Risk behavior detection and alarm method and system based on log analysis
By employing distributed log collection, multi-dimensional feature engineering, and logistic regression models, combined with lightweight model inference and dynamic alerts, the high false alarm rate and poor scalability of existing technologies for identifying risky operations have been resolved, enabling accurate identification and rapid handling of risky behaviors in the system.
Patent Information
- Application Number
- CN202511760858.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-27
- Publication Date
- 2026-02-13
AI Technical Summary
In existing technologies, risk operation identification relies on manually configured rules, which cannot adapt to dynamically changing attack patterns and suffers from problems such as high false positive rates, data silos, and poor scalability.
By using distributed log collection, multi-dimensional feature engineering, and logistic regression models, combined with lightweight model inference and dynamic alerts, we can achieve accurate identification and rapid handling of risky behaviors in the system.
It achieves high real-time performance, low resource consumption, low false alarm rate and high scalability, supports elastic scaling in cloud environments, and is suitable for scenarios with tens of millions of log throughput.
Smart Images
Figure CN121530692A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of big data security analysis and big model technology, in particular to a risk behavior detection and alarm method and system based on log analysis. BACKGROUND
[0002] In the prior art, risk operation recognition mainly relies on manual configuration of rules (such as fixed threshold alarm, IP blacklist), which has the following defects:
[0003] 1. Rule rigidity: unable to adapt to dynamically changing attack patterns, lack of multi-dimensional correlation analysis, high false positive rate.
[0004] 2. Data silos: logs are scattered in multiple source systems (such as application logs, database logs), lack of unified analysis.
[0005] 3. Poor scalability: in a cloud computing environment, unable to dynamically adapt to changes in business size. SUMMARY
[0006] The technical task of the present application is to solve the above problems, and provide a risk behavior detection and alarm method and system based on log analysis, which can realize accurate identification and rapid disposal of system risk behavior.
[0007] The technical solution adopted by the present application to solve its technical problems is:
[0008] A risk behavior detection and alarm method based on log analysis, the implementation of the method includes:
[0009] Log collection: real-time capture of multi-source logs through distributed agents and standardization;
[0010] Feature engineering: extract time, behavior, statistics and session features and build feature vectors; the time feature, calculate the operation interval and non-working period mark; the behavior feature, statistics high-frequency operation and geographical location difference; the session feature, analyze the session duration and operation sequence pattern;
[0011] Logistic regression model inference: use a logistic regression model to output a risk score based on the feature vector;
[0012] Hierarchical alarm: trigger different levels of alarm according to the risk score.
[0013] This method uses big data analysis technology, combined with a logistic regression model to perform real-time scanning and risk identification on business system logs. Through distributed log collection, multi-dimensional feature engineering, lightweight model inference and dynamic alarm response, accurate identification and real-time alarm of high-risk operations are realized.
[0014] Further, the log collection distributes the logs to multiple processing nodes using a hash algorithm to balance the load.
[0015] Using a virtual node mechanism, the logs are evenly distributed to multiple log processing nodes according to the operation user ID using a hash algorithm, supporting horizontal expansion and balancing the load.
[0016] Further, the multi-source logs include database, application, API interface logs, and support formats including JSON, CSV, text, etc.
[0017] The collected log formats are standardized: first, unify the log time format to UTC format (YYYY-MM-DDTHH:mm:ss), and extract key fields including user ID, access system name, operation type, IP address, resource access path, operation result status, etc.; and fill in missing values, using default values or null values to mark.
[0018] Further, the feature engineering specifically includes:
[0019] Time features:
[0020] Calculate the time interval of the user's continuous operation, set a threshold in the system, and mark it as abnormal if the threshold time is exceeded; the threshold can be dynamically adjusted according to the historical data statistics mean ± 3σ;
[0021] Determine whether the operation performed by the user occurs during non-working hours or sensitive time periods such as early morning, and the time window can be customized;
[0022] Behavioral features:
[0023] Statistical sensitive operation types of the user within a preset time window (1 hour, 1 day), including: the number of consecutive login failures is greater than the set number, high-frequency access to sensitive resources, download data, etc.
