequence features corresponding to the leaf nodes of the rule matching tree to determine whether the state transition sequence features meet the state constraints in the rule conclusion.

[0051] The final verification is performed on the state transition sequence features corresponding to the leaf nodes of the rule matching tree. In a financial transaction system, taking a rule about account fund changes as an example, the state constraint in the rule conclusion might be "fund changes must proceed according to the normal process." The state transition sequence features of log entries are analyzed to determine whether they meet these state constraints. If the state transition sequence does not conform to the normal process, such as the fund change being completed without necessary review, then the log entry may have a problem.

[0052] Step 1326: When all rule conditions at all levels are met, generate a compliance status label; when the rule conditions at any level are not met, generate a non-compliance status label and record the number of the non-met rule condition.

[0053] A compliance status label is generated when all rule conditions at all levels are met. In a financial transaction system, if a user login operation log entry meets all basic compliance rules regarding its operation intent, resource permissions, and state transitions, a "Login Compliant" status label is generated. When rule conditions at any level are not met, a non-compliance status label is generated, and the number of the non-compliant rule condition is recorded. For example, if a user's authentication information is incorrect during login, a "Login Non-compliant" status label is generated, and the corresponding rule condition number is recorded.

[0054] Step 1327: Merge the compliance status label or non-compliance status label with the rule condition number to generate a preliminary compliance judgment result at the log entry level.

[0055] By merging compliance or non-compliance status labels with rule condition numbers, a preliminary compliance determination result is generated at the log entry level. In a financial transaction system, for a non-compliant user transfer operation log entry, the "transfer non-compliant" status label is merged with the unmet rule condition number to form a complete preliminary compliance determination result. This result clearly indicates whether the log entry is compliant and the specific reasons for non-compliance.

[0056] Step 133: Based on the semantic dependency relationship, perform correlation verification on the preliminary compliance judgment results of adjacent log entries, correct the misjudgment results caused by isolated verification, and obtain the final compliance judgment conclusion.

[0057] In the auditing of national cryptographic logs in financial transaction systems, preliminary compliance judgments are correlated and verified based on the semantic dependencies between adjacent log entries. For example, a log entry for a user's account query operation might initially be deemed non-compliant. However, by analyzing its semantic dependencies with an adjacent login operation log entry, it might be found that the login operation is compliant and the query operation was performed normally after successful login. In this case, the preliminary judgment for the account query operation log entry can be revised, leading to a final compliance judgment. This correlative verification process reduces misjudgments caused by isolated checks.

[0058] Step 134: Extract risk points from the log entries marked as non-compliant in the compliance determination conclusion and generate a description of the non-compliant risk points.

[0059] Risk point extraction processing is performed on log entries marked as non-compliant in the compliance assessment conclusion. In a financial transaction system, if a log entry about a user's large fund transfer operation is judged as non-compliant, risk points are extracted by analyzing its semantic element extraction results and relevant rules, such as "the amount of funds transferred exceeds the user's authorization range" or "the fund transfer did not go through the necessary approval process," and a non-compliant risk point description is generated, which can clearly point out the specific risks of non-compliance.

[0060] Step 135: Divide the operation behavior record sequence into multiple behavior pattern sequence units according to semantic dependencies. Each behavior pattern sequence unit consists of consecutive log entries whose semantic dependencies satisfy a preset threshold.

[0061] Operational behavior record sequences are divided into multiple behavioral pattern sequence units based on semantic dependencies. In financial transaction systems, if the preset threshold for semantic dependencies is a high standard of correlation, consecutive log entries in the operational behavior record sequence whose semantic dependencies meet this threshold are grouped into a single behavioral pattern sequence unit. For example, a series of consecutive log entries where a user first checks their account balance, then makes a small transfer, and finally checks the transfer result, can be grouped into a single behavioral pattern sequence unit because their semantic dependencies are strong and meet the preset threshold.

[0062] Step 136: Input the semantic element extraction results of each behavior pattern sequence unit into the preset abnormal pattern recognition model for pattern matching processing.

[0063] Step 1361: Perform time-series splicing processing on the semantic element extraction results of all log entries contained in the behavior pattern sequence unit to generate a sequence-level semantic feature vector.

[0064] The semantic element extraction results of all log entries contained in the behavioral pattern sequence unit are processed by temporal concatenation. In a financial transaction system, taking a behavioral pattern sequence unit containing operations such as user login, account query, and fund transfer as an example, the semantic element extraction results of the log entries corresponding to these operations are concatenated in chronological order to generate a sequence-level semantic feature vector. This vector can comprehensively reflect the semantic features of the behavioral pattern sequence unit.

[0065] Step 1362: Perform dimensionality standardization on the sequence-level semantic feature vector to match the input dimension of the anomaly pattern recognition model.

[0066] The generated sequence-level semantic feature vectors undergo dimensionality standardization. In the national cryptographic log auditing of financial transaction systems, the anomaly pattern recognition model has specific input dimensionality requirements. The sequence-level semantic feature vectors are processed to match their dimensions with the model's input dimensions. For example, by adjusting the vector's dimensionality or normalizing the values ​​of certain dimensions, it is ensured that the sequence-level semantic feature vectors can be correctly input into the anomaly pattern recognition model.

[0067] Step 1363: Input the standardized sequence-level semantic feature vector into the feature extraction layer of the abnormal pattern recognition model to extract local pattern features and global trend features in the sequence.

[0068] The standardized sequence-level semantic feature vectors are input into the feature extraction layer of the anomaly pattern recognition model. In financial trading systems, the feature extraction layer extracts local pattern features and global trend features from the sequence. Local pattern features may include the set patterns of a certain operation stage, such as the input information patterns when a user logs in; global trend features may include trends such as the operation frequency and operation time distribution of the entire behavioral pattern sequence units. By extracting these features, a more comprehensive understanding of the characteristics of the behavioral patterns can be achieved.

[0069] Step 1364: Input the local pattern features and global trend features into the pattern matching layer of the abnormal pattern recognition model, and perform similarity calculation with the known abnormal pattern feature library stored in the model.

[0070] Local pattern features and global trend features are input into the pattern matching layer of the anomaly pattern recognition model, and similarity is calculated with the known anomaly pattern feature library stored in the model. In financial transaction systems, the known anomaly pattern feature library may include patterns such as "frequent large-amount transfers" and "sensitive operations outside of working hours." By calculating the similarity between the local pattern features and global trend features and these known anomaly pattern features, it is determined whether a matching anomaly pattern exists.

