Network security investigation and operation prevention and control method and system based on node logs

Abstract

The invention relates to the technical field of network security, and provides a network security investigation and operation prevention and control method and system based on node logs, and the method comprises the steps: obtaining an abnormal log of a target node, and carrying out the feature extraction and classified storage of the abnormal log, so as to achieve the efficient query; virtual node IDs are preset, an association mapping library is obtained, and a foundation is laid for association matching query; the method comprises the following steps: associating and mapping an abnormal log to a virtual node ID based on a first feature of the abnormal log, then obtaining a to-be-configured node and a corresponding first feature, and carrying out matching query to obtain the virtual node ID associated with the first feature of the to-be-configured node, thereby obtaining a first operation strategy file, and realizing operation prevention and control of the to-be-configured node; according to the method, the real-time log of the target node is obtained, feature extraction and classified storage are performed on the real-time log, the virtual node ID associated with the real-time log is matched and inquired, the analysis log file is obtained, and the second operation strategy file is obtained, so that real-time troubleshooting of the target node is realized, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security investigation and operation control method and system based on node logs. Background Technology

[0002] Currently, IT operations and maintenance (O&M) services are crucial for the continuous and stable operation of large-scale IT system architectures. A key aspect of O&M is monitoring the daily operational status of services, troubleshooting various anomalies, and ensuring the system's continuous, efficient, and available operation. Most services in IT systems are deployed in a distributed manner, consisting of multiple nodes. Each service is also linked to other services within the IT system, such as databases, gateway services, and log collection services. Therefore, achieving efficient O&M and implementing optimal emergency response plans in the event of system anomalies is a significant challenge for most companies.

[0003] One existing method for troubleshooting node anomalies is to match service nodes through log content and store the logs in the operation and maintenance system. However, this requires manual judgment of the cause of the node anomaly, resulting in low troubleshooting efficiency. In addition, similar nodes exist in different operation and maintenance systems, and it is necessary to identify similar nodes by using the logs of different operation and maintenance systems. When a node becomes abnormal, it is necessary to use the logs to check each similar node one by one to determine whether it has become abnormal. This makes the troubleshooting process redundant and cumbersome, reducing the efficiency of operation and maintenance.

[0004] Therefore, how to effectively analyze node logs, achieve efficient troubleshooting and operational control of similar nodes, and thus improve operational efficiency has become an urgent problem to be solved. Summary of the Invention

[0005] Given that one of the existing methods for troubleshooting node anomalies involves matching service nodes based on log content and storing the logs in the operation and maintenance system, but this requires manual judgment of the cause of the node anomaly, resulting in low troubleshooting efficiency; in addition, similar nodes exist in different operation and maintenance systems, requiring the identification of similar nodes through the logs of different operation and maintenance systems, and when a node becomes abnormal, it is necessary to use the logs to check similar nodes one by one to determine whether an anomaly has occurred, making the troubleshooting process redundant and cumbersome, reducing operation and maintenance efficiency, one of the purposes of this application is to provide a network security troubleshooting and operation control method and system based on node logs, which achieves efficient retrieval through classified storage and establishes associations using virtual IDs, not only achieving efficient node troubleshooting, but also enabling operation control of nodes based on anomaly logs, effectively reducing operation and maintenance costs.

[0006] To achieve the above objectives, this application adopts the following technical solution: The network security investigation and operational control method based on node logs includes the following steps: Step S10: Obtain the abnormal logs of the target node, and extract features from the abnormal logs to obtain the first feature and the second feature of the abnormal logs; generate a unique log ID for the abnormal logs, and classify and store the abnormal logs based on the first feature, the second feature and the log ID; Step S20: Preset virtual node ID and obtain association mapping library; based on the first feature of the abnormal log, associate and map the abnormal log to the virtual node ID in the association mapping library, and replace the first feature of the abnormal log with the virtual node ID; Step S30: Obtain the node to be configured and its corresponding first feature; match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; based on the corresponding virtual node ID, obtain the first running strategy file; Step S40: Obtain the real-time logs of the target node, and perform feature extraction and classification storage on the real-time logs; then match and query the virtual node ID associated with the real-time logs to obtain the analysis log file; based on the analysis log file, obtain the second running strategy file.

