Log caching method, log query method, device and equipment

Abstract

The embodiment of the invention provides a log caching method, a log query method, a log query device and log query equipment, which are used for solving the problems of long query response time and low cache hit rate caused by a caching mode in the prior art. The log caching method comprises the steps of performing feature extraction on preset type parameters in log data to obtain a first fusion feature, and predicting a first probability of querying the log data in N future time windows based on duration features of the N future time windows and the first fusion feature, and determining a target cache strategy in combination with the risk level and storing the target cache strategy in a corresponding storage device. Through the method, the high-risk logs which are easy to query can obtain the preferential cache resources, so that a faster query response can be realized during subsequent query, more reasonable resource allocation can be ensured, and the query hit rate of the logs in the cache is improved.

Description

Technical Field

[0001] This application relates to the field of data caching and querying technology, and in particular to a log caching method, log querying method, apparatus and device. Background Technology

[0002] In existing technologies, log processing is typically stored chronologically in a distributed file system or time-series database, employing a partitioning and sharding strategy to manage massive amounts of log data. When a user queries the logs, the system scans the corresponding data partitions based on the query conditions and returns matching results. Another mechanism is to create an index based on the log generation time, supporting time-range queries. Furthermore, existing technologies often employ a simple LRU caching strategy, caching the results of most recently queried logs in memory. Caching strategies are primarily based on the access frequency of query results, without considering the semantic features and business relevance of the log content.

[0003] However, storing logs according to a set time interval can lead to long query response times. When a security incident occurs and requires tracing and analysis, a large number of related logs need to be queried, and the query response time will affect the efficiency of emergency response. In addition, the traditional LRU caching strategy can only cache log data that has been queried. When a new security incident occurs and log data needs to be queried, it cannot retrieve log data from the cache, resulting in a low log hit rate in the memory cache.

[0004] Therefore, a new log caching method is urgently needed to overcome the above problems. Summary of the Invention

[0005] This application provides a log caching method, log query method, apparatus, and device to solve the problems of long query response time and low cache hit rate caused by existing caching methods.

[0006] In a first aspect, embodiments of this application provide a log caching method, the method comprising:

[0007] Obtain the log dataset to be stored, and perform the following operations for each log data in the log dataset:

[0008] Extract preset type parameters from the log data, where the preset types include domain type, time type, and risk type;

[0009] Feature extraction is performed on the preset type parameters to obtain the first fused feature;

[0010] For any one of the preset N future time windows, the following steps are performed: based on the duration feature of the any one future time window and the first fusion feature, predict the first probability of querying the log data within the future time window; where N≥1 and N is a positive integer, and the duration feature is the time period length information corresponding to the any one future time window;

[0011] Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0012] The log data is stored in the storage device corresponding to the target caching policy, and the association between the log data and the storage device is established.

[0013] In one possible implementation, establishing the association between the log data and the storage device includes:

[0014] Determine the path identifier of the log data in the storage device;

[0015] Determine the key value of the log data, and add the key value, the device identifier of the storage device, and the path identifier to the metadata of the log data to establish the association between the log data and the storage device.

[0016] In one possible implementation, determining the target caching strategy for the log data based on the first probabilities corresponding to the N future time windows and the risk level of the log data includes:

[0017] For each future time window, perform the following: determine the target value range within which the first probability falls within a range of M values;

[0018] Based on the target value range corresponding to each first probability and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0019] In one possible implementation, storing the log data in the storage device corresponding to the target caching policy includes:

[0020] Based on the correlation between caching strategies and storage media types, the target storage type corresponding to the target caching strategy is determined;

[0021] The log data is stored in the storage device corresponding to the target storage type.

[0022] In one possible implementation, predicting the first probability of querying the log data within the future time window based on the duration feature of any future time window and the first fused feature includes:

[0023] The duration feature of any future time window and the first fusion feature are input into the query prediction model, and the first probability of querying the log data within the future time window is predicted by the query prediction model.

[0024] The query prediction model is obtained in the following way:

[0025] Obtain a training sample set, which includes multiple training samples. Each training sample includes sample log data and sample labels. The sample labels include multiple sub-labels. Each sub-label is used to represent the query result of querying the sample log data within a corresponding set time window.

[0026] The initial network model is trained multiple times based on the training sample set until the set conditions are met, at which point the training stops and the query prediction model is obtained.

[0027] In each round of training, the following operations are performed:

[0028] For each training sample in the training sample set, the following steps are performed: feature extraction and concatenation are performed based on preset type parameters in the sample log data to obtain concatenated features; the concatenated features and duration features corresponding to multiple historical time windows are input into the network model output from the previous round, and the predicted probability set for querying the training sample within the multiple historical time windows is predicted based on the network model output from the previous round; wherein, the predicted probability set includes multiple second probabilities, each second probability representing the probability of querying the training sample within the corresponding historical time window;

[0029] For each historical time window, the following steps are performed: based on the second probability and sample label of each training sample for the future time window, a first loss value, a ranking loss value, and a sparsity loss value are determined respectively, and the first loss value, the ranking loss value, and the sparsity loss value are weighted to obtain the target loss;

[0030] The total loss is obtained by weighting the target losses corresponding to the multiple future time windows.

[0031] The parameters of the network model in the previous round are adjusted based on the total loss to obtain the network model in the current round.

[0032] Secondly, embodiments of this application provide a log query method, the method comprising:

[0033] In response to a query operation targeting the target log data, the target storage device associated with the target log data is determined based on the association between the log data and the storage device.