[0024] Record the user's IP address, detect the difference between the IP attribution and the commonly used attribution location, and compare the IP attribution by calling the IP geographic location API; if the difference exceeds the threshold (cross-network segment, cross-province, cross-domain) after comparison, an abnormality is triggered;
[0025] Statistical features:
[0026] Calculate the success rate of the user's operation, if the failure rate is greater than 80% in the continuous execution of N operations, consider it as illegal access operation, and mark it as abnormal;
[0027] Support adaptive dynamic adjustment of the size of N value according to the user's historical behavior pattern;
[0028] Check the matching degree of permissions and operations. If a user with low permissions attempts to access functions or resource operations outside the scope of their permissions or has permission change operations, a high-risk flag is triggered.
[0029] Session characteristics:
[0030] Analyze the duration of the user's session. If the duration of the user's session exceeds the threshold, mark it as an abnormally long session. Support dynamic adjustment of the threshold according to the role the user is assigned, such as allowing an administrator's session to be up to 24 hours long.
[0031] Detect the user's operation sequence pattern and analyze it through a rule engine to identify abnormal behavior chains, such as: login -> modify user permissions -> perform delete operations; Use regular expressions to match operation sequences within the system.
[0032] Further, the logistic regression model has the following hyperparameter settings: C=1.0, max_iter=100, solver='liblinear', and is deployed through the ONNX format.
[0033] Further, the logistic regression model inference implementation includes:
[0034] (1) Logistic regression model construction: the input feature vector contains the following dimensions:
[0035] Time characteristics: time interval, non-working period marker;
[0036] Behavior characteristics: operation type encoding, sensitive operation frequency;
[0037] Statistical characteristics: user operation success rate, user operation permission matching degree;
[0038] Session characteristics: user continuous session duration, user operation sequence pattern matching score in the system;
[0039] (2) Parameter tuning:
[0040] Set the logistic regression hyperparameters as follows:
[0041] Regularization coefficient C=1.0 (L2 regularization);
[0042] Optimizer solver='liblinear' to adapt to small sample data;
[0043] Set the maximum number of iterations max_iter=100 to avoid overfitting.
[0044] The model deployment method is as follows:
[0045] Lightweight inference: convert the trained logistic regression model into ONNX format, and realize inference delay <50ms through MegEngine Lite;
[0046] Dynamic scaling deployment: encapsulate the inference service using a container, use a Kubernetes cluster, and dynamically adjust the number of pods according to QPS.
[0047] Further, the hierarchical alarm:
[0048] The logistic regression model determines different risk level grades according to the generated classification result score, calls the corresponding message communication interface, and sends different alarm modes such as internal messages, short messages and emails;
[0049] Meanwhile, the classification result generated by the model is written into the database, and the data is visualized and analyzed according to the historical classification result.
[0050] The application also claims to protect a risk behavior detection and alarm system based on log analysis, comprising:
[0051] The log collection module is used for real-time grabbing of multi-source logs and standardization through a distributed agent;
[0052] The feature engineering module is used for extracting time, behavior, statistics and session features to construct a feature vector;
[0053] The logistic regression model inference module is used for outputting a risk score based on the feature vector;
[0054] The hierarchical alarm module triggers different levels of alarms according to the risk score;
[0055] The system can realize the above method.
[0056] The application also claims to protect a risk behavior detection and alarm device based on log analysis, comprising: at least one memory and at least one processor;
[0057] The at least one memory is used for storing machine readable programs;
[0058] The at least one processor is used for calling the machine readable programs to realize the above method.
[0059] The application also claims to protect a computer readable medium, and the computer readable medium stores computer instructions, and the computer instructions realize the above method when executed by a processor.
[0060] Compared with the prior art, the risk behavior detection and alarm method and system based on log analysis of the application have the following beneficial effects:
[0061] 1. High real-time, through distributed collection and lightweight inference, millisecond-level response can be realized.
[0062] 2. Low resource consumption, compared with deep learning model, the logic regression model reduces 90% of GPU resource demand.
[0063] 3. High expansibility: support elastic expansion in cloud environment, adapt to ten million level log swallowing scene.
[0064] 4. Accurate identification: through multi-dimensional feature fusion, the false alarm rate is greatly reduced.
[0065] 5. Compatibility: slight or no modification of business system is needed, only need to deploy log collection agent to access. BRIEF DESCRIPTION OF DRAWINGS
[0066] Figure 1 It is the risk behavior detection and alarm method flow chart based on log analysis provided by the embodiment of the application. DETAILED DESCRIPTION
[0067] The application will be further described below in combination with the drawings and specific embodiments.