[0071] Step 1365: When the calculated similarity value exceeds the preset matching threshold, the match is determined to be successful, and the corresponding abnormal pattern type code is output.

[0072] When the calculated similarity value exceeds the preset matching threshold, a successful match is determined. In the national cryptographic log audit of financial transaction systems, if the similarity between the features of a certain behavioral pattern sequence unit and the "frequent large-amount transfer anomaly pattern" exceeds the preset threshold, a successful match is determined, and the corresponding anomaly pattern type code, such as "anomaly pattern 001", is output.

[0073] Step 1366: When the calculated similarity value does not exceed the preset matching threshold, the sequence-level semantic feature vector is input into the anomaly evaluation layer of the anomaly pattern recognition model to calculate the anomaly score of the sequence.

[0074] When the calculated similarity value does not exceed the preset matching threshold, the sequence-level semantic feature vector is input into the anomaly evaluation layer of the anomaly pattern recognition model. In a financial trading system, the anomaly evaluation layer calculates the anomaly score of the sequence based on various features of the sequence, such as operation frequency, operation time, and operation object. This score reflects the degree of anomaly of the behavioral pattern sequence unit.

[0075] Step 1367: When the anomaly score exceeds the anomaly threshold, it is marked as an unknown anomaly mode, and a special anomaly mode type code is generated.

[0076] When the anomaly score exceeds the anomaly threshold, it is marked as an unknown anomaly pattern. In a financial trading system, if the anomaly score of a behavioral pattern sequence unit exceeds the set anomaly threshold, it indicates that it is abnormal but does not belong to a known anomaly pattern. At this time, a special anomaly pattern type code is generated, such as "Unknown Anomaly Pattern 001", so as to further analyze and process this unknown anomaly.

[0077] Step 1368: Merge the successfully matched exception pattern type code or special exception pattern type code as the output of the pattern matching process.

[0078] The successfully matched anomaly pattern type code or special anomaly pattern type code is merged and used as the output of the pattern matching process. In the national cryptographic log auditing of financial transaction systems, if a behavioral pattern sequence unit matches a known anomaly pattern, the corresponding anomaly pattern type code is output; if it is an unknown anomaly pattern, the special anomaly pattern type code is output. This output result can clearly indicate whether the behavioral pattern sequence unit has an anomaly and the type of anomaly.

[0079] Step 137: Perform temporal distribution statistical processing on the matched abnormal pattern type encoding to generate temporal distribution features of pattern occurrence.

[0080] The matched abnormal pattern type codes are subjected to time-series distribution statistical processing. In the national cryptographic log audit of financial transaction systems, the frequency and distribution of different abnormal pattern type codes at different time points are statistically analyzed. For example, the number of times the "frequent large-amount transfer abnormal pattern" occurs in different time periods within a day is statistically analyzed to generate the time-series distribution characteristics of the pattern, which can reflect the temporal regularity of the abnormal pattern.

[0081] Step 138: Integrate the abnormal pattern type encoding and time series distribution features to generate an abnormal behavior pattern recognition report across entries.

[0082] By fusing anomaly pattern type codes and temporal distribution features, a cross-entry-level anomaly behavior pattern recognition report is generated. In financial transaction systems, the report includes various anomaly pattern type codes and their temporal distribution features, such as "anomaly pattern 001 occurs more frequently between 10:00 AM and 11:00 AM on weekdays." This report provides a more comprehensive understanding of the anomaly behavior patterns present in the national cryptographic logs.

[0083] Step 140: Construct a national cryptographic log security audit result set based on the compliance judgment conclusion and the abnormal behavior pattern identification report. The national cryptographic log security audit result set includes risk level assessment results, violation evidence chain association graph, and security hardening strategy recommendation list.

[0084] Step 141: Extract descriptions of non-compliance risk points from the compliance determination conclusion and determine the severity level of each non-compliance risk point.

[0085] Extract descriptions of non-compliance risk points from compliance assessment conclusions. In the audit of national cryptographic logs of financial transaction systems, for a non-compliant user fund operation log entry, the non-compliance risk point description is extracted as "fund operation did not undergo the necessary approval process." Based on the degree of impact of this risk point on system security and normal business operations, its severity level is determined, such as "high," "medium," or "low."

[0086] Step 142: Extract the abnormal pattern type code from the abnormal behavior pattern recognition report, query the preset pattern threat level mapping table, and determine the threat level of each abnormal pattern.

[0087] Extract the abnormal pattern type code from the abnormal behavior pattern recognition report. In a financial transaction system, if "Abnormal Pattern 001" is extracted, query the preset pattern threat level mapping table. This table records the threat level corresponding to different abnormal pattern type codes. Determine the threat level of "Abnormal Pattern 001" based on the mapping table, such as "Severe Threat," "Medium Threat," or "Minor Threat."

[0088] Step 143: Construct a risk assessment matrix based on the severity level and threat level, and calculate the comprehensive risk index.

[0089] Step 1431: Divide the severity level into multiple quantitative levels, with each quantitative level corresponding to a severity score.

[0090] The severity level is divided into multiple quantitative levels. In the audit of the national cryptographic logs of financial transaction systems, the severity level is divided into quantitative levels such as "low severity", "medium severity" and "high severity". Each quantitative level corresponds to a severity score, such as "low severity" corresponding to a score of 1, "medium severity" corresponding to a score of 2, and "high severity" corresponding to a score of 3.

[0091] Step 1432: Divide the threat level into multiple quantification levels, with each quantification level corresponding to a threat level score.

[0092] Threat levels are divided into multiple quantitative levels. In financial trading systems, threat levels are divided into quantitative levels such as "minor threat," "moderate threat," and "critical threat," with each quantitative level corresponding to a threat level score. For example, "minor threat" corresponds to a score of 1, "moderate threat" corresponds to a score of 2, and "critical threat" corresponds to a score of 3.

[0093] Step 1433: Construct a risk assessment matrix with severity scores as rows and threat level scores as columns.

[0094] Construct a risk assessment matrix with severity scores as rows and threat level scores as columns. In a financial transaction system, the rows of the matrix represent different severity scores, the columns represent different threat level scores, and each cell in the matrix represents a risk situation under a combination of severity and threat level.

[0095] Step 1434: Assign a corresponding basic risk index value to each cell in the risk assessment matrix according to the preset risk calculation rules.

[0096] Based on preset risk calculation rules, each cell in the risk assessment matrix is ​​assigned a corresponding basic risk index value. In the financial transaction system, cells with a severity score of 3 (high severity) and a threat level score of 3 (serious threat) are assigned a higher basic risk index value according to the risk calculation rules.