[0034] Query the target log data from the storage device;

[0035] The association between the log data and the storage device is established after the log data is stored in the storage device. The target storage device is determined based on the target storage strategy, which is determined based on the risk level of the target log data and the first probability of querying the target log data within N future time windows.

[0036] In one possible implementation, when the association between the log data and the storage device is established by adding the log data's key value, the storage device's device identifier, and the path identifier to the log data's metadata, the querying of the storage device based on the association includes:

[0037] In response to a query operation on the target log data, the target key value corresponding to the target log data is determined;

[0038] Determine the target metadata containing the target key value, and from the target metadata, determine the target device identifier and the target path identifier;

[0039] The target storage device corresponding to the target device identifier is determined, and the first log data is obtained from the path indicated by the target path identifier in the target storage device.

[0040] Thirdly, embodiments of this application provide a log caching device, including:

[0041] The acquisition module is used to acquire the log dataset to be stored, and performs the following operations for each log data in the log dataset:

[0042] The processing module is used to extract preset type parameters from the log data, wherein the preset types include domain type, time type and risk type;

[0043] Feature extraction is performed on the preset type parameters to obtain the first fused feature;

[0044] For any one of the preset N future time windows, the following steps are performed: based on the duration feature of the any one future time window and the first fusion feature, predict the first probability of querying the log data within the future time window; where N≥1 and N is a positive integer, and the duration feature is the time period length information corresponding to the any one future time window;

[0045] Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0046] The log data is stored in the storage device corresponding to the target caching policy, and the association between the log data and the storage device is established.

[0047] In one possible implementation, the processing module, when establishing the association between the log data and the storage device, is specifically used for:

[0048] Determine the path identifier of the log data in the storage device;

[0049] Determine the key value of the log data, and add the key value, the device identifier of the storage device, and the path identifier to the metadata of the log data to establish the association between the log data and the storage device.

[0050] In one possible implementation, when determining the target caching strategy for the log data based on the first probabilities corresponding to the N future time windows and the risk level of the log data, the processing module is specifically used for:

[0051] For each future time window, perform the following: determine the target value range within which the first probability falls within a range of M values;

[0052] Based on the target value range corresponding to each first probability and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0053] In one possible implementation, the processing module, in storing the log data in the storage device corresponding to the target caching policy, specifically performs the following:

[0054] Based on the correlation between caching strategies and storage media types, the target storage type corresponding to the target caching strategy is determined;

[0055] The log data is stored in the storage device corresponding to the target storage type.

[0056] In one possible implementation, when the processing module predicts the first probability of querying the log data within the future time window based on the duration feature of any future time window and the first fusion feature, it is specifically used for:

[0057] The duration feature of any future time window and the first fusion feature are input into the query prediction model, and the first probability of querying the log data within the future time window is predicted by the query prediction model.

[0058] The query prediction model is obtained in the following way:

[0059] Obtain a training sample set, which includes multiple training samples. Each training sample includes sample log data and sample labels. The sample labels include multiple sub-labels. Each sub-label is used to represent the query result of querying the sample log data within a corresponding set time window.

[0060] The initial network model is trained multiple times based on the training sample set until the set conditions are met, at which point the training stops and the query prediction model is obtained.

[0061] In each round of training, the following operations are performed:

[0062] For each training sample in the training sample set, the following steps are performed: feature extraction and concatenation are performed based on preset type parameters in the sample log data to obtain concatenated features; the concatenated features and duration features corresponding to multiple historical time windows are input into the network model output from the previous round, and the predicted probability set for querying the training sample within the multiple historical time windows is predicted based on the network model output from the previous round; wherein, the predicted probability set includes multiple second probabilities, each second probability representing the probability of querying the training sample within the corresponding historical time window;

[0063] For each historical time window, the following steps are performed: based on the second probability and sample label of each training sample for the future time window, a first loss value, a ranking loss value, and a sparsity loss value are determined respectively, and the first loss value, the ranking loss value, and the sparsity loss value are weighted to obtain the target loss;

[0064] The total loss is obtained by weighting the target losses corresponding to the multiple future time windows.

[0065] The parameters of the network model in the previous round are adjusted based on the total loss to obtain the network model in the current round.

[0066] Fourthly, embodiments of this application provide a log query device, including:

[0067] The processing module is used to respond to query operations on target log data and determine the target storage device associated with the target log data based on the association between the log data and the storage device.

[0068] The query module is used to query the target log data from the storage device;

[0069] The association between the log data and the storage device is established after the log data is stored in the storage device. The target storage device is determined based on the target storage strategy, which is determined based on the risk level of the target log data and the first probability of querying the target log data within N future time windows.

[0070] In one possible implementation, when the association between the log data and the storage device is established by adding the log data's key value, the storage device's device identifier, and the path identifier to the log data's metadata, the query module, when querying the storage device based on the association, specifically performs the following:

[0071] In response to a query operation on the target log data, the target key value corresponding to the target log data is determined;

[0072] Determine the target metadata containing the target key value, and from the target metadata, determine the target device identifier and the target path identifier;

[0073] The target storage device corresponding to the target device identifier is determined, and the first log data is obtained from the path indicated by the target path identifier in the target storage device.

[0074] Fifthly, embodiments of this application provide a computer device, including:

[0075] Memory, used to store program instructions;

[0076] A processor is configured to acquire program instructions from the memory and execute the methods described in the first aspect and different implementations, as well as the methods described in the second aspect and different implementations, according to the acquired program instructions.