[0068] The embodiment of the application provides a risk behavior detection and alarm method based on log analysis, and the implementation of the method comprises the following steps:
[0069] Log collection: through distributed agent, real-time grabbing of multi-source logs and standardization;
[0070] Feature engineering: extracting time, behavior, statistics and session features and constructing feature vectors; the time feature, calculating the operation interval and non-working period mark; the behavior feature, statistics of high-frequency operation and geographical position difference; the session feature, analysis of session duration and operation sequence mode;
[0071] Logic regression model inference: adopting a logic regression model, outputting a risk score based on the feature vector;
[0072] Hierarchical alarm: triggering different levels of alarms according to the risk score.
[0073] The log collection adopts a hash algorithm to distribute logs to multiple processing nodes to balance the load.
[0074] The model inference module adopts a logic regression model, the hyperparameters of which are set as C=1.0, max_iter=100, solver='liblinear', and is deployed through the ONNX format.
[0075] The authentication plug-in supports multiple authentication modes such as password authentication, biometric authentication, hardware token authentication and the like.
[0076] Through four core modules of multi-source log real-time collection, multi-dimensional feature engineering, lightweight model inference, hierarchical alarm and automatic response, accurate identification and rapid disposal of system risk behavior are realized.
[0077] The specific implementation of the method is as follows:
[0078] 1. Log collection
[0079] Through distributed log agent (such as Fluentd), multi-source audit logs (including database, application, API interface logs) are real-time captured, supporting JSON, CSV, text and other formats.
[0080] The collected log format is standardized, the time format of the log is unified as UTC format (YYYY-MM-DDTHH:mm:ss), and key fields such as user ID, access system name, operation type, IP address, resource access path, operation result status, etc. are extracted. And fill in the missing values, use default value or empty value to mark.
[0081] When deploying the log collection module, use the virtual node mechanism, use the hash algorithm, and distribute the logs to multiple log processing nodes according to the operation user ID, support horizontal expansion, and balance the load.
[0082] 2. Feature engineering
[0083] (1) Time feature:
[0084] Calculate the time interval of user continuous operation, set threshold in the system, more than 200 seconds is marked as abnormal, threshold can be dynamically adjusted according to historical data statistics mean ± 3σ.
[0085] Determine whether the operation of the user is performed in non-working hours or sensitive time periods such as early morning, and the time window can be customized.
[0086] (2) Behavior feature:
[0087] Statistical sensitive operation types of users within a preset time window (1 hour, 1 day), such as: the number of consecutive login failures is greater than how many times, high-frequency access to sensitive resources, download data and other operations.
[0088] Record the IP address of the user, detect the difference between the IP attribution and the commonly used attribution location, call the IP geographic location API to compare the IP attribution, if the difference after comparison exceeds the threshold (cross network segment, cross province, cross domain), trigger abnormal mark.
[0089] (3) Statistical feature:
[0090] Calculate the success rate of user operations. If the failure rate is greater than 80% in N consecutive operations, it is considered an illegal access operation and marked as an exception.
[0091] It supports adaptive and dynamic adjustment of the N value based on the user's historical behavior patterns.
[0092] Check the matching degree between permissions and operations. For example, if a user with low permissions attempts to access functions or resources with high permissions or outside the scope of their permissions, or if there is a permission change operation, a high-risk flag will be triggered.
[0093] (4) Conversation characteristics:
[0094] Analyze the duration of user sessions. If a user's session duration exceeds a threshold such as 8 hours, it is marked as an abnormally long session. The threshold can be dynamically adjusted based on the user's assigned role. For example, an administrator session is allowed a maximum of 24 hours.
[0095] The system detects user action sequences and identifies abnormal behavior chains through a pre-developed rule engine, such as: login -> modify user permissions -> perform a deletion operation. Regular expressions are used within the system to match these action sequences.
[0096] 3. Model Training and Inference
[0097] (1) Logistic Regression Model Construction:
[0098] The input feature vector contains the following dimensions:
[0099] Time characteristics: time interval, non-working period markers.
[0100] Behavioral characteristics: operation type encoding, number of sensitive operations.
[0101] Statistical characteristics: success rate of user operations and matching degree of user operation permissions.
[0102] Session characteristics: duration of continuous user sessions and pattern matching score of user's operation sequence within the system.
[0103] (2) Parameter tuning:
[0104] Set the logistic regression hyperparameters as follows:
[0105] The regularization coefficient C = 1.0 (L2 regularization).