[0007] In one embodiment of this application, in step S10, abnormal logs of the target node are obtained, and feature extraction is performed on the abnormal logs to obtain a first feature and a second feature of the abnormal logs; a unique log ID is generated for the abnormal logs, and the abnormal logs are classified and stored based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization; extract features from the preprocessed abnormal logs to obtain malicious identifiers and abnormal behaviors, which are used as the first feature and the second feature of the abnormal logs, respectively; wherein, the first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

[0008] In one embodiment of this application, in step S20, a virtual node ID is preset to obtain an association mapping library; based on the first feature of the abnormal log, the abnormal log is associated and mapped to the virtual node ID in the association mapping library, and the first feature of the abnormal log is replaced with the virtual node ID, including: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifiers from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain an association mapping library; If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

[0009] In one embodiment disclosed in this application, in step S30, the node to be configured and its corresponding first feature are obtained; the first feature of the node to be configured is matched with the virtual node ID to obtain the corresponding virtual node ID; based on the corresponding virtual node ID, the first running strategy file is obtained, including: Obtain the node to be configured and its corresponding first feature; match the first feature corresponding to the node to be configured with the virtual node ID in the association mapping library to obtain the virtual node ID associated with the node to be configured. The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

[0010] In one embodiment disclosed in this application, in step S40, the real-time logs of the target node are obtained, and the real-time logs are feature extracted and classified for storage; then, the virtual node ID associated with the real-time logs is matched and queried to obtain an analysis log file; based on the analysis log file, a second running strategy file is obtained, including: The system acquires real-time logs from the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as a key, a second hash table is used to classify and store the real-time logs, with the first key-value pairs of the second hash table used to store the first feature. In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain an analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filename of the analysis log file and the filename of the abnormal logs associated with the second feature of the real-time log are obtained. According to the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain a second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

[0011] The network security investigation and operation control system based on node logs includes the following modules: The first abnormal log processing module is used to obtain the abnormal logs of the target node, extract features from the abnormal logs to obtain the first feature and the second feature of the abnormal logs; generate a unique log ID for the abnormal logs; and classify and store the abnormal logs based on the first feature, the second feature and the log ID. The association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library; The second abnormal log processing module is used to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and replace the first feature of the abnormal log with the virtual node ID; The node to be configured processing module is used to obtain the node to be configured and its corresponding first feature, and match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; The first runtime strategy file generation module is used to obtain the first runtime strategy file based on the corresponding virtual node ID; The real-time log processing module is used to acquire the real-time logs of the target node, and to extract features from and classify the real-time logs for storage. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain the analysis log file; and to obtain the second operation strategy file based on the analysis log file.

[0012] In one embodiment disclosed in this application, the first abnormal log processing module is used to acquire abnormal logs of a target node, extract features from the abnormal logs to obtain a first feature and a second feature of the abnormal logs; generate a unique log ID for the abnormal logs, and classify and store the abnormal logs based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization; extract features from the preprocessed abnormal logs to obtain malicious identifiers and abnormal behaviors, which are used as the first feature and the second feature of the abnormal logs, respectively; wherein, the first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

[0013] In one embodiment disclosed in this application, the association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library, including: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifiers from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain an association mapping library; The second abnormal log processing module is configured to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and to replace the first feature of the abnormal log with the virtual node ID, including: If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

[0014] In one embodiment disclosed in this application, the node-to-be-configured processing module is used to obtain the node to be configured and its corresponding first feature, and to match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID, including: Obtain the node to be configured and its corresponding first feature; match the first feature corresponding to the node to be configured with the virtual node ID in the association mapping library to obtain the virtual node ID associated with the node to be configured. The first runtime strategy file generation module is used to obtain a first runtime strategy file based on the corresponding virtual node ID, including: The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

[0015] In one embodiment disclosed in this application, the real-time log processing module is used to acquire the real-time logs of the target node, and to perform feature extraction and classification storage on the real-time logs, including: The system acquires real-time logs from the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as a key, a second hash table is used to classify and store the real-time logs, with the first key-value pairs of the second hash table used to store the first feature. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain an analysis log file; based on the analysis log file, the second operation strategy file is obtained, including: In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain an analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filename of the analysis log file and the filename of the abnormal logs associated with the second feature of the real-time log are obtained. According to the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain a second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