[0097] Step 1435: Obtain the risk sensitivity coefficient of the current audit scenario. The risk sensitivity coefficient is determined based on the importance of the national cryptographic application system.

[0098] Obtain the risk sensitivity coefficient for the current audit scenario. In the audit of national cryptographic logs of financial transaction systems, the risk sensitivity coefficient is determined based on the importance of the financial transaction system. If the system involves a large number of fund transactions and important customer information, the risk sensitivity coefficient will be relatively high.

[0099] Step 1436: The risk index base value and the risk sensitivity coefficient are weighted and calculated to obtain the adjusted risk index.

[0100] The risk index is calculated by weighting the base value of the risk index with the risk sensitivity coefficient. In a financial trading system, the risk index is adjusted by multiplying the base value of the risk index by the risk sensitivity coefficient, and the risk index can be adjusted reasonably according to the importance of the system.

[0101] Step 1437: Sum the adjusted risk indices corresponding to all non-compliance risk points and abnormal patterns involved to generate a comprehensive risk index.

[0102] The adjusted risk indices corresponding to all non-compliant risk points and abnormal patterns are summed. In the audit of the national cryptographic logs of the financial transaction system, the adjusted risk indices corresponding to each non-compliant risk point and abnormal pattern are added together to generate a comprehensive risk index, which can comprehensively reflect the degree of risk present in the national cryptographic logs.

[0103] Step 1438: Compare the comprehensive risk index with the preset risk level threshold to determine the final risk level assessment result.

[0104] The comprehensive risk index is compared with preset risk level thresholds. In financial trading systems, preset risk level thresholds may be categorized as "low risk threshold," "medium risk threshold," and "high risk threshold," etc. Based on the comparison results between the comprehensive risk index and these thresholds, the final risk level assessment result is determined, such as "low risk," "medium risk," or "high risk."

[0105] Step 144: Using the semantic dependency relationship as a link, log entries associated with the same non-compliance risk point or abnormal pattern are chained together to construct a violation evidence chain association graph; the violation evidence chain association graph includes main evidence nodes, auxiliary evidence nodes, and evidence association strength.

[0106] Step 1441: Identify log entries marked as non-compliant or associated with abnormal patterns as primary evidence nodes.

[0107] Log entries marked as non-compliant or associated with abnormal patterns are identified as key evidence nodes. In the auditing of national cryptographic logs in financial transaction systems, if a log entry concerning a large abnormal transfer of funds by a user is marked as non-compliant, it is identified as a key evidence node.

[0108] Step 1442: Based on the semantic dependency relationship, find the log entries directly associated with the main evidence node as first-level auxiliary evidence nodes.

[0109] Based on semantic dependencies, log entries directly associated with the primary evidence node are identified as first-level auxiliary evidence nodes. In a financial transaction system, if the primary evidence node is a log entry of a user's abnormal large-scale fund transfer, log entries directly associated with it, such as the user's login log entries and account query log entries, can serve as first-level auxiliary evidence nodes.

[0110] Step 1443: Continue to search for log entries associated with the first-level auxiliary evidence nodes as second-level auxiliary evidence nodes, and so on, until the semantic dependency is lower than the preset threshold.

[0111] Continue searching for log entries associated with the primary auxiliary evidence nodes as secondary auxiliary evidence nodes. In a financial transaction system, if the primary auxiliary evidence node is a user login log entry, associated entries such as system operation log entries before login can serve as secondary auxiliary evidence nodes. Continue searching in this manner until the semantic dependency falls below a preset threshold, at which point the search stops.

[0112] Step 1444: Calculate the semantic dependency strength between the main evidence node and each auxiliary evidence node, as the evidence association strength.

[0113] Calculate the semantic dependency strength between the primary evidence node and each auxiliary evidence node. In financial transaction systems, the semantic dependency strength is calculated by analyzing the degree of association between log entries in terms of operation subject, operation object, operation type, etc., and this strength is used as the evidence association strength. The higher the degree of association, the stronger the evidence association.

[0114] Step 1445: Add node attribute information to each evidence node. The node attribute information includes log entry timestamps, operation subject authentication information, and compliance judgment conclusions.

[0115] Add node attribute information to each evidence node. In the financial transaction system, for primary and secondary evidence nodes, add a log entry timestamp to specify when the operation occurred; add identity verification information of the operation subject to identify the executor of the operation; and add a compliance judgment conclusion to indicate whether the log entry is compliant.

[0116] Step 1446: Use a directed graph structure to represent the relationships between evidence nodes, with the weight of the directed edge being the evidence association strength.

[0117] A directed graph structure is used to represent the relationships between evidence nodes. In the auditing of national cryptographic logs in financial transaction systems, primary and secondary evidence nodes are represented as nodes in the graph, and the relationships between nodes are represented by directed edges, with the weight of each edge indicating the strength of the evidence association. This directed graph structure can more clearly demonstrate the relationships between evidence of violations.

[0118] Step 1447: Perform redundant node pruning on the constructed directed graph structure, removing auxiliary evidence nodes whose evidence association strength is lower than the set threshold.

[0119] Redundant nodes are pruned from the constructed directed graph structure. In financial trading systems, auxiliary evidence nodes with an evidentiary strength below a set threshold are removed. If an auxiliary evidence node has a very low evidentiary strength with the main evidence node, it indicates that it is not very effective in proving violations, and it is removed to make the evidence chain graph of violations more concise and clear.

[0120] Step 1448: Perform visualization layout processing on the cropped directed graph structure to generate a violation evidence chain association graph containing node hierarchical relationships and association strength.

[0121] The cropped directed graph structure is then visualized and laid out. In the auditing of national cryptographic logs in financial transaction systems, a reasonable layout algorithm is used to arrange nodes and directed edges, generating a relational graph of evidence chains of violations that includes node hierarchical relationships and association strength. This graph can intuitively display the evidence chain of violations in the national cryptographic logs.

[0122] Step 145: Retrieve a security hardening strategy that matches the anomaly pattern type code from the national cryptographic security protection strategy library.

[0123] Step 1451: Parse the abnormal pattern type code and extract the core feature identifier of the pattern.

[0124] Parse the abnormal pattern type code to extract the core feature identifier of the pattern. In the national cryptographic log audit of financial transaction system, if the abnormal pattern type code is "abnormal pattern 001", its core feature identifiers such as "frequent large-amount transfers" can be extracted by parsing it.

[0125] Step 1452: Construct a set of search keywords based on the core feature identifiers of the pattern.