[0106] The optimizer solver='liblinear' is set to work with small sample data.
[0107] Set the maximum number of iterations max_iter = 100 to avoid overfitting.
[0108] 4. Model Deployment
[0109] Lightweight inference: The trained logistic regression model is converted to ONNX format, and inference latency of <50ms is achieved through MegEngine Lite.
[0110] Dynamic scaling deployment: The inference service is encapsulated using Docker, and the number of Pods is dynamically adjusted based on QPS using a Kubernetes cluster.
[0111] 5. Tiered alarm
[0112] The inference model scores the generated classification results and determines different risk levels, then calls the corresponding message communication interface to send different alarm methods such as in-site messages, SMS, and emails.
[0113] Simultaneously, the classification results generated by the model are written into the database, and the data is visualized and analyzed based on historical classification results.
[0114] This method utilizes big data analytics combined with a logistic regression model to perform real-time scanning and risk identification of business system logs. Through distributed log collection, multi-dimensional feature engineering, lightweight model inference, and dynamic alarm response, it achieves accurate identification and real-time alerts for high-risk operations.
[0115] This method can detect risky behaviors with little or no modification to the business system, and solves existing technical problems through the following innovations:
[0116] Lightweight integration: Supports direct log collection by distributed log brokers such as Fluentd, with minimal or no modification to business system code.
[0117] Multi-dimensional feature engineering: Combining time, behavior, statistics, and conversation features to improve the model's generalization ability.
[0118] Low-latency inference: Deployed with MegEngine Lite via ONNX format, achieving millisecond-level response times.
[0119] Dynamic scaling: Containerized deployment based on Kubernetes clusters, supporting elastic scaling.
[0120] This invention also provides a risk behavior detection and alerting system based on log analysis, comprising:
[0121] The log collection module is used to capture and standardize multi-source logs in real time through a distributed agent.
[0122] The feature engineering module is used to extract time, behavior, statistics, and conversation features to construct feature vectors.
[0123] The logistic regression model inference module is used to output risk scores based on feature vectors.
[0124] The tiered alarm module triggers alarms of different levels based on risk scores.
[0125] The log collection process uses a hash algorithm to distribute logs to multiple processing nodes to balance the load.
[0126] The model inference module adopts a logistic regression model with hyperparameters set to C=1.0, max_iter=100, and solver='liblinear', and is deployed in ONNX format.
[0127] This system can implement the risk behavior detection and alarm method based on log analysis described in the above embodiments.
[0128] 1. Log collection module
[0129] Real-time capture of multi-source audit logs (including database, application, and API interface logs) via distributed log brokers (such as Fluentd), supporting formats such as JSON, CSV, and text.
[0130] The collected log formats are standardized. First, the log time format is unified to UTC format (YYYY-MM-DDTHH:mm:ss), and key fields such as user ID, accessed system name, operation type, IP address, resource access path, and operation result status are extracted. Missing values are filled in, and default values or empty values are used for marking.
[0131] When deploying the log collection module, a virtual node mechanism is adopted, using a hash algorithm to evenly distribute logs to multiple log processing nodes based on the user ID, supporting horizontal scaling and achieving load balancing.
[0132] 2. Feature Engineering Module
[0133] (1) Temporal characteristics:
[0134] Calculate the time interval between consecutive user operations, set a threshold within the system, and mark it as abnormal if it exceeds the threshold by 200 seconds. The threshold can be dynamically adjusted based on the historical data statistical average ±3σ.
[0135] To determine whether a user's action occurred outside of working hours or during sensitive periods such as the early morning, a customizable time window can be used.
[0136] (2) Behavioral characteristics:
[0137] The system tracks the types of sensitive user actions within a preset time window (1 hour, 1 day), such as: the number of consecutive failed login attempts, high-frequency access to sensitive resources, and data downloads.
[0138] Record the user's IP address, detect the difference between the IP location and the commonly used location, and compare the IP location by calling the IP geolocation API. If the difference exceeds the threshold (cross network segment, cross province, cross domain), an anomaly flag is triggered.
[0139] (3) Statistical characteristics:
[0140] Calculate the success rate of user operations. If the failure rate is greater than 80% in N consecutive operations, it is considered an illegal access operation and marked as an exception.
[0141] It supports adaptive and dynamic adjustment of the N value based on the user's historical behavior patterns.