[0016] Compared with existing technologies, the beneficial effects of this invention are: acquiring the abnormal logs of the target node and extracting features from the abnormal logs to obtain a first feature and a second feature, which are used to characterize the abnormal logs; generating a unique log ID for the abnormal logs, and classifying and storing the abnormal logs based on the first feature, the second feature, and the log ID, facilitating subsequent fast matching queries; pre-setting virtual node IDs to obtain an association mapping library, laying the foundation for subsequent association matching queries; based on the first feature of the abnormal logs, associating and mapping the abnormal logs to virtual node IDs in the association mapping library, and replacing the first feature of the abnormal logs with the virtual node IDs; and then acquiring the node to be configured. The system uses the first feature of the node to be configured to match the virtual node ID to obtain the corresponding virtual node ID. Based on the corresponding virtual node ID, a first running policy file is obtained, which is used to perform security configuration on the node to be configured, thereby achieving operational prevention and control and reducing operation and maintenance costs. It also obtains the real-time logs of the target node, performs feature extraction and classification storage on the real-time logs, and then matches and queries the virtual node IDs associated with the real-time logs to obtain the analysis log file, thereby obtaining the second running policy file. This enables real-time investigation of network security of the target node, which can quickly locate anomalies and obtain effective historical response plans based on the anomaly logs, thus improving operation and maintenance efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the network security investigation and operational control method based on node logs provided in this application; Figure 2 A schematic diagram of the network security investigation and operation control system based on node logs provided in this application. Detailed Implementation

[0019] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0020] The terms “comprising” and “having”, and any variations thereof, used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0022] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0024] Figure 1 This is a flowchart illustrating the network security investigation and operational control method based on node logs provided in this application. The method includes the following steps: Step S10: Obtain the abnormal log of the target node, and extract features from the abnormal log to obtain the first feature and the second feature of the abnormal log; generate a unique log ID for the abnormal log, and classify and store the abnormal log based on the first feature, the second feature and the log ID; Step S20: Preset virtual node ID and obtain association mapping library; based on the first feature of the abnormal log, associate and map the abnormal log to the virtual node ID in the association mapping library, and replace the first feature of the abnormal log with the virtual node ID; Step S30: Obtain the node to be configured and its corresponding first feature; match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; based on the corresponding virtual node ID, obtain the first running strategy file; Step S40: Obtain the real-time log of the target node, extract features from the real-time log, classify and store it; then match and query the virtual node ID associated with the real-time log to obtain the analysis log file; based on the analysis log file, obtain the second running strategy file.

[0025] This network security investigation and operational control method based on node logs acquires abnormal logs of target nodes and extracts features from these logs to obtain first and second features for characterizing the abnormal logs. A unique log ID is generated for each abnormal log, and the abnormal logs are categorized and stored based on their first and second features and the log ID for easy subsequent fast matching and querying. Virtual node IDs are preset to obtain an association mapping library, laying the foundation for subsequent association matching queries. Based on the first feature of the abnormal logs, the abnormal logs are associated and mapped to virtual node IDs in the association mapping library, and the first feature of the abnormal logs is replaced with the virtual node IDs. Then, the method acquires the node to be configured... The system identifies a node and its corresponding first feature. It matches the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID. Based on the corresponding virtual node ID, a first runtime policy file is obtained, which is used to perform security configuration on the node to be configured, achieving operational control and reducing maintenance costs. It also acquires real-time logs of the target node, extracts features from the real-time logs, classifies and stores them, and then matches and queries the virtual node IDs associated with the real-time logs to obtain an analysis log file, which in turn yields a second runtime policy file. This enables real-time investigation of network security for the target node, quickly locating anomalies and obtaining effective historical response plans based on the anomaly logs, thus improving operational efficiency.

[0026] Preferably, in step S10, the abnormal logs of the target node are obtained, and feature extraction is performed on the abnormal logs to obtain the first feature and the second feature of the abnormal logs; a unique log ID is generated for the abnormal logs, and the abnormal logs are classified and stored based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization. Extract features from the preprocessed abnormal logs to obtain the malicious identifiers and abnormal behaviors of the abnormal logs, which are used as the first feature and the second feature of the abnormal logs, respectively. The first feature includes one or more of the malicious identifiers, and the second feature includes one or more of the abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

[0027] In the above technical solution, abnormal logs are preprocessed to lay the foundation for subsequent feature extraction. Specifically, filtering removes irrelevant or duplicate logs, while normalization and standardization convert logs from different sources or with inconsistent formats into a unified internal standard format. Then, feature extraction is performed on the preprocessed abnormal logs to obtain their malicious identifiers and abnormal behaviors. The malicious identifier uniquely identifies the abnormal log, specifically used to uniquely identify the entity that caused the abnormality or participated in the abnormal activity; the abnormal behavior refers to the abnormal actions that occurred on the target node. Therefore, the same abnormal log may include one or more malicious identifiers and abnormal behaviors. Using the second feature of the abnormal log as the key, a hash table structure is used to classify and store the abnormal logs, thereby grouping abnormal logs with the same characteristics together. The log ID is used as an index to quickly locate the corresponding first feature, ensuring the accuracy of subsequent efficient queries.