[0077] In a sixth aspect, embodiments of this application provide a computer-readable storage medium including computer instructions that, when executed by a computer, implement the methods described in the first aspect and different implementations, as well as the methods described in the second aspect and different implementations.

[0078] The beneficial effects of this application are as follows:

[0079] This application uses domain name, time, and risk characteristics to predict log data queries at different time scales. This allows for the determination of the varying urgency levels of the log data being queried, and the appropriate storage medium is determined based on the risk level. This ensures that high-risk log data, which is frequently queried, receives priority caching resources. This caching method leads to faster query responses, more rational resource allocation, and improved cache hit rate. Attached Figure Description

[0080] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0081] Figure 1 A flowchart illustrating a log caching method provided in an embodiment of this application;

[0082] Figure 2 A schematic diagram illustrating the determination of a first probability provided in an embodiment of this application;

[0083] Figure 3 A flowchart illustrating a log query method provided in an embodiment of this application;

[0084] Figure 4 A schematic diagram illustrating a log caching and query process provided in an embodiment of this application;

[0085] Figure 5 This is a schematic diagram of the structure of a log caching device provided in an embodiment of this application;

[0086] Figure 6 This is a schematic diagram of the structure of a log query device provided in an embodiment of this application;

[0087] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0088] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0089] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0090] In existing technologies, log processing is typically stored chronologically in a distributed file system or time-series database, employing a partitioning and sharding strategy to manage massive amounts of log data. When a user queries the logs, the system scans the corresponding data partitions based on the query conditions and returns matching results. Another mechanism is to create an index based on the log generation time, supporting time-range queries. Furthermore, existing technologies often employ a simple LRU caching strategy, caching the results of most recently queried logs in memory. Caching strategies are primarily based on the access frequency of query results, without considering the semantic features and business relevance of the log content.

[0091] However, storing logs according to a set time interval can lead to long query response times. When a security incident occurs and requires tracing and analysis, a large number of related logs need to be queried, and the query response time will affect the efficiency of emergency response. In addition, the traditional LRU caching strategy can only cache log data that has been queried. When a new security incident occurs and log data needs to be queried, it cannot retrieve log data from the cache, resulting in a low log hit rate in the memory cache.

[0092] To address the aforementioned issues, this application provides a log caching method, a log querying method, an apparatus, and a device. The log caching method includes: extracting features from preset type parameters in log data to obtain a first fusion feature; predicting a first probability of querying log data within N future time windows based on the duration features of N future time windows and the first fusion feature; and determining a target caching strategy based on a risk level and storing it in a corresponding storage device. This method ensures that high-risk logs that are easily queried receive priority caching resources, resulting in faster query responses in subsequent queries, more reasonable resource allocation, and improved log query hit rate within the cache.

[0093] See Figure 1 The diagram shown is a flowchart of a log caching method provided in an embodiment of this application. The specific steps are as follows:

[0094] Step S101: Obtain the log dataset to be stored. For each log data in the log dataset, perform the following operations: Extract the preset type parameters from the log data. The preset types include domain type, time type, and risk type.

[0095] In some embodiments, data cleaning can be performed on each log data in the log dataset, and preset type parameters can be extracted from the cleaned log data.

[0096] Specifically, the log data may include the following fields: timestamp (processing timestamp), domain (domain name string), risk_level (risk level (0 = whitelist, 1 = low risk, 2 = medium risk, 3 = high risk)), action (processing action (block = block, vip = high protection, monitor = suspected malicious, allow = allow, etc.)), server (target recursive address of the request), client (client source address of the request), and source_ip (source IP network segment (de-identified)).

[0097] Furthermore, based on the log format, parameters for the domain name type, risk type, and time type of the log data can be extracted, namely, the parameters corresponding to the three fields of handling timestamp, domain name string, and risk level.

[0098] Step S102: Extract features from the preset type parameters to obtain the first fused feature.

[0099] In some scenarios, features can be extracted separately from the processing timestamp parameter, domain name string parameter, and risk level parameter. The extracted time features, domain name features, and risk features are then fused to obtain the first fused feature. Feature fusion can be feature concatenation or feature weighting; this application does not specifically limit this.

[0100] In some embodiments, domain name features may include, but are not limited to, the following features: character-level features, structural features, and semantic features. Character-level features can be represented by the ratio of the number of numeric characters to the total number of characters in the domain name string. Structural features can be represented by the number of specified characters in the string. For example, if the domain name string parameters include three "." characters, the structural features can be determined based on the number of "." characters. In some scenarios, semantic features can be obtained through feature extraction using embedding models (including but not limited to BERT, ChatGPT, etc.).

[0101] In some embodiments, time feature extraction may include periodic features, weekday features, and relative time features. Periodic features can be determined using hour_sin = sin(2π × timestamp.hour / 24). Weekday features are defined as follows: when the processing timestamp is a weekday, the weekday feature is 1; when the processing timestamp is a weekend, the weekday feature is 0. Furthermore, relative time features can be determined using time_since_last_query = timestamp - last_query_time.

[0102] Step S103: For any one of the preset N future time windows, perform the following: Based on the duration feature and the first fusion feature of any one future time window, predict the first probability of querying log data within the future time window.

[0103] Where N≥1 and N is a positive integer, the duration feature is the time period length information corresponding to any future time window.

[0104] As an example, a future time window is a set duration following the processing timestamp of the log data. For instance, if the processing timestamp of the log data is 10:00:00, then the future time window could be the next hour, i.e., 10:00:01-11:00:00. Different future time windows correspond to different durations, such as 1 hour, 6 hours, or 24 hours; this application does not specifically limit this.