[0126] A set of search keywords is constructed based on the core feature identifiers of the pattern. In financial transaction systems, a set of search keywords such as "protection against frequent large transfers" and "large transfer restriction strategies" is constructed based on the core feature identifiers of the pattern, such as "frequent large transfers".

[0127] Step 1453: Preprocess the policy documents in the national cryptographic security protection policy library and establish a policy keyword index table.

[0128] The strategy documents in the national cryptographic security protection strategy library are preprocessed to create a strategy keyword index table. In the financial trading system, the strategy documents are segmented, keywords are extracted, and an index table is created to facilitate subsequent retrieval.

[0129] Step 1454: Use the set of search keywords to perform fuzzy matching search in the strategy keyword index table to obtain a set of initially matched strategy documents.

[0130] The search keyword set is used to perform fuzzy matching searches in the strategy keyword index table. In the financial trading system, the constructed search keyword set is matched with the strategy keyword index table to obtain a preliminary set of matching strategy documents, such as strategy documents containing content related to "protection against frequent large-amount transfers".

[0131] Step 1455: Calculate the content similarity of the initially matched set of policy documents, whereby the content similarity is determined based on the semantic overlap between the policy documents and the descriptions of abnormal patterns.

[0132] Content similarity is calculated for the initially matched set of strategy documents. In financial trading systems, content similarity is determined based on the semantic overlap between the strategy documents and the descriptions of abnormal patterns. If the content in a strategy document regarding "protection against frequent large transfers" has a high degree of semantic overlap with the descriptions of abnormal patterns, then its similarity is considered high.

[0133] Step 1456: Sort the policy document set from high to low according to content similarity, and select a preset number of policy documents at the top of the sort as candidate security hardening policies.

[0134] The strategy document set is sorted from highest to lowest content similarity. In a financial trading system, a predetermined number of the top-ranked strategy documents are selected as candidate security hardening strategies. For example, the top 5 strategy documents with the highest content similarity are selected as candidates.

[0135] Step 1457: Extract the implementation condition descriptions from the candidate security hardening strategies and match and verify them with the operating environment characteristics of the current national cryptographic application system.

[0136] The implementation conditions of candidate security hardening strategies are extracted and matched against the operating environment characteristics of the current national cryptographic application system. In financial transaction systems, the implementation conditions of candidate security hardening strategies may include system version requirements, network environment requirements, etc. These conditions are compared with the operating environment characteristics of the current system to determine whether they match.

[0137] Step 1458: Filter out candidate security hardening strategies that do not match the implementation conditions to obtain security hardening strategies that match the anomaly pattern type encoding.

[0138] Candidate security hardening strategies that do not meet the implementation conditions are filtered out. In a financial trading system, if the implementation conditions of a candidate security hardening strategy require the system version to be a certain set version, and the current system version does not meet this requirement, it is filtered out, and the final security hardening strategy that matches the anomaly pattern type code is obtained.

[0139] Step 146: Based on the specific content of the description of the non-compliance risk points, filter and adjust the retrieved security hardening strategies.

[0140] Step 1461: Extract keywords from the description of the non-compliance risk points to determine the core risk elements.

[0141] Keyword extraction was performed on descriptions of non-compliant risk points. In the audit of national cryptographic logs of financial transaction systems, keywords such as "fund operations" and "approval processes" were extracted from the description of the non-compliant risk point "fund operations not following necessary approval procedures" to identify the core elements of the risk.

[0142] Step 1462: Decompose the retrieved security hardening strategy into multiple strategy units, each of which contains specific protection measures and applicable scenario descriptions.

[0143] The retrieved security hardening strategies are broken down into multiple strategy units. In a financial transaction system, a security hardening strategy for fund operation security may be broken down into "strengthening user authentication strategy unit," "adding approval process strategy unit," etc., with each strategy unit containing specific protective measures and descriptions of applicable scenarios.

[0144] Step 1463: Semantically match the core risk elements with the applicable scenario descriptions of each strategy unit, and select the strategy units that match the applicable scenarios.

[0145] Semantic matching is performed between core risk elements and the applicable scenario descriptions of each strategy unit. In the financial transaction system, core risk elements such as "fund operations" and "approval processes" are compared with the applicable scenario descriptions of each strategy unit to select strategy units that match the applicable scenarios, such as the "add approval process strategy unit".

[0146] Step 1464: Analyze the logical relationships between the selected strategy units and identify conflicting or duplicated strategy content.

[0147] Analyze the logical relationships between the selected strategy units. In financial trading systems, there may be conflicts or overlaps among the selected strategy units. For example, the "strengthen user authentication strategy unit" and the "add approval process strategy unit" may have overlapping verification steps in some aspects, which need to be identified.

[0148] Step 1465: For strategy units with conflicts, determine their priority based on the risk level assessment results, and retain the strategy units with higher priority.

[0149] For conflicting strategy units, priority is determined based on the risk level assessment results. In a financial trading system, if the risk level assessment result is "high risk," for conflicting strategy units, the higher-priority strategy unit that is more effective for the high-risk situation is retained.

[0150] Step 1466: Merge duplicate strategy units to simplify the strategy content.

[0151] Duplicate strategy units are merged. In the financial transaction system, duplicate verification steps in the "Strengthen User Authentication Strategy Unit" and the "Add Approval Process Strategy Unit" are merged to streamline the strategy content and make the strategy more concise and effective.

[0152] Step 1467: Based on the specific technical details in the description of non-compliance risk points, adjust the parameters of the protective measures of the retained strategy units to adapt them to the current risk scenario.

[0153] Based on the specific technical details described in the non-compliance risk point description, the parameters of the protective measures for the retained strategy units are adjusted. In the financial transaction system, if the non-compliance risk point description indicates a vulnerability in the approval process for fund operations, the parameters of the protective measures for the "add approval process strategy unit" are adjusted, such as adding verification information in the approval process, to adapt it to the current risk scenario.

[0154] Step 1468: Integrate the adjusted strategy units to generate security hardening strategies for the current non-compliance risk points.

[0155] The adjusted strategy units are integrated to generate a security hardening strategy targeting current non-compliance risk points. Within the financial trading system, the selected and adjusted strategy units are merged to form a complete security hardening strategy for the non-compliance risk point of "fund operations not undergoing necessary approval processes."

[0156] Step 147: Sort the adjusted security hardening strategies according to implementation priority and generate a list of security hardening strategy recommendations.