[0028] Preferably, in step S20, a virtual node ID is preset to obtain an association mapping library; based on the first feature of the abnormal log, the abnormal log is associated and mapped to the virtual node ID in the association mapping library, and replacing the first feature of the abnormal log with the virtual node ID includes: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifier from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain the association mapping library; If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

[0029] In the above technical solution, known entity identifiers that cause or participate in abnormal activities are obtained, and malicious identifiers from the same source are used as preset first features. A virtual node ID is created for the preset first feature, thereby aggregating related malicious identifiers under the same virtual node ID. The preset first feature and its association mapping relationship with the virtual node ID are then written into an empty mapping table to obtain an association mapping library, laying the foundation for subsequent association matching queries. The first feature corresponding to the log ID is then compared with the preset first feature to obtain the virtual node ID associated with the first feature corresponding to the log ID. This virtual node ID replaces the first feature, avoiding frequent retrieval of the first feature during subsequent association analysis. Replacing it with a virtual node ID effectively improves analysis efficiency. Furthermore, new virtual node IDs are created for first features that are not associated, and the corresponding first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, thereby enriching and improving the association mapping library. A filename is also created for the abnormal logs whose first feature is replaced with a virtual node ID. This filename contains the corresponding virtual node ID for subsequent fast matching queries.

[0030] Preferably, in step S30, the node to be configured and its corresponding first feature are obtained; the first feature of the node to be configured is matched with the virtual node ID to obtain the corresponding virtual node ID; based on the corresponding virtual node ID, the first running strategy file is obtained, including: Obtain the node to be configured and its corresponding first feature. In the association mapping library, match the first feature corresponding to the node to be configured with the virtual node ID to obtain the virtual node ID associated with the node to be configured. The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

[0031] In the above technical solution, the first feature of the node to be configured is mapped to the malicious identifier in the virtual node ID in the association mapping library. This matching process yields all virtual node IDs associated with the node to be configured, establishing an association between the node to be configured and the abnormal logs. This allows the node to be configured to perform security operation control based on the abnormal logs, effectively preventing the same abnormal behavior from recurring on the node. Then, based on all the matched virtual node IDs, a query is performed in the first hash table to obtain all log IDs associated with these virtual node IDs. This yields the second feature of the abnormal logs corresponding to these log IDs. Targeted operation policies are generated based on each second feature. These operation policies are integrated to obtain a first operation policy file, and the node to be configured is then securely configured according to this first operation policy file. This achieves the goal of node operation control and effectively reduces operation and maintenance costs.

[0032] Preferably, in step S40, the real-time log of the target node is obtained, and the real-time log is feature extracted, classified, and stored; then, the virtual node ID associated with the real-time log is matched and queried to obtain the analysis log file; based on the analysis log file, the second running strategy file is obtained, including: The system acquires the real-time logs of the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as the key, a second hash table is used to classify and store the real-time logs. The first key-value pairs of the second hash table are used to store the first feature of the real-time logs. In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain the analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filenames of the analysis log file and the abnormal logs associated with the second feature of the real-time log are obtained. Based on the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain the second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

[0033] In the above technical solution, real-time logs are also preprocessed to ensure data validity and standardization. Feature extraction is performed on the real-time logs, using both a first and second feature to characterize them, facilitating subsequent matching queries. The second feature of the real-time log is then used as a key, and a second hash table is used to classify and store the logs. This facilitates querying all associated abnormal logs by matching the second feature, improving the efficiency of network security investigation of target nodes. Based on the first feature of the real-time log, all virtual node IDs corresponding to the first feature are found in the association mapping library. The first feature of the real-time log is replaced with these virtual node IDs, and the real-time log is used as an analysis log file. A filename including these virtual node IDs is created for this analysis log file, laying the foundation for the correspondence and matching between the analysis log file and abnormal logs. By matching the second feature of the real-time log in the first hash table, all abnormal logs associated with the second feature of the real-time log are obtained. Then, based on the correspondence between the file names of these abnormal logs and the file names of the analysis log files, abnormal logs associated with the first feature of the real-time log are filtered out from these abnormal logs. The abnormal logs associated with the first feature of the real-time log are read to obtain the historical processing records of these abnormal logs. By integrating all the historical processing records, the second operation strategy file can be obtained. The target node can quickly take countermeasures based on the second operation strategy file, thereby improving operation and maintenance efficiency.