[0105] Specifically, the duration feature of any future time window and the first fusion feature can be input into the query prediction model, and the first probability of querying log data within the future time window can be predicted through the query prediction model.

[0106] like Figure 2 As shown, taking N=3 as an example, there are 3 future time windows, with corresponding set durations of 1 hour, 6 hours and 24 hours in the future.

[0107] Furthermore, taking the processing timestamp of log data as 10:00:00 and the future time window as 10:00:01-11:00:00 as an example, the duration of the window can be used to extract features to obtain duration feature 1. Furthermore, duration feature 1 and the first fused feature can be input into the query prediction model to make a prediction and determine the first probability of querying log data within the future time window of 10:00:01-11:00:00.

[0108] Similarly, taking a future time window of 10:00:01-16:00:00 as an example, the duration of the window can be used to extract features, resulting in duration feature 2. Furthermore, duration feature 2 and the first fused feature can be input into the query prediction model to predict and determine the first probability of querying log data within the future time window of 10:00:01-16:00:00. Taking a future time window of 10:00:01-10:00:00 the next day as an example, the duration of the window can be used to extract features, resulting in duration feature 3. Furthermore, duration feature 3 and the first fused feature can be input into the query prediction model to predict and determine the first probability of querying log data within the future time window of 10:00:01-10:00:00 the next day.

[0109] Step S104: Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, determine the target caching strategy corresponding to the log data.

[0110] In some embodiments, the target caching strategy for the log data is determined based on the first probability corresponding to each of the N future time windows and the risk level of the log data. This can be determined in the following way:

[0111] For each future time window, perform the following: determine the target value range within which the first probability lies within a range of M values;

[0112] Based on the target value range corresponding to each first probability and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0113] Specifically, a corresponding caching strategy can be determined based on N initial probabilities and risk levels, as shown in the table below. The table illustrates caching strategies determined based on initial probabilities and risk levels for future time windows of 1 hour, 6 hours, and 24 hours:

[0114]

[0115]

[0116] In this table, L1 is a high-priority cache, L2 is a medium-priority cache, and L3 is a low-priority cache. For example, if the probability of querying log data 1 within the next hour is 0.5, the probability of querying log data 1 within the next 6 hours is 0.8, and the probability of querying log data 1 within the next 24 hours is 0.95, and the risk level corresponding to log data 1 is medium risk (referred to as medium-risk), then according to the table above, the corresponding storage strategy is L2, i.e., medium-priority cache.

[0117] Step S105: Store the log data in the storage device corresponding to the target caching policy, and establish the association between the log data and the storage device.

[0118] In some scenarios, the target storage type corresponding to the target caching strategy can be determined based on the correlation between caching strategies and storage media types. Furthermore, log data can be stored in the storage device corresponding to the target storage type.

[0119] As an example, the high-priority cache L1 is associated with memory, the medium-priority cache L2 is associated with solid-state drives (SSDs), and the low-priority cache L3 is associated with disks. Furthermore, when the target caching strategy is determined to be L2, log data can be stored on SSDs.

[0120] In some embodiments, the path identifier of the log data in the storage device can be determined. Further, the key value of the log data can be determined, and the key value, the device identifier of the storage device, and the path identifier can be added to the metadata of the log data to establish the association between the log data and the storage device.

[0121] In other embodiments, a key value for the log data may be determined, and the key value, the device identifier of the storage device, and the timestamp of the log data may be added to the metadata of the log data to establish an association between the log data and the storage device.

[0122] In some embodiments, the cache space can be configured with a ratio of historical query data to predicted data. For example, historical query data might occupy 60% of the space, while predicted data (log data predicted to be queried but not yet queried) might occupy 40%. When space is insufficient, log data with low query probability and low-risk historical data are deleted first, while 20% of the memory cache space is reserved for caching log data related to sudden security events. For memory, 20% of the space can be reserved initially, and then the remaining 80% can be allocated according to the ratio of historical query data to predicted data. For example, using the 6:4 allocation method described above, historical query data would be allocated 48% of the space, and predicted data would be allocated 32%.

[0123] In some embodiments, the query prediction model is obtained as follows:

[0124] First, obtain the training sample set. The training sample set includes multiple training samples. Each training sample includes sample log data and sample labels. The sample labels include multiple sub-labels, each of which represents the query result of querying the sample log data within a corresponding set time window.

[0125] In some embodiments, a historical observation window and a time window can be set, and the log data within the historical observation window can be cleaned to obtain sample log data for the training samples. As an example, assuming the historical observation window is 168 hours, the log data is deduplicated based on the (timestamp, domain, server, client, action) tuple. Further, historical query data is queried, and the sample label corresponding to each sample log data is determined based on the historical query data. Specifically, query records can be extracted from the query logs, including the following fields: query_time: query timestamp; queried_domain: the domain name being queried. If the time window includes three windows, T1 = 1 hour, T6 = 6 hours, and T24 = 24 hours, the sample label corresponding to each log data can be determined based on the query timestamp and the queried domain name in the query record.

[0126] For example, if the domain name of the sample log data is 1 and the processing timestamp is 10:00:00, and it is determined that there is a query record with domain name 1 in the query log and the query timestamp is 14:40:00, then the sample label corresponding to the log sample data can be determined to be (0,1,1). Here, 0 indicates that the sample log data has not been queried within 1 hour from the time the sample log data was generated, and (1,1) indicates that the sample log data has been queried within 6 hours and 24 hours from the time the sample log data was generated.