[0142] Check the matching degree between permissions and operations. For example, if a user with low permissions attempts to access functions or resources with high permissions or outside the scope of their permissions, or if there is a permission change operation, a high-risk flag will be triggered.
[0143] (4) Conversation characteristics:
[0144] Analyze the duration of user sessions. If a user's session duration exceeds a threshold such as 8 hours, it is marked as an abnormally long session. The threshold can be dynamically adjusted based on the user's assigned role. For example, an administrator session is allowed a maximum of 24 hours.
[0145] The system detects user action sequences and identifies abnormal behavior chains through a pre-developed rule engine, such as: login -> modify user permissions -> perform a deletion operation. Regular expressions are used within the system to match these action sequences.
[0146] 3. Model Training and Inference Module
[0147] (1) Logistic Regression Model Construction:
[0148] The input feature vector contains the following dimensions:
[0149] Time characteristics: time interval, non-working period markers.
[0150] Behavioral characteristics: operation type encoding, number of sensitive operations.
[0151] Statistical characteristics: success rate of user operations and matching degree of user operation permissions.
[0152] Session characteristics: duration of continuous user sessions and pattern matching score of user's operation sequence within the system.
[0153] (2) Parameter tuning:
[0154] Set the logistic regression hyperparameters as follows:
[0155] The regularization coefficient C = 1.0 (L2 regularization).
[0156] The optimizer solver='liblinear' is set to work with small sample data.
[0157] Set the maximum number of iterations max_iter = 100 to avoid overfitting.
[0158] 4. Model Deployment
[0159] Lightweight inference: The trained logistic regression model is converted to ONNX format, and inference latency of <50ms is achieved through MegEngine Lite.
[0160] Dynamic scaling deployment: The inference service is encapsulated using Docker, and the number of Pods is dynamically adjusted based on QPS using a Kubernetes cluster.
[0161] 5. Alarm Module
[0162] The inference model scores the generated classification results and determines different risk levels, then calls the corresponding message communication interface to send different alarm methods such as in-site messages, SMS, and emails.
[0163] Simultaneously, the classification results generated by the model are written into the database, and the data is visualized and analyzed based on historical classification results.
[0164] Log collection module: Supports real-time capture and standardized processing of multi-source heterogeneous logs;
[0165] Feature engineering: Extracting time, behavior, statistics, and conversation features to construct high-dimensional feature vectors;
[0166] Logistic regression model: Model parameters are optimized through cross-validation, and low-latency inference is achieved by combining the ONNX format;
[0167] Dynamic alarm mechanism: Alarms are triggered and automatic blocking is implemented based on risk score classification.
[0168] This system is highly scalable in cloud computing environments, can reduce the false alarm rate to below 5%, and has a response latency of less than 50ms, making it suitable for high-security scenarios such as finance and government.
[0169] This invention also provides a risk behavior detection and alarm device based on log analysis, comprising: at least one memory and at least one processor;
[0170] The at least one memory is used to store a machine-readable program;
[0171] The at least one processor is used to call the machine-readable program to implement the risk behavior detection and alarm method based on log analysis described in the above embodiments.
[0172] This invention also provides a computer-readable medium storing computer instructions. When executed by a processor, these computer instructions implement the risk behavior detection and alarm method based on log analysis described in the above embodiments. Specifically, a system or apparatus equipped with a storage medium storing software program code that implements the functions of any of the embodiments described above, and enabling the computer (or CPU or MPU) of the system or apparatus to read and execute the program code stored in the storage medium.
[0173] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.
[0174] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.
[0175] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.
[0176] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.
[0177] The present invention has been shown and described in detail above with reference to the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above embodiments, those skilled in the art will know that more embodiments of the present invention can be obtained by combining the code review methods in the different embodiments. These embodiments are also within the protection scope of the present invention.
Claims
1. A method for detecting and alerting risky behaviors based on log analysis, characterized in that, The implementation of this method includes: Log collection: Real-time capture and standardization of logs from multiple sources via a distributed proxy; Feature engineering: Extracting time, behavior, statistics, and session features and constructing feature vectors; the time features include calculating operation intervals and marking non-working periods; the behavior features include statistically analyzing high-frequency operations and geographical location differences; the session features include analyzing session duration and operation sequence patterns. Logistic Regression Model Inference: A logistic regression model is used to output a risk score based on feature vectors; Tiered alerts: Different levels of alerts are triggered based on risk scores.