[0034] Figure 2 A schematic diagram of the network security investigation and operation control system based on node logs provided in this application. This network security investigation and operation control system based on node logs includes the following modules: The first abnormal log processing module is used to obtain the abnormal logs of the target node, extract features from the abnormal logs to obtain the first feature and the second feature of the abnormal logs; generate a unique log ID for the abnormal logs; and classify and store the abnormal logs based on the first feature, the second feature and the log ID. The association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library; The second abnormal log processing module is used to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and replace the first feature of the abnormal log with the virtual node ID; The node to be configured processing module is used to obtain the node to be configured and its corresponding first feature, and match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; The first runtime strategy file generation module is used to obtain the first runtime strategy file based on the corresponding virtual node ID; The real-time log processing module is used to acquire the real-time logs of the target node, and to extract features from and classify the real-time logs for storage. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain the analysis log file; based on the analysis log file, the second operation strategy file is obtained.

[0035] This network security investigation and operation control system based on node logs acquires abnormal logs of target nodes and extracts features from these logs to obtain first and second features for characterizing the abnormal logs. A unique log ID is generated for each abnormal log, and the abnormal logs are categorized and stored based on their first and second features and the log ID for easy subsequent matching and querying. Virtual node IDs are preset to obtain an association mapping library, laying the foundation for subsequent association matching queries. Based on the first feature of the abnormal logs, the system associates and maps the abnormal logs to virtual node IDs in the association mapping library, and replaces the first feature of the abnormal logs with the virtual node IDs. Then, the system acquires the node to be configured... The system identifies a node and its corresponding first feature. It matches the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID. Based on the corresponding virtual node ID, a first runtime policy file is obtained, which is used to perform security configuration on the node to be configured, achieving operational control and reducing maintenance costs. It also acquires real-time logs of the target node, extracts features from the real-time logs, classifies and stores them, and then matches and queries the virtual node IDs associated with the real-time logs to obtain an analysis log file, which in turn yields a second runtime policy file. This enables real-time investigation of network security for the target node, quickly locating anomalies and obtaining effective historical response plans based on the anomaly logs, thus improving operational efficiency.

[0036] Preferably, the first abnormal log processing module is used to acquire the abnormal logs of the target node, extract features from the abnormal logs to obtain a first feature and a second feature of the abnormal logs; generate a unique log ID for the abnormal logs, and classify and store the abnormal logs based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization. Extract features from the preprocessed abnormal logs to obtain the malicious identifiers and abnormal behaviors of the abnormal logs, which are used as the first feature and the second feature of the abnormal logs, respectively. The first feature includes one or more of the malicious identifiers, and the second feature includes one or more of the abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

[0037] In the above technical solution, abnormal logs are preprocessed to lay the foundation for subsequent feature extraction. Specifically, filtering removes irrelevant or duplicate logs, while normalization and standardization convert logs from different sources or with inconsistent formats into a unified internal standard format. Then, feature extraction is performed on the preprocessed abnormal logs to obtain their malicious identifiers and abnormal behaviors. The malicious identifier uniquely identifies the abnormal log, specifically used to uniquely identify the entity that caused the abnormality or participated in the abnormal activity; the abnormal behavior refers to the abnormal actions that occurred on the target node. Therefore, the same abnormal log may include one or more malicious identifiers and abnormal behaviors. Using the second feature of the abnormal log as the key, a hash table structure is used to classify and store the abnormal logs, thereby grouping abnormal logs with the same characteristics together. The log ID is used as an index to quickly locate the corresponding first feature, ensuring the accuracy of subsequent efficient queries.

[0038] Preferably, the association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library including: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifier from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain the association mapping library; The second processing module for the abnormal log is used to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and to replace the first feature of the abnormal log with the virtual node ID, including: If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

[0039] In the above technical solution, known entity identifiers that cause or participate in abnormal activities are obtained, and malicious identifiers from the same source are used as preset first features. A virtual node ID is created for the preset first feature, thereby aggregating related malicious identifiers under the same virtual node ID. The preset first feature and its association mapping relationship with the virtual node ID are then written into an empty mapping table to obtain an association mapping library, laying the foundation for subsequent association matching queries. The first feature corresponding to the log ID is then compared with the preset first feature to obtain the virtual node ID associated with the first feature corresponding to the log ID. This virtual node ID replaces the first feature, avoiding frequent retrieval of the first feature during subsequent association analysis. Replacing it with a virtual node ID effectively improves analysis efficiency. Furthermore, new virtual node IDs are created for first features that are not associated, and the corresponding first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, thereby enriching and improving the association mapping library. A filename is also created for the abnormal logs whose first feature is replaced with a virtual node ID. This filename contains the corresponding virtual node ID for subsequent fast matching queries.