[0127] Furthermore, the initial network model can be trained multiple times based on the training sample set until training stops when a set condition is met, thus obtaining the query prediction model. The set condition can be that the number of training rounds meets a set round threshold, or that the loss value is less than a set loss threshold.

[0128] Specifically, in each round of training, the following operations are performed:

[0129] For each training sample in the training sample set, the following steps are performed: feature extraction and concatenation are performed based on preset type parameters in the sample log data to obtain concatenated features; the concatenated features and duration features corresponding to multiple historical time windows are input into the network model output from the previous round, and the predicted probability set for querying training samples within multiple historical time windows is predicted based on the network model output from the previous round. The predicted probability set includes multiple second probabilities, each representing the probability of querying training samples within the corresponding historical time window. In the first round of training, the network model output from the previous round is the initial network model.

[0130] Specifically, domain name features, time features, and risk features are extracted from the sample log data, and then concatenated to obtain concatenated features.

[0131] In some embodiments, the sample log data can be sorted chronologically. Furthermore, the sample data can be encoded using absolute location encoding and event-aware location encoding.

[0132] The absolute position encoding can include sine position encoding / cosine position encoding, which are represented as follows:

[0133]

[0134] Where pos represents the index position of the sample log data, and i represents the index dimension.

[0135] Furthermore, the event intensity function can be expressed as:

[0136]

[0137] Where λ is the time decay factor, used to capture the impact of the time of security events on query patterns, for example, λ = 0.1, t j Let be the time when event j occurs.

[0138] Furthermore, the absolute position encoding, event intensity encoding, splicing features, and duration features of the set time window can be input into the network model output from the previous round, so as to predict the prediction probability set of the query sample log data within multiple historical time windows through the network model output from the previous round.

[0139] Specifically, the network model in this application can be implemented using a multi-head self-attention mechanism, constructing an attention mechanism capable of simultaneously focusing on multiple time scales and query patterns, and automatically learning the query association patterns of different types of security events. Different attention heads are used for different tasks. For example, heads 1-2 are short-term association attention, focusing on query associations within 1 hour; heads 3-4 are medium-term event attention, focusing on security event associations within 6 hours; heads 5-6 are long-term periodic attention, focusing on security event associations within 24 hours; and heads 7-8 are risk propagation attention, focusing on the association propagation patterns of high-risk domains.

[0140] In this application, a multi-task prediction head design is adopted, and three prediction tasks are established. Each prediction head adopts a three-layer fully connected network, and finally the sigmoid activation function is used to output the second probability.

[0141] Next, for each historical time window, the following steps can be performed: based on the second probability and sample label of each training sample for the future time window, determine the first loss value, ranking loss value, and sparsity loss value respectively, and then weight the first loss value, ranking loss value, and sparsity loss value to obtain the target loss. Furthermore, the target losses corresponding to multiple future time windows can be weighted to obtain the total loss, and the parameters of the previous round's network model can be adjusted based on the total loss to obtain the current round's network model.

[0142] The first loss value can be determined using the weighted binary cross-entropy loss function:

[0143] L BCE =-∑[w i ×(y i ×log(p i )+(1-y i )×log(1-p i ))];

[0144] Where, p i The second probability of the i-th log, with weight w i Calculated based on the historical query frequency of the domain name: w i = log(1+query_frequency) i Among them, the domain name historical query frequency is the total number of times the domain name has been queried within the historical time window.

[0145] The sorting loss value can be determined using the sorting loss function:

[0146] L rank =∑max(0,margin-(p) pos -p neg ));

[0147] Where p_pos is the second probability of a positive sample (the domain name that was actually queried), p_neg is the second probability of a negative sample (the domain name that was not actually queried), and margin is the preset boundary parameter of the ranking loss.

[0148] Sparsity loss:

[0149] L sparse =λ sparse ×∑p i ;

[0150] Total loss: L total =λ1×L BCE +λ2×L rank +λ3×L sparse .

[0151] As an example, λ1 = 1.0, λ2 = 0.1, λ3 = 0.01.

[0152] In some embodiments, a real-time monitoring mechanism for system performance can be established to collect key indicators such as cache hit rate, query latency, and prediction accuracy, providing a data foundation for subsequent optimization decisions. Key performance indicators are defined as follows: Cache hit rate = number of cache hits / total number of queries; Average query latency = average of all query latencies; Prediction accuracy = number of correct predictions / total number of predictions.

[0153] Furthermore, performance baselines and thresholds can be set, including a target cache hit rate of 80%, a hit rate decrease threshold of 75%, a latency increase threshold of 100ms, and a prediction accuracy threshold of 70%. These thresholds can be dynamically adjusted as needed, and this application does not impose specific limitations on them.

[0154] Next, when the cache hit rate is below the threshold and the prediction is accurate, the preloading activity is increased; when the prediction is inaccurate, model retraining is triggered; when the query latency is too high, cache resource allocation is rebalanced.

[0155] In some scenarios, incremental learning updates can be performed, enabling the predictive model to continuously learn new query patterns and business changes, preventing model performance from degrading over time and maintaining the timeliness and accuracy of predictions. Specifically, incremental learning trigger conditions can be defined: prediction accuracy is below 70% for 7 consecutive days, a new query pattern is discovered (cosine similarity < 0.8), or an update is manually triggered. Furthermore, query data from the past 7 days can be collected, the model can be fine-tuned using a small learning rate (1e-5), and performance can be evaluated. If the improvement is > 5%, a new model is deployed; otherwise, the model is rolled back and the reason for failure is recorded.