[0157] The adjusted security hardening strategies are prioritized for implementation. During the audit of the national cryptographic logs of the financial transaction system, the adjusted security hardening strategies are ranked based on factors such as their importance in reducing risk and the ease of implementation, generating a list of recommended security hardening strategies. For example, strategies that directly improve high-risk situations and are relatively easy to implement are ranked higher.

[0158] Step 148: Integrate the risk level assessment results, the evidence chain correlation graph of violations, and the security hardening strategy recommendation list to generate a national cryptographic log security audit result set.

[0159] By integrating the risk level assessment results, the evidence chain correlation diagram of violations, and the security hardening strategy recommendation list, a national cryptographic log security audit result set is generated. This result set can comprehensively reflect the risk situation, evidence of violations, and corresponding security hardening measures in the national cryptographic log.

[0160] In a non-limiting embodiment, the national cryptographic log auditing system is further configured to perform the following steps: Step 151: Based on the abnormal behavior pattern identification report in the national cryptographic log security audit result set, construct a dynamic log annotation rule base. The dynamic log annotation rule base includes the mapping relationship between abnormal pattern type encoding and annotation label, annotation priority rules, and label conflict resolution strategies.

[0161] In the context of national cryptographic log auditing in financial transaction systems, a dynamic log labeling rule base is constructed based on the abnormal behavior pattern identification reports in the national cryptographic log security audit result set. For abnormal pattern type encoding, such as "abnormal pattern 001" corresponding to the label "frequent large-amount transfer anomaly," this mapping relationship is established. Labeling priority rules can specify the priority order of labeling tags for different abnormal patterns; for example, the labeling tag for "high-risk abnormal pattern" has a higher priority than "low-risk abnormal pattern." A label conflict resolution strategy is used to handle situations where a log entry matches multiple labels with the same priority, such as analyzing the contextual semantic features of the log entry and historical labeling records to determine the final label.

[0162] Step 152: Collect newly generated national cryptographic log entries, extract their semantic elements, and obtain new log semantic elements.

[0163] Newly generated national cryptographic log entries are collected. Taking a financial transaction system as an example, newly generated log entries may be records of new investment operations performed by users. Semantic element extraction processing is performed on these new log entries, similar to the previous processing of log entries in the operation behavior record sequence. The text content of the operation subject field, operation object field, operation type field, and status description field is extracted, and then operations such as word segmentation and construction of semantic representation vectors are performed to obtain new log semantic elements.

[0164] Step 153: Match the new log semantic elements with the exception pattern type codes in the dynamic log annotation rule base to determine the candidate annotation tag set.

[0165] The new log semantic elements are matched with the abnormal pattern type codes in the dynamic log annotation rule base. In a financial transaction system, if the new log semantic elements indicate that the operation has the characteristics of frequent large-amount transfers, and it successfully matches "abnormal pattern 001" in the dynamic log annotation rule base, the candidate annotation tag set is determined to include relevant annotation tags such as "frequent large-amount transfer anomaly".

[0166] Step 154: Sort the candidate label set according to the labeling priority rules, and select the label with the highest priority as the preliminary labeling result.

[0167] The candidate label set is sorted according to the labeling priority rule. In a financial transaction system, if the candidate label set contains two labels, "frequent large-amount abnormal transfers" and "small-amount abnormal operations," and the label "frequent large-amount abnormal transfers" has a higher priority, it is selected as the initial labeling result, thereby highlighting high-risk abnormal situations.

[0168] Step 155: When multiple labels with the same priority exist in the candidate label set, causing a conflict, the label conflict resolution strategy is activated. The final label is determined by analyzing the contextual semantic features of the new log entry and historical label records.

[0169] When multiple candidate labels with the same priority cause a conflict, a label conflict resolution strategy is activated. In a financial trading system, if a new log entry matches both "abnormal pattern 001" and "abnormal pattern 002" with the same priority, the contextual semantic features of the new log entry, such as the operation time and operation object, as well as historical label records, are analyzed to determine which abnormal pattern the log entry better matches, thus determining the final label.

[0170] Step 156: Associate the final annotation label with the new log entry and store it to generate an annotation log entry.

[0171] The final labels are associated with the new log entries and stored accordingly. In financial transaction systems, final labels such as "frequent large-amount transfer anomalies" are associated with the corresponding new log entries to generate labeled log entries. This allows for the rapid identification of anomalies in log entries during subsequent auditing and analysis.

[0172] Step 157: Sampling and checking the labeled log entries based on a preset period to evaluate the labeling accuracy.

[0173] A sampling inspection of labeled log entries is conducted based on a preset period. In financial trading systems, a certain number of labeled log entries are randomly selected for inspection at regular intervals. The accuracy of the labels is determined through manual review or other verification methods, and the labeling accuracy rate is calculated, for example, the proportion of accurately labeled log entries to the total number of sampled log entries.

[0174] Step 158: When the annotation accuracy is lower than the preset threshold, the update process of the dynamic log annotation rule base is triggered to retrain the abnormal pattern recognition model and adjust the mapping relationship.

[0175] When the annotation accuracy falls below a preset threshold, the dynamic log annotation rule base update process is triggered. In financial trading systems, if the annotation accuracy is below the set threshold, it indicates that there may be inaccuracies in the dynamic log annotation rule base. The anomaly pattern recognition model is retrained to more accurately identify anomaly patterns, and the mapping relationship between anomaly pattern type encoding and annotation labels is adjusted to ensure annotation accuracy.

[0176] Step 159: Apply the updated dynamic log annotation rule base to the log annotation process to achieve adaptive optimization of log annotation.

[0177] The updated dynamic log annotation rule base is applied to the log annotation process. In the financial trading system, the updated rule base is used to annotate newly generated national cryptographic log entries. By continuously updating and applying the rule base, adaptive optimization of log annotation is achieved, making the annotation results more accurate and reliable.

[0178] In a non-limiting embodiment, the national cryptographic log auditing system is further configured to perform the following steps: Step 161: Conduct in-depth analysis of the evidence chain association graph of violations in the national cryptographic log security audit result set, and extract key evidence nodes and evidence association paths.

[0179] In the scenario of auditing national cryptographic logs in financial transaction systems, in-depth analysis is conducted on the correlation graph of violation evidence chains in the national cryptographic log security audit results set. By analyzing the nodes and edges in the graph, key evidence nodes are extracted. For example, in a graph concerning illegal fund transfers, the log entry node indicating an abnormal transfer initiated by a user may be a key evidence node. Simultaneously, evidence correlation paths are determined, that is, the paths formed by directed edges from the main evidence node to each auxiliary evidence node. These paths clearly demonstrate the correlation between the evidence.