[0040] Preferably, the node-to-be-configured processing module is used to obtain the node to be configured and its corresponding first feature, and to match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID, including: Obtain the node to be configured and its corresponding first feature. In the association mapping library, match the first feature corresponding to the node to be configured with the virtual node ID to obtain the virtual node ID associated with the node to be configured. The first runtime strategy file generation module is used to obtain the first runtime strategy file based on the corresponding virtual node ID, including: The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

[0041] In the above technical solution, the first feature of the node to be configured is mapped to the malicious identifier in the virtual node ID in the association mapping library. This matching process yields all virtual node IDs associated with the node to be configured, establishing an association between the node to be configured and the abnormal logs. This allows the node to be configured to perform security operation control based on the abnormal logs, effectively preventing the same abnormal behavior from recurring on the node. Then, based on all the matched virtual node IDs, a query is performed in the first hash table to obtain all log IDs associated with these virtual node IDs. This yields the second feature of the abnormal logs corresponding to these log IDs. Targeted operation policies are generated based on each second feature. These operation policies are integrated to obtain a first operation policy file, and the node to be configured is then securely configured according to this first operation policy file. This achieves the goal of node operation control and effectively reduces operation and maintenance costs.

[0042] Preferably, the real-time log processing module is used to acquire the real-time logs of the target node, and to perform feature extraction and classification storage on the real-time logs, including: The system acquires the real-time logs of the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as the key, a second hash table is used to classify and store the real-time logs. The first key-value pairs of the second hash table are used to store the first feature of the real-time logs. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain the analysis log file; based on the analysis log file, the second operation strategy file includes: In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain the analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filenames of the analysis log file and the abnormal logs associated with the second feature of the real-time log are obtained. Based on the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain the second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

[0043] In the above technical solution, real-time logs are also preprocessed to ensure data validity and standardization. Feature extraction is performed on the real-time logs, using both a first and second feature to characterize them, facilitating subsequent matching queries. The second feature of the real-time log is then used as a key, and a second hash table is used to classify and store the logs. This facilitates querying all associated abnormal logs by matching the second feature, improving the efficiency of network security investigation of target nodes. Based on the first feature of the real-time log, all virtual node IDs corresponding to the first feature are found in the association mapping library. The first feature of the real-time log is replaced with these virtual node IDs, and the real-time log is used as an analysis log file. A filename including these virtual node IDs is created for this analysis log file, laying the foundation for the correspondence and matching between the analysis log file and abnormal logs. By matching the second feature of the real-time log in the first hash table, all abnormal logs associated with the second feature of the real-time log are obtained. Then, based on the correspondence between the file names of these abnormal logs and the file names of the analysis log files, abnormal logs associated with the first feature of the real-time log are filtered out from these abnormal logs. The abnormal logs associated with the first feature of the real-time log are read to obtain the historical processing records of these abnormal logs. By integrating all the historical processing records, the second operation strategy file can be obtained. The target node can quickly take countermeasures based on the second operation strategy file, thereby improving operation and maintenance efficiency.

[0044] As can be seen from the above, this network security investigation and operation control method and system based on node logs acquires abnormal logs of target nodes and extracts features from the abnormal logs to obtain first and second features for characterizing the abnormal logs; it generates unique log IDs for the abnormal logs and classifies and stores the abnormal logs based on the first feature, second feature, and log ID for easy subsequent fast matching and querying; it presets virtual node IDs to obtain an association mapping library, laying the foundation for subsequent association matching and querying; based on the first feature of the abnormal logs, it associates and maps the abnormal logs to virtual node IDs in the association mapping library, and replaces the first feature of the abnormal logs with the virtual node IDs; then... The system acquires the node to be configured and its corresponding first feature. It then matches the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID. Based on the corresponding virtual node ID, it obtains the first runtime policy file, which is used to perform security configuration on the node to be configured, achieving operational control and reducing maintenance costs. Furthermore, it acquires the real-time logs of the target node, extracts features from the real-time logs, classifies and stores them, and then matches and queries the virtual node IDs associated with the real-time logs to obtain the analysis log file. This yields the second runtime policy file, enabling real-time network security checks on the target node. This allows for rapid anomaly location and the acquisition of effective historical response plans based on the anomaly logs, improving operational efficiency.