[0156] See Figure 3The image shows a log query method provided in an embodiment of this application. The method includes the following steps:

[0157] Step S301: In response to the query operation for the target log data, determine the target storage device associated with the target log data based on the association between the log data and the storage device.

[0158] Step S302: Query target log data from storage device; wherein, the association between log data and storage device is established after log data is stored in storage device, the target storage device is determined based on target storage strategy, and the target storage strategy is determined based on the risk level of target log data and the first probability of querying target log data in N future time windows.

[0159] In some embodiments, when the association between log data and storage devices is established by adding the key value of the log data, the device identifier of the storage device, and the path identifier to the metadata of the log data, querying the storage device based on the association can be achieved in the following way: in response to a query operation on the target log data, determine the target key value corresponding to the target log data; determine the target metadata where the target key value is located, and determine the target device identifier and the target path identifier from the target metadata; determine the target storage device corresponding to the target device identifier, and obtain the target log data from the path indicated by the target path identifier in the target storage device.

[0160] In some scenarios, when the metadata includes the processing timestamp of the log data, log data can also be queried from the storage device corresponding to the storage device identifier based on the processing timestamp.

[0161] This application designs a security event awareness query prediction model based on the business characteristics of log processing. It learns different query patterns, such as high-risk domain tracing, event correlation queries, and routine maintenance, through a multi-head attention mechanism to predict log data that may be queried in the future. Compared to traditional log systems that use general LRU caching strategies and cannot understand the query semantics of security business, this application, through event-driven predictive modeling, can accurately predict query needs, significantly improving cache hit rate.

[0162] Secondly, this application designs a multi-task prediction head for different query urgency levels: real-time queries for hotspot caching, event queries for emergency response, and deep analysis queries for historical tracing. Joint training improves the comprehensiveness and accuracy of predictions. Compared to existing log systems that typically only consider caching on a single time dimension and cannot adapt to the query needs of different business scenarios, this application's multi-scale prediction architecture can optimize query performance across different time dimensions.

[0163] Furthermore, this application implements a differentiated caching strategy based on the risk level of the processed logs (high-risk / medium-risk / low-risk / whitelist) and the predicted query probability. High-risk logs receive priority caching resources and faster query responses, achieving business value-oriented resource allocation. Compared to traditional caching strategies that do not consider the differences in business value of log content, leading to unreasonable resource allocation, this application uses refined caching management based on risk level to ensure that high-value logs receive priority protection, significantly improving query efficiency.

[0164] Furthermore, by establishing a real-time monitoring and feedback mechanism for query performance, the predictive model and caching strategy are dynamically adjusted based on metrics such as cache hit rate, query response time, and user satisfaction, ensuring that the system can continuously adapt to changes in query patterns. Compared to the problem that the static configuration of traditional log systems cannot adapt to changes in business needs, the adaptive mechanism of this application can continuously optimize system performance based on actual query results, maintaining a long-term stable query service quality.

[0165] like Figure 4 The diagram shown is a flowchart of a log caching and querying method provided in an embodiment of this application, which specifically includes the following steps:

[0166] S401, extract domain name data, time data, and risk data from the log data, and perform feature extraction on each.

[0167] S402, the extracted domain name features, time features and risk features are fused to obtain a fusion vector.

[0168] S403 inputs the fusion vector and the duration features of N future time windows into the query prediction model, and outputs the predicted probability of querying log data within each of the N future time windows.

[0169] S404: Based on the predicted probabilities corresponding to N future time windows and the risk level of the log data, determine the target caching strategy for the log data and store the log data in the storage device corresponding to the target caching strategy.

[0170] S405, determine the key value of the log data and the path identifier of the log data in the storage device, and add the key value, the device identifier of the storage device and the path identifier to the metadata of the log data to establish the association between the log data and the storage device.

[0171] S406, in response to an operation that queries log data from an object, determines the key-value pair corresponding to the log data.

[0172] S407, determine the target metadata where the target key value is located, and determine the target device identifier and target path identifier from the target metadata.

[0173] S408: Obtain log data from the target storage device corresponding to the target device identifier, under the path indicated by the target path identifier.

[0174] Based on the same technical concept, see [link / reference] Figure 5 The image shows a log caching device 500 provided in an embodiment of this application. This device 500 can perform any step of the log caching method described above; to avoid repetition, it will not be described again here. The log caching device 500 includes an acquisition module 501 and a processing module 502.

[0175] The acquisition module 501 is used to acquire the log dataset to be stored, and performs the following operations for each log data in the log dataset:

[0176] Processing module 502 is used to extract preset type parameters from the log data, wherein the preset types include domain type, time type and risk type;

[0177] Feature extraction is performed on the preset type parameters to obtain the first fused feature;

[0178] For any one of the preset N future time windows, the following steps are performed: based on the duration feature of the any one future time window and the first fusion feature, predict the first probability of querying the log data within the future time window; where N≥1 and N is a positive integer, and the duration feature is the time period length information corresponding to the any one future time window;

[0179] Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0180] The log data is stored in the storage device corresponding to the target caching policy, and the association between the log data and the storage device is established.

[0181] In one possible implementation, the processing module 502, when establishing the association between the log data and the storage device, is specifically used for:

[0182] Determine the path identifier of the log data in the storage device;

[0183] Determine the key value of the log data, and add the key value, the device identifier of the storage device, and the path identifier to the metadata of the log data to establish the association between the log data and the storage device.