[0180] Step 162: Construct a log audit knowledge graph based on the key evidence nodes. The log audit knowledge graph includes entity nodes, relationship edges, and attribute information. Entity nodes include types such as operation subjects, operation objects, and abnormal patterns. Relationship edges represent the association between entities. Attribute information includes descriptive features of nodes.

[0181] A knowledge graph for log auditing is constructed based on key evidence nodes. In financial transaction systems, entity nodes include operating subjects, such as users; operating objects, such as accounts; and abnormal patterns, such as "frequent large-amount transfer anomalies." Relationship edges represent the associations between entities; for example, there is an "operation" relationship between users and accounts, and a "trigger" relationship between users and abnormal patterns. Attribute information contains descriptive features of nodes, such as user identity information and account balance information. By constructing this knowledge graph, various information and relationships in the national cryptographic logs can be more comprehensively displayed.

[0182] Step 163: Collect log data from multi-source national cryptographic application systems, standardize the data, and unify the log entry format and semantic element extraction rules.

[0183] Collect log data from multiple national cryptographic application systems. Financial transaction systems may contain national cryptographic application systems for different business modules; collect the log data generated by these systems. Standardize this log data, unifying the log entry format, such as specifying the location and format of fields like the operation subject and operation object; unify semantic element extraction rules to ensure that log data from different systems can be extracted for semantic elements in the same way.

[0184] Step 164: Perform entity matching between the standardized multi-source log data and the log audit knowledge graph to establish cross-system log entity associations.

[0185] Standardized multi-source log data is matched against a log audit knowledge graph. In financial transaction systems, entities such as the operating subjects and objects in the log data of different business modules are matched with entity nodes in the log audit knowledge graph. If user information in a log file successfully matches a user entity node in the knowledge graph, a cross-system log entity association is established. This allows for the integration of multi-source log data and the discovery of relationships between different systems.

[0186] Step 165: Discover hidden relationships in cross-system log data through association rule mining algorithms and add them to the relationship edges of the log audit knowledge graph.

[0187] Hidden relationships in cross-system log data are discovered through association rule mining algorithms. In financial trading systems, association rule mining algorithms are used to analyze multi-source log data to uncover hidden relationships such as the order of operations between different business modules and the user's operational preferences across different systems. These hidden relationships are then added to the relation edges of the log audit knowledge graph, making the knowledge graph more complete.

[0188] Step 166: Based on the expanded log audit knowledge graph, perform anomaly prediction processing on newly generated national cryptographic log entries to identify potential cross-system collaborative anomalies.

[0189] Based on the expanded log auditing knowledge graph, anomaly prediction processing is performed on newly generated national cryptographic log entries. In the financial transaction system, when a new log entry is generated, the entity relationships and association rules in the knowledge graph are used to determine whether there are potential cross-system collaborative anomalies. For example, if a user's actions in multiple business modules do not conform to normal association relationships, there may be potential anomalies.

[0190] Step 167: When potential abnormal behavior is predicted, generate an early warning message and push it to the audit terminal.

[0191] When potential abnormal behavior is predicted, an early warning message is generated and pushed to the audit terminal. In a financial transaction system, if an abnormal correlation is found between a user's fund operations in different business modules, an early warning message is generated, such as "User [username] may have engaged in cross-system fund violations," and this information is pushed to the auditor's terminal for timely handling.

[0192] Step 168: Perform entity fusion and relationship deduplication on the log audit knowledge graph based on a preset period to optimize the structural integrity and accuracy of the knowledge graph.

[0193] Based on a preset cycle, entity fusion and relationship deduplication are performed on the log audit knowledge graph. In the financial transaction system, entity nodes and relationship edges in the knowledge graph are checked at regular intervals. Duplicate entity nodes are merged, for example, merging two nodes representing the same user into one; duplicate relationship edges are deduplicated to optimize the structural integrity and accuracy of the knowledge graph, ensuring that the knowledge graph can accurately reflect the information and relationships in the national cryptographic logs.

[0194] Step 169: Apply the optimized log auditing knowledge graph to the in-depth auditing analysis of national cryptographic logs.

[0195] The optimized log auditing knowledge graph is applied to in-depth auditing analysis of national cryptographic logs. In financial transaction systems, the optimized knowledge graph is used to conduct more in-depth analysis of newly collected national cryptographic logs, uncovering more potential abnormal behaviors and correlations, thereby improving the efficiency and accuracy of national cryptographic log auditing.

[0196] The national cryptographic log auditing system of this invention comprehensively collects the operation behavior record sequence during the operation of the national cryptographic application system during the data acquisition phase. This includes the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process, reflecting the true state of system operation and operational details. Then, the operation behavior record sequence is deeply analyzed to obtain the semantic element extraction results of each log entry and the semantic dependencies between adjacent log entries. The semantic element extraction results include operation intent category identifiers, resource permission matching features, and state transition sequence features, which can accurately depict the essence and characteristics of the operation; the semantic dependencies reveal the close connection between different log entries at the business logic level, enabling auditors to understand log data from a semantic perspective, uncover the business logic and potential risks hidden behind the data, and improve the understanding and analysis capabilities of log data. Further multi-level compliance verification processing, based on the national cryptographic security audit rule system, comprehensively verifies the semantic element extraction results and semantic dependencies, generating compliance judgment conclusions at the log entry level and abnormal behavior pattern identification reports at the cross-entry level. The compliance assessment results clearly define whether each log entry is compliant and the risk points of non-compliance, providing a basis for timely detection and correction of violations. The abnormal behavior pattern identification report identifies potential abnormal behavior patterns through abnormal pattern type coding and the temporal distribution characteristics of pattern occurrence, which helps to provide early warning and prevent security risks. The multi-level verification method can ensure the comprehensiveness and accuracy of the audit, effectively avoiding missed detections and misjudgments.

[0197] Finally, based on the compliance assessment conclusions and the abnormal behavior pattern identification report, a national cryptographic log security audit result set is constructed, including risk level assessment results, violation evidence chain correlation graphs, and a security hardening strategy recommendation list. The risk level assessment results intuitively reflect the degree of risk in the national cryptographic logs, helping auditors quickly determine risk priorities; the violation evidence chain correlation graph clearly displays the evidence chain of violations, providing strong evidentiary support for investigating and handling violations; and the security hardening strategy recommendation list provides targeted security hardening measures based on the identified risks and abnormal patterns, enabling timely remediation of security vulnerabilities and improving the security of national cryptographic application systems.