[0045] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A network security investigation and operational control method based on node logs, characterized in that, It includes the following steps: Step S10: Obtain the abnormal log of the target node, and extract features from the abnormal log to obtain the first feature and the second feature of the abnormal log. Generate a unique log ID for the abnormal log, and classify and store the abnormal log based on the first feature, the second feature, and the log ID; Step S20: Preset virtual node IDs and obtain the associated mapping library; Based on the first feature of the abnormal log, the abnormal log is associated with and mapped to the virtual node ID in the association mapping library, and the first feature of the abnormal log is replaced with the virtual node ID; Step S30: Obtain the node to be configured and its corresponding first feature; match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; based on the corresponding virtual node ID, obtain the first running strategy file; Step S40: Obtain the real-time logs of the target node, and perform feature extraction and classification storage on the real-time logs; Then, match and query the virtual node ID associated with the real-time log to obtain the analysis log file; based on the analysis log file, obtain the second running strategy file.

2. The network security investigation and operation control method based on node logs according to claim 1, characterized in that, In step S10, the abnormal log of the target node is obtained, and the abnormal log is subjected to feature extraction to obtain the first feature and the second feature of the abnormal log. Generate a unique log ID for the abnormal log, and classify and store the abnormal log based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization; extract features from the preprocessed abnormal logs to obtain malicious identifiers and abnormal behaviors, which are used as the first feature and the second feature of the abnormal logs, respectively; wherein, the first feature includes one or more of the malicious identifiers, and the second feature includes one or more of the abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

3. The network security investigation and operation control method based on node logs according to claim 2, characterized in that, In step S20, a virtual node ID is preset to obtain an association mapping library; based on the first feature of the abnormal log, the abnormal log is associated and mapped to the virtual node ID in the association mapping library, and the first feature of the abnormal log is replaced with the virtual node ID, including: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifiers from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain an association mapping library; If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

4. The network security investigation and operation control method based on node logs according to claim 3, characterized in that, In step S30, the node to be configured and its corresponding first feature are obtained, and the first feature of the node to be configured is matched with the virtual node ID to obtain the corresponding virtual node ID; Based on the corresponding virtual node ID, the first running strategy file includes: Obtain the node to be configured and its corresponding first feature; match the first feature corresponding to the node to be configured with the virtual node ID in the association mapping library to obtain the virtual node ID associated with the node to be configured. The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

5. The network security investigation and operation control method based on node logs according to claim 3, characterized in that, In step S40, the real-time logs of the target node are obtained, and the real-time logs are subjected to feature extraction and classification storage. Then, match and query the virtual node ID associated with the real-time log to obtain the analysis log file; Based on the analysis log file, the second running strategy file includes: The system acquires real-time logs from the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as a key, a second hash table is used to classify and store the real-time logs, with the first key-value pairs of the second hash table used to store the first feature. In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain an analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filename of the analysis log file and the filename of the abnormal logs associated with the second feature of the real-time log are obtained. According to the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain a second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

6. A network security investigation and operation control system based on node logs, characterized in that, It includes the following modules: The first abnormal log processing module is used to obtain the abnormal logs of the target node and extract features from the abnormal logs to obtain the first feature and the second feature of the abnormal logs. Generate a unique log ID for the abnormal log, and classify and store the abnormal log based on the first feature, the second feature, and the log ID; The association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library; The second abnormal log processing module is used to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and replace the first feature of the abnormal log with the virtual node ID; The node to be configured processing module is used to obtain the node to be configured and its corresponding first feature, and match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID; The first runtime strategy file generation module is used to obtain the first runtime strategy file based on the corresponding virtual node ID; The real-time log processing module is used to acquire the real-time logs of the target node, and to extract features from and classify the real-time logs for storage. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain the analysis log file; and to obtain the second operation strategy file based on the analysis log file.