2. The risk behavior detection and alerting method based on log analysis according to claim 1, characterized in that, The log collection process uses a hash algorithm to distribute logs to multiple processing nodes to balance the load.
3. A risk behavior detection and alarm method based on log analysis according to claim 1 or 2, characterized in that, Multi-source logs include database, application, and API interface logs, and support formats including JSON, CSV, and text; The collected log formats are standardized: the time format of the logs is unified to UTC format, and key fields are extracted, including user ID, access system name, operation type, IP address, resource access path, and operation result status; missing values are filled in, and default values or empty values are used for marking.
4. The risk behavior detection and alarm method based on log analysis according to claim 1, characterized in that, The feature engineering specifically includes: Time characteristics: Calculate the time interval between consecutive user operations, set a threshold within the system, and mark it as abnormal if the time exceeds the threshold. Determine whether the user's operation occurred outside of working hours and during sensitive time periods; Behavioral characteristics: The system tracks the types of sensitive user actions within a preset time window, including consecutive failed login attempts exceeding a set number, frequent access to sensitive resources, and data downloads. Record the user's IP address, detect the difference between the IP location and the commonly used location, and compare the IP location by calling the IP geolocation API. If the difference exceeds the threshold after comparison, an anomaly flag is triggered. Statistical characteristics: Calculate the success rate of user operations. If the failure rate is greater than 80% in N consecutive operations, it is considered an illegal access operation and marked as an exception. Supports adaptive and dynamic adjustment of the N value based on the user's historical behavior patterns; Check the matching degree between permissions and operations. If a user with low permissions attempts to access functions or resources with high permissions or outside the scope of their permissions, or performs a change operation that they have permission to perform, a high-risk flag will be triggered. Session characteristics: Analyze user session duration; if a user's session duration exceeds a threshold, it is marked as an abnormally long session; support dynamically adjusting the threshold based on the user's assigned role. The system detects user operation sequence patterns and analyzes and identifies abnormal behavior chains through a compiled rule engine; regular expressions are used within the system to match operation sequences.
5. The risk behavior detection and alarm method based on log analysis according to claim 1, characterized in that, The logistic regression model has hyperparameters set to C=1.0, max_iter=100, and solver='liblinear', and is deployed in ONNX format.
6. The risk behavior detection and alarm method based on log analysis according to claim 1, characterized in that, The specific implementation of logistic regression model inference includes: (1) Logistic Regression Model Construction: The input feature vector contains the following dimensions: Time characteristics: time interval, non-working period markers; Behavioral characteristics: Operation type encoding, number of sensitive operations; Statistical characteristics: success rate of user operations, matching degree of user operation permissions; Session characteristics: duration of continuous user sessions, and pattern matching score of user's operation sequence within the system; (2) Parameter tuning: Set the logistic regression hyperparameters as follows: The regularization coefficient C = 1.0; The optimizer `solver='liblinear'` is used to adapt to small sample data; Set the maximum number of iterations max_iter = 100 to avoid overfitting. The model deployment method is as follows: Lightweight inference: The trained logistic regression model is converted to ONNX format, and inference latency of <50ms is achieved through MegEngine Lite; Dynamic scaling deployment: The inference service is encapsulated using containers, and the number of Pods is dynamically adjusted based on QPS using a Kubernetes cluster.
7. The risk behavior detection and alarm method based on log analysis according to claim 1, characterized in that, The tiered alarm: The logistic regression model scores the generated classification results and determines different risk levels, then calls the corresponding message communication interface to send alarms in different ways. Simultaneously, the classification results generated by the model are written into the database, and the data is visualized and analyzed based on historical classification results.
8. A risk behavior detection and alarm system based on log analysis, characterized in that, include: The log collection module is used to capture and standardize multi-source logs in real time through a distributed agent; The feature engineering module is used to extract time, behavior, statistics, and conversation features to construct feature vectors; The logistic regression model inference module is used to output risk scores based on feature vectors. The tiered alarm module triggers alarms of different levels based on risk scores. The system is capable of implementing the method described in any one of claims 1 to 7.
9. A risk behavior detection and alarm device based on log analysis, characterized in that, include: At least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to invoke the machine-readable program to implement the method according to any one of claims 1 to 7.
10. A computer-readable medium, characterized in that, The computer-readable medium stores computer instructions that, when executed by a processor, implement the method described in any one of claims 1 to 7.