[0198] In conclusion, this national cryptographic log auditing system has comprehensively improved the quality and efficiency of national cryptographic log auditing.

[0199] Furthermore, Figure 2 A structural block diagram of the national cryptographic log auditing system 300 is shown, including: a memory 310 for storing program instructions and data; and a processor 320 for coupling with the memory 310 to execute the instructions in the memory 310 to implement the above-mentioned method.

[0200] Furthermore, a computer storage medium is also provided, comprising instructions that, when executed on a processor, implement the above-described method.

[0201] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A national cryptographic log auditing system, characterized in that, include: Memory is used to store program instructions and data; A processor, coupled to memory, executes instructions in said memory to implement the following method: The system collects a sequence of operation behavior records generated during the operation of the national cryptographic application system. The sequence of operation behavior records consists of log entries generated in chronological order. Each log entry contains the authentication information of the operation initiator, the resource access path information of the operation target object, and the state transition description information of the operation execution process. The operation behavior record sequence is subjected to contextual semantic association parsing to obtain the semantic element extraction result of each log entry and the semantic dependency relationship between adjacent log entries. The semantic element extraction result includes operation intention category identifier, resource permission matching feature and state transition sequence feature. The semantic dependency relationship is used to characterize the degree of association between different log entries at the business logic level. Based on the national cryptographic security audit rule system, the semantic element extraction results and semantic dependencies are subjected to multi-level compliance verification processing to generate log entry-level compliance judgment conclusions and cross-entry-level abnormal behavior pattern identification reports. The compliance judgment conclusions include compliance status labels and non-compliance risk point descriptions, and the abnormal behavior pattern identification reports include abnormal pattern type codes and temporal distribution characteristics of pattern occurrence. Based on the compliance judgment conclusions and abnormal behavior pattern identification reports, a national cryptographic log security audit result set is constructed. The national cryptographic log security audit result set includes risk level assessment results, violation evidence chain association graphs, and a list of security hardening strategy recommendations. The process of performing contextual semantic association parsing on the operation behavior record sequence to obtain the semantic element extraction results of each log entry and the semantic dependencies between adjacent log entries includes: The structured semantic parsing is performed on each log entry in the operation behavior record sequence to extract the text content of the operation subject field, operation object field, operation type field and status description field; The text content is processed by calling the national cryptographic semantic segmentation tool to perform domain-adaptive segmentation, generating a segmentation result set containing national cryptographic professional terms. Each segmentation unit in the segmentation result set carries a domain semantic tag. Based on the word segmentation result set, a semantic representation vector for log entries is constructed, and the dimension of the semantic representation vector corresponds to the number of domain semantic tag types in the word segmentation result set; Calculate the cosine similarity between the semantic representation vectors of adjacent log entries, and use the cosine similarity as the initial semantic dependency coefficient; Analyze the consistency characteristics of adjacent log entries in the operation subject field, operation object field, and operation type field, and perform weighted adjustment on the initial semantic dependency coefficient to generate a semantic dependency relationship that represents the degree of closeness of business logic association. The intent category identification process is performed on the word segmentation result set of each log entry to determine the operation intent category identifier; Extract terminology units related to resource permissions from the word segmentation result set to generate resource permission matching features; The text content of the state description field is converted into state transition sequence features, which include a state type sequence and a state transition probability distribution. By integrating the operation intent category identifier, resource permission matching features, and state transition sequence features, semantic element extraction results are generated for each log entry.

2. The national cryptographic log auditing system as described in claim 1, characterized in that, The semantic element extraction results and semantic dependencies are processed through multi-level compliance verification based on the national cryptographic security audit rule system, generating compliance judgment conclusions at the log entry level and abnormal behavior pattern identification reports at the cross-entry level, including: Load a subset of rules that matches the current audit scenario from the national cryptographic security audit rule system. The subset of rules includes basic compliance rules, business logic rules, and anomaly detection rules. The semantic element extraction results of each log entry are matched and verified against the basic compliance rules one by one to generate preliminary compliance judgment results at the log entry level; Based on the semantic dependency relationship, the preliminary compliance judgment results of adjacent log entries are correlated and verified to correct the misjudgment results caused by isolated verification and obtain the final compliance judgment conclusion. Risk point extraction processing is performed on the log entries marked as non-compliant in the compliance judgment conclusion to generate a description of non-compliant risk points; The operation behavior record sequence is divided into multiple behavior pattern sequence units according to semantic dependencies. Each behavior pattern sequence unit consists of consecutive log entries whose semantic dependencies satisfy a preset threshold. The semantic element extraction results of each behavioral pattern sequence unit are input into a preset abnormal pattern recognition model for pattern matching processing. When a known abnormal pattern is matched in the abnormal pattern recognition model, the corresponding abnormal pattern type code is recorded. Perform temporal distribution statistical processing on the matched abnormal pattern type encoding to generate temporal distribution features of pattern occurrence; By integrating the abnormal pattern type encoding and time series distribution features, an abnormal behavior pattern recognition report is generated across entries.

3. The national cryptographic log auditing system as described in claim 2, characterized in that, The step of matching and verifying the semantic element extraction results of each log entry with the basic compliance rules one by one to generate preliminary compliance judgment results at the log entry level includes: Parse the rule condition expressions and rule conclusions in the basic compliance rules, and construct a rule matching tree structure; The operation intent category identifier in the semantic element extraction result of the log entry is matched with the root node of the rule matching tree to determine the candidate rule branch; Extract the resource permission matching feature verification conditions corresponding to the candidate rule branches, and compare the resource permission matching features of the log entries with the verification conditions; When the resource permission matching feature meets the verification conditions, continue matching the next level node of the rule matching tree; otherwise, mark it as potentially non-compliant. The final verification is performed on the state transition sequence features corresponding to the leaf nodes of the rule matching tree to determine whether the state transition sequence features meet the state constraints in the rule conclusion. When all rule conditions at all levels are met, a compliance status label is generated; when the rule conditions at any level are not met, a non-compliance status label is generated, and the number of the non-met rule condition is recorded. The compliance status label or non-compliance status label is combined with the rule condition number to generate a preliminary compliance determination result at the log entry level.