[0184] In one possible implementation, when determining the target caching strategy corresponding to the log data based on the first probabilities corresponding to the N future time windows and the risk level of the log data, the processing module 502 is specifically used for:

[0185] For each future time window, perform the following: determine the target value range within which the first probability falls within a range of M values;

[0186] Based on the target value range corresponding to each first probability and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

[0187] In one possible implementation, the processing module 502, in storing the log data in the storage device corresponding to the target caching policy, is specifically used for:

[0188] Based on the correlation between caching strategies and storage media types, the target storage type corresponding to the target caching strategy is determined;

[0189] The log data is stored in the storage device corresponding to the target storage type.

[0190] In one possible implementation, the processing module 502, when predicting the first probability of querying the log data within the future time window based on the duration feature of any future time window and the first fusion feature, is specifically used for:

[0191] The duration feature of any future time window and the first fusion feature are input into the query prediction model, and the first probability of querying the log data within the future time window is predicted by the query prediction model.

[0192] The query prediction model is obtained in the following way:

[0193] Obtain a training sample set, which includes multiple training samples. Each training sample includes sample log data and sample labels. The sample labels include multiple sub-labels. Each sub-label is used to represent the query result of querying the sample log data within a corresponding set time window.

[0194] The initial network model is trained multiple times based on the training sample set until the set conditions are met, at which point the training stops and the query prediction model is obtained.

[0195] In each round of training, the following operations are performed:

[0196] For each training sample in the training sample set, the following steps are performed: feature extraction and concatenation are performed based on preset type parameters in the sample log data to obtain concatenated features; the concatenated features and duration features corresponding to multiple historical time windows are input into the network model output from the previous round, and the predicted probability set for querying the training sample within the multiple historical time windows is predicted based on the network model output from the previous round; wherein, the predicted probability set includes multiple second probabilities, each second probability representing the probability of querying the training sample within the corresponding historical time window;

[0197] For each historical time window, the following steps are performed: based on the second probability and sample label of each training sample for the future time window, a first loss value, a ranking loss value, and a sparsity loss value are determined respectively, and the first loss value, the ranking loss value, and the sparsity loss value are weighted to obtain the target loss;

[0198] The total loss is obtained by weighting the target losses corresponding to the multiple future time windows.

[0199] The parameters of the network model in the previous round are adjusted based on the total loss to obtain the network model in the current round.

[0200] Based on the same technical concept, see [link / reference] Figure 6 The image shows a log query device 600 provided in an embodiment of this application. This log query device 600 can perform any step of the log query method described above; to avoid repetition, it will not be described again here. The log caching device 600 includes a processing module 601 and a query module 602.

[0201] Processing module 601 is used to respond to query operations on target log data and determine the target storage device associated with the target log data based on the association between the log data and the storage device.

[0202] Query module 602 is used to query the target log data from the storage device;

[0203] The association between the log data and the storage device is established after the log data is stored in the storage device. The target storage device is determined based on the target storage strategy, which is determined based on the risk level of the target log data and the first probability of querying the target log data within N future time windows.

[0204] In one possible implementation, when the association between the log data and the storage device is established by adding the log data's key value, the storage device's device identifier, and the path identifier to the log data's metadata, the query module 602, when performing a query on the storage device based on the association, specifically performs the following:

[0205] In response to a query operation on the target log data, the target key value corresponding to the target log data is determined;

[0206] Determine the target metadata containing the target key value, and from the target metadata, determine the target device identifier and the target path identifier;

[0207] Determine the target storage device corresponding to the target device identifier, and obtain the target log data from the path indicated by the target path identifier in the target storage device.

[0208] Please see Figure 7 Based on the same technical concept, embodiments of this application also provide a computer device. In one embodiment, the computer device is as follows: Figure 7 As shown, it may include a memory 701, a communication module 703, and one or more processors 702.

[0209] The memory 701 is used to store computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, and the data storage area may store various operation instruction sets, etc.

[0210] Memory 701 may be volatile memory, such as random-access memory (RAM); memory 701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 701 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above-described memories.

[0211] Processor 702 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 702 is used to implement the above-mentioned log caching and log query methods when calling computer programs stored in memory 701.

[0212] The communication module 703 is used to communicate with data transmitting devices, data receiving devices, or other network devices.

[0213] This application embodiment does not limit the specific connection medium between the memory 701, communication module 703, and processor 702 described above. This application embodiment... Figure 7 The memory 701 and the processor 702 are connected via a bus 704, and the bus 704 is in Figure 7 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 704 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 7 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0214] The memory 701 stores a computer storage medium containing computer-executable instructions for implementing the log caching and log query methods of the embodiments of this application. The processor 702 is used to execute the log caching and log query methods of the above embodiments.

[0215] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium storing a computer program. When the computer program instructions are executed on a computer, the computer processor performs the steps of the log caching and log query methods according to various embodiments of this application described above.

[0216] In some possible implementations, various aspects of the log caching and log querying methods provided in this application can also be implemented as a program product, which includes program code. When the program product is run on a computer device, the program code is used to cause the computer device to perform the steps in the log caching and log querying methods according to various exemplary embodiments of this application described above. For example, the computer device can execute the steps of each embodiment.