7. The network security investigation and operation control system based on node logs according to claim 6, characterized in that: The first abnormal log processing module is used to obtain the abnormal log of the target node and extract features from the abnormal log to obtain the first feature and the second feature of the abnormal log. Generate a unique log ID for the abnormal log, and classify and store the abnormal log based on the first feature, the second feature, and the log ID, including: Obtain the abnormal logs of the target node, and preprocess the abnormal logs, including filtering, normalization and standardization; extract features from the preprocessed abnormal logs to obtain malicious identifiers and abnormal behaviors, which are used as the first feature and the second feature of the abnormal logs, respectively; wherein, the first feature includes one or more of the malicious identifiers, and the second feature includes one or more of the abnormal behaviors. A unique log ID is generated for each of the preprocessed abnormal logs, and the abnormal logs are classified and stored using a first hash table with the second feature of the abnormal log as the key. The first key-value pair of the first hash table is used to store the log ID, and the second key-value pair is used to store the first feature of the abnormal log.

8. The network security investigation and operation control system based on node logs according to claim 7, characterized in that: The association mapping library generation module is used to preset virtual node IDs and obtain the association mapping library, including: Obtain known malicious identifiers, create a virtual node ID for malicious identifiers from the same source, and use the malicious identifiers from the same source as a preset first feature; create an empty mapping table, and write the preset first feature and its association mapping relationship with the virtual node ID into the empty mapping table to obtain an association mapping library; The second abnormal log processing module is configured to associate and map the abnormal log to the virtual node ID in the association mapping library based on the first feature of the abnormal log, and to replace the first feature of the abnormal log with the virtual node ID, including: If any of the malicious identifiers in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then the first feature corresponding to the log ID is replaced with the virtual node ID, and a filename containing the virtual node ID is created for the abnormal log corresponding to the log ID; if no malicious identifier in the first feature corresponding to the log ID is associated with a virtual node ID in the association mapping library, then a new virtual node ID is created for the first feature, the first feature and its association mapping relationship with the new virtual node ID are written into the association mapping library, then the first feature corresponding to the log ID is replaced with the new virtual node ID, and a filename containing the new virtual node ID is created for the abnormal log corresponding to the log ID.

9. The network security investigation and operation control system based on node logs according to claim 8, characterized in that: The node-to-be-configured processing module is used to obtain the node to be configured and its corresponding first feature, and to match the first feature of the node to be configured with the virtual node ID to obtain the corresponding virtual node ID, including: Obtain the node to be configured and its corresponding first feature; match the first feature corresponding to the node to be configured with the virtual node ID in the association mapping library to obtain the virtual node ID associated with the node to be configured. The first runtime strategy file generation module is used to obtain a first runtime strategy file based on the corresponding virtual node ID, including: The associated virtual node ID is matched and queried in the first hash table to obtain the log ID associated with the associated virtual node ID; the corresponding abnormal log is obtained according to the log ID, and the second feature of the corresponding abnormal log is obtained; based on the second feature of the corresponding abnormal log, an operation strategy corresponding to the second feature of the corresponding abnormal log is generated; the operation strategy is integrated to obtain the first operation strategy file.

10. The network security investigation and operation control system based on node logs according to claim 8, characterized in that: The real-time log processing module is used to acquire the real-time logs of the target node, and to perform feature extraction and classification storage on the real-time logs, including: The system acquires real-time logs from the target node and preprocesses them, including filtering, normalization, and standardization. It then extracts features from the preprocessed logs to identify malicious identifiers and abnormal behaviors, which are used as the first and second features of the logs, respectively. The first feature includes one or more malicious identifiers, and the second feature includes one or more abnormal behaviors. Finally, using the second feature as a key, a second hash table is used to classify and store the real-time logs, with the first key-value pairs of the second hash table used to store the first feature. The second operation strategy file generation module is used to match and query the virtual node ID associated with the real-time log to obtain an analysis log file; based on the analysis log file, the second operation strategy file is obtained, including: In the associated mapping library, the first feature of the real-time log is matched with the virtual node ID to find all corresponding virtual node IDs. The first feature of the real-time log is then replaced with all the corresponding virtual node IDs to obtain an analysis log file. A filename containing all the corresponding virtual node IDs is created for the analysis log file. Based on the second feature of the real-time log, a matching query is performed in the first hash table to obtain the abnormal logs associated with the second feature of the real-time log. The filename of the analysis log file and the filename of the abnormal logs associated with the second feature of the real-time log are obtained. According to the correspondence of virtual node IDs in the filenames, all abnormal logs associated with the analysis log file are obtained. All associated abnormal logs are read to obtain the corresponding historical processing records. The historical processing records are integrated to obtain a second running strategy file. The historical processing records include effective strategies implemented in the past for the abnormal behavior of the abnormal logs.

Images