4. The national cryptographic log auditing system as described in claim 2, characterized in that, The step of inputting the semantic element extraction results of each behavioral pattern sequence unit into a preset abnormal pattern recognition model for pattern matching processing includes: The semantic element extraction results of all log entries contained in the behavior pattern sequence unit are subjected to time-series splicing processing to generate a sequence-level semantic feature vector; The sequence-level semantic feature vectors are subjected to dimensionality normalization to match the input dimension of the abnormal pattern recognition model. The standardized sequence-level semantic feature vector is input into the feature extraction layer of the abnormal pattern recognition model to extract local pattern features and global trend features from the sequence. The local pattern features and global trend features are input into the pattern matching layer of the abnormal pattern recognition model, and similarity is calculated with the known abnormal pattern feature library stored in the model. When the calculated similarity value exceeds the preset matching threshold, the match is considered successful, and the corresponding abnormal pattern type code is output. When the calculated similarity value does not exceed the preset matching threshold, the sequence-level semantic feature vector is input into the anomaly evaluation layer of the anomaly pattern recognition model to calculate the anomaly score of the sequence. When the anomaly score exceeds the anomaly threshold, it is marked as an unknown anomaly pattern, and a special anomaly pattern type code is generated. The successfully matched exception pattern type code or special exception pattern type code is used as the output of the pattern matching process.

5. The national cryptographic log auditing system as described in claim 1, characterized in that, The process of constructing a national cryptographic log security audit result set based on the compliance judgment conclusion and the abnormal behavior pattern identification report includes: Extract descriptions of non-compliance risk points from the compliance assessment conclusions and determine the severity level of each non-compliance risk point; Extract the abnormal pattern type code from the abnormal behavior pattern recognition report, query the preset pattern threat level mapping table, and determine the threat level of each abnormal pattern; A risk assessment matrix is ​​constructed based on the severity level and threat level, and a comprehensive risk index is calculated. The risk level assessment result is determined based on the comprehensive risk index. Using the semantic dependencies as a link, log entries associated with the same non-compliance risk point or abnormal pattern are chained together to construct a violation evidence chain association graph; the violation evidence chain association graph includes main evidence nodes, auxiliary evidence nodes, and evidence association strength; Retrieve security hardening strategies that match the anomaly pattern type encoding from the national cryptographic security protection strategy database; Based on the specific details of the non-compliance risk points described, the retrieved security hardening strategies were screened and adjusted. The adjusted security hardening strategies are sorted by implementation priority to generate a list of security hardening strategy recommendations. By integrating the risk level assessment results, the evidence chain correlation diagram of violations, and the security hardening strategy recommendation list, a set of national cryptographic log security audit results is generated.

6. The national cryptographic log auditing system as described in claim 5, characterized in that, The process of constructing a risk assessment matrix based on the severity level and threat level, and calculating a comprehensive risk index, includes: The severity level is divided into multiple quantitative levels, and each quantitative level corresponds to a severity score; The threat level is divided into multiple quantitative levels, and each quantitative level corresponds to a threat level score. Construct a risk assessment matrix with severity scores as rows and threat level scores as columns; Based on the preset risk calculation rules, each cell in the risk assessment matrix is ​​assigned a corresponding basic risk index value. Obtain the risk sensitivity coefficient for the current audit scenario, wherein the risk sensitivity coefficient is determined based on the importance of the national cryptographic application system; The adjusted risk index is obtained by weighting the base value of the risk index with the risk sensitivity coefficient. The adjusted risk indices corresponding to all non-compliance risk points and abnormal patterns are summed to generate a comprehensive risk index. The comprehensive risk index is compared with a preset risk level threshold to determine the final risk level assessment result.

7. The national cryptographic log auditing system as described in claim 5, characterized in that, The process of linking log entries associated with the same non-compliance risk point or abnormal pattern using the semantic dependency relationship to construct a violation evidence chain association graph includes: Log entries marked as non-compliant or associated with abnormal patterns are identified as primary evidence nodes; Based on the semantic dependencies, log entries directly associated with the main evidence node are identified as primary auxiliary evidence nodes; Continue searching for log entries associated with the primary auxiliary evidence nodes as secondary auxiliary evidence nodes, and so on, until the semantic dependency is lower than the preset threshold; Calculate the semantic dependency strength between the main evidence node and each auxiliary evidence node, and use it as the evidence association strength; Add node attribute information to each evidence node, which includes log entry timestamps, operation subject identity verification information, and compliance judgment conclusions; A directed graph structure is used to represent the relationships between evidence nodes, and the weight of the directed edge is the evidence association strength. Redundant nodes are pruned from the constructed directed graph structure, and auxiliary evidence nodes whose evidence association strength is lower than a set threshold are removed. The cropped directed graph structure is visualized and laid out to generate a chain of evidence of violations that includes node hierarchy and association strength.

8. The national cryptographic log auditing system as described in claim 5, characterized in that, The step of retrieving a security hardening strategy from the national cryptographic security protection strategy library that matches the anomaly pattern type code includes: Parse the abnormal pattern type code and extract the core feature identifier of the pattern; Construct a set of search keywords based on the core feature identifiers of the pattern; The policy documents in the national cryptographic security protection policy library are preprocessed to establish a policy keyword index table; The search keyword set is used to perform fuzzy matching search in the strategy keyword index table to obtain a preliminary matching set of strategy documents; Content similarity is calculated for the initially matched set of policy documents, and the content similarity is determined based on the semantic overlap between the policy documents and the descriptions of abnormal patterns; The policy document set is sorted from high to low according to content similarity, and a preset number of policy documents at the top of the sort are selected as candidate security hardening policies. Extract the implementation condition descriptions from candidate security hardening strategies and match and verify them with the operating environment characteristics of the current national cryptographic application system; Candidate security hardening strategies that do not match the implementation conditions are filtered out, and security hardening strategies that match the anomaly pattern type encoding are obtained.

9. The national cryptographic log auditing system as described in claim 5, characterized in that, The process of filtering and adjusting the retrieved security hardening strategies based on the specific content of the description of the non-compliance risk points includes: Keyword extraction was performed on the descriptions of the non-compliance risk points to identify the core risk elements; The retrieved security hardening strategies are decomposed into multiple strategy units, each of which contains specific protection measures and descriptions of applicable scenarios. The core risk elements are semantically matched with the applicable scenario descriptions of each strategy unit to filter out the strategy units that match the applicable scenarios. Analyze the logical relationships between the selected strategy units to identify conflicting or duplicate strategy content; For strategy units with conflicting objectives, priority is determined based on the risk level assessment results, and strategy units with higher priority are retained. Duplicate strategy units are merged to simplify the strategy content; Based on the specific technical details in the description of non-compliance risk points, the parameters of the protective measures for the retained strategy units are adjusted to adapt them to the current risk scenario; By integrating and adjusting the strategy units, a security hardening strategy is generated targeting the current non-compliance risk points.

Images