[0217] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0218] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this application, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0219] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0220] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0221] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0222] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0223] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0224] Furthermore, it should be noted that in the specific embodiments of this application, object data related to log data and the like are involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the object is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0225] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0226] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0227] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0228] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0229] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A log caching method, characterized in that, The method includes: Obtain the log dataset to be stored, and perform the following operations for each log data in the log dataset: Extract preset type parameters from the log data, where the preset types include domain type, time type, and risk type; Feature extraction is performed on the preset type parameters to obtain the first fused feature; For any one of the preset N future time windows, the following steps are performed: based on the duration feature of the any one future time window and the first fusion feature, predict the first probability of querying the log data within the future time window; where N≥1 and N is a positive integer, and the duration feature is the time period length information corresponding to the any one future time window; Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, the target caching strategy corresponding to the log data is determined. The log data is stored in the storage device corresponding to the target caching policy, and the association between the log data and the storage device is established.

2. The method as described in claim 1, characterized in that, Establishing the association between the log data and the storage device includes: Determine the path identifier of the log data in the storage device; Determine the key value of the log data, and add the key value, the device identifier of the storage device, and the path identifier to the metadata of the log data to establish the association between the log data and the storage device.

3. The method as described in claim 1, characterized in that, The step of determining the target caching strategy for the log data based on the first probabilities corresponding to the N future time windows and the risk level of the log data includes: For each future time window, perform the following: determine the target value range within which the first probability falls within a range of M values; Based on the target value range corresponding to each first probability and the risk level of the log data, the target caching strategy corresponding to the log data is determined.

4. The method as described in claim 1, characterized in that, The step of storing the log data in the storage device corresponding to the target caching policy includes: Based on the correlation between caching strategies and storage media types, the target storage type corresponding to the target caching strategy is determined; The log data is stored in the storage device corresponding to the target storage type.

5. The method according to any one of claims 1-4, characterized in that, The prediction of the first probability of querying the log data within the future time window based on the duration feature of any one future time window and the first fusion feature includes: The duration feature of any future time window and the first fusion feature are input into the query prediction model, and the first probability of querying the log data within the future time window is predicted by the query prediction model. The query prediction model is obtained in the following way: Obtain a training sample set, which includes multiple training samples. Each training sample includes sample log data and sample labels. The sample labels include multiple sub-labels. Each sub-label is used to represent the query result of querying the sample log data within a corresponding set time window. The initial network model is trained multiple times based on the training sample set until the set conditions are met, at which point the training stops and a query prediction model is obtained. In each round of training, the following operations are performed: For each training sample in the training sample set, the following steps are performed: feature extraction and concatenation are performed based on preset type parameters in the sample log data to obtain concatenated features; the concatenated features and duration features corresponding to multiple historical time windows are input into the network model output from the previous round, and the predicted probability set for querying the training sample within the multiple historical time windows is predicted based on the network model output from the previous round; wherein, the predicted probability set includes multiple second probabilities, each second probability representing the probability of querying the training sample within the corresponding historical time window; For each historical time window, the following steps are performed: based on the second probability and sample label of each training sample for the future time window, a first loss value, a ranking loss value, and a sparsity loss value are determined respectively, and the first loss value, the ranking loss value, and the sparsity loss value are weighted to obtain the target loss; The total loss is obtained by weighting the target losses corresponding to the multiple future time windows. The parameters of the network model in the previous round are adjusted based on the total loss to obtain the network model in the current round.

6. A log query method, characterized in that, The method includes: In response to a query operation targeting the target log data, the target storage device associated with the target log data is determined based on the association between the log data and the storage device. Query the target log data from the storage device; The association between the log data and the storage device is established after the log data is stored in the storage device. The target storage device is determined based on the target storage strategy, which is determined based on the risk level of the target log data and the first probability of querying the target log data within N future time windows.

7. The method as described in claim 6, characterized in that, When the association between the log data and the storage device is established by adding the log data's key value, the storage device's device identifier, and the path identifier to the log data's metadata, the query performed on the storage device based on the association includes: In response to a query operation on the target log data, the target key value corresponding to the target log data is determined; Determine the target metadata containing the target key value, and from the target metadata, determine the target device identifier and the target path identifier; Determine the target storage device corresponding to the target device identifier, and obtain the target log data from the path indicated by the target path identifier in the target storage device.

8. A log caching device, characterized in that, include: The acquisition module is used to acquire the log dataset to be stored, and performs the following operations for each log data in the log dataset: The processing module is used to extract preset type parameters from the log data, wherein the preset types include domain type, time type and risk type; Feature extraction is performed on the preset type parameters to obtain the first fused feature; For any one of the preset N future time windows, the following steps are performed: based on the duration feature of the any one future time window and the first fusion feature, predict the first probability of querying the log data within the future time window; where N≥1 and N is a positive integer, and the duration feature is the time period length information corresponding to the any one future time window; Based on the first probability corresponding to each of the N future time windows and the risk level of the log data, the target caching strategy corresponding to the log data is determined. The log data is stored in the storage device corresponding to the target caching policy, and the association between the log data and the storage device is established.

9. A log query device, characterized in that, include: The processing module is used to respond to query operations on target log data and determine the target storage device associated with the target log data based on the association between the log data and the storage device. The query module is used to query the target log data from the storage device; The association between the log data and the storage device is established after the log data is stored in the storage device. The target storage device is determined based on the target storage strategy, which is determined based on the risk level of the target log data and the first probability of querying the target log data within N future time windows.

10. A computer device, characterized in that, include: Memory, used to store program instructions; A processor is configured to acquire program instructions from the memory and execute the method of any one of claims 1-5 and 6-7 according to the acquired program instructions.

Images