User internet log processing method and device based on large model, and computer program product

Abstract

The invention discloses a user internet surfing log processing method and device based on a large model and a computer program product. The method comprises the steps that the multi-mode fusion capability of a universal large model, a code large model and a multi-mode large model is utilized; according to the method, the target internet surfing log data generated based on the internet surfing behavior of the target user is efficiently converted from unstructured data to structured information, and then accurate classification of the intranet target internet surfing log data and the extranet target internet surfing log data and intelligent summarization of website content are completed; through statistical analysis of summarized intranet target internet surfing log data and service type labels and service content introductions thereof, and extranet target internet surfing log data and website classification labels and website content introductions thereof, a classification result (for example, whether the internet surfing behaviors belong to negative and slowdown behaviors or not) of the internet surfing behaviors of the target user is determined more accurately; therefore, the processing efficiency and accuracy of the target internet surfing log can be improved based on cooperative processing of a plurality of large models.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of natural language processing, and particularly relates to a user online log processing method based on a large model, equipment and a computer program product. BACKGROUND

[0002] With the continuous development of artificial intelligence (AI) and Internet technology, the application scenarios of human-computer interaction are becoming more and more extensive, and more and more users conduct office work, entertainment and shopping through the Internet. Among them, the processing of user online logs has become a crucial link in network management and security operation.

[0003] At present, there are usually three ways to process user online logs: the first is a log analysis and classification mode dominated by artificial, which completely relies on artificial experience, is not only low in efficiency, but also prone to classification errors when relying on rules to judge in the face of massive log data, and cannot meet the needs of large-scale network management. The second is a log processing mode based on a simple rule-driven log processing system, in which the flexibility of the processing system is poor, and in the massive data scenario, classification errors often occur due to incomplete rule coverage, which cannot meet the needs of large-scale network management. It is also unable to adapt to scenarios where website content changes dynamically. Once the website function is upgraded or the content is updated, the fixed rules cannot be iterated synchronously, resulting in lagging or even invalid classification results, making it difficult to accurately identify the real properties of the website. In addition, the processing system cannot accurately classify complex and diverse external domain name types, and it is also difficult to effectively identify the negative and lazy work behavior of employees with strong concealment, which has obvious shortcomings in network behavior refinement management. The third is a log processing mode assisted by a single AI model, but this mode also has obvious shortcomings. On the one hand, the analysis capability of a single AI model is limited, and when facing non-standardized txt log data, it is prone to analysis errors, and lacks an automatic optimization mechanism. On the other hand, in the domain name classification link, the judgment of a single AI model is easily affected by data bias, and the classification accuracy is insufficient, which cannot guarantee the reliability of the classification results. It can be seen that the existing three methods for processing user online logs all have major problems, which will affect the final processing effect. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide a user online log processing method based on a large model, equipment and a computer program product, which can be based on the cooperative processing of multiple large language models (LLM) to improve the processing efficiency and accuracy of user online logs, so as to achieve an ideal processing effect.

[0005] The embodiments of the present application provide a user online log processing method based on a large model, comprising:

[0006] Obtaining target online log data generated based on the target user online behavior, and parsing the target online log data by using a general large model and a code large model to obtain parsed structured target online log data;

[0007] Classifying the structured target online log data to obtain intranet target online log data and extranet target online log data;

[0008] Based on an intranet service matching rule library, matching a service type label and a service content introduction for the intranet target online log data according to a network address identifier;

[0009] Using an extranet website classification database, matching a website classification label and a website content introduction for the extranet target online log data according to a network address identifier; and using a general large model to determine a website classification label for the extranet target online log data for which matching fails, and using a multi-modal large model to generate a website content introduction for the extranet target online log data for which matching fails;

[0010] Statistically analyzing the intranet target online log data and the service type label and the service content introduction thereof, and the extranet target online log data and the website classification label and the website content introduction thereof, and determining a classification result of the target user online behavior according to a statistical analysis result obtained.

[0011] In a possible implementation manner, the parsing of the target online log data by using the general large model and the code large model to obtain the parsed structured target online log data includes:

[0012] Generating a sampling instruction by using the target online log data, inputting the sampling instruction to a general large model for sample sampling processing to obtain sample sampling data corresponding to the target online log data;

[0013] Generating a parsing instruction by using the sample sampling data, inputting the parsing instruction to a code large model for log parsing script generation processing to obtain a structured parsing script;

[0014] Performing parsing processing on the target online log data by using the structured parsing script to obtain the parsed structured target online log data.

[0015] In a possible implementation manner, the parsing of the target online log data by using the general large model and the code large model to obtain the parsed structured target online log data includes:

[0016] The target online log data is parsed by using a pre-stored structured parsing script to obtain parsed structured target online log data, wherein the structured parsing script is pre-generated by using a general large model and a code large model.

[0017] In a possible implementation manner, the structured target online log data is classified to obtain intranet target online log data and extranet target online log data, and the classification includes:

[0018] Target online log data with a network address identifier matching an intranet network segment identifier is filtered from the structured target online log data as intranet target online log data, and target online log data that fails to match is taken as extranet target online log data.

[0019] In a possible implementation manner, the general large model is used to determine a website classification label for the extranet target online log data that fails to match, and the multi-modal large model is used to generate a website content introduction for the extranet target online log data that fails to match, and the implementation includes:

[0020] The N general large models are used to form a voting large model to vote for the website classification of the extranet target online log data that fails to match, and a voting result of each website classification label is counted by using an indicator function, so as to determine the website classification label corresponding to the extranet target online log data that fails to match according to the counting result; N is a positive odd number greater than 1.

[0021] The website classification label and the network address identifier of the extranet target online log data are used to generate a prompt instruction, which is input to the multi-modal large model for generation of the website content introduction, to obtain the website content introduction corresponding to the extranet target online log data that fails to match.

[0022] In a possible implementation manner, after the general large model is used to determine the website classification label for the extranet target online log data that fails to match, and the multi-modal large model is used to generate the website content introduction for the extranet target online log data that fails to match, the method further includes:

[0023] The extranet website classification database is updated by using the website classification label and the website content introduction corresponding to the extranet target online log data that fails to match, to obtain an updated extranet website classification database.

[0024] In a possible implementation manner, after the intranet target online log data, the service type label and the service content introduction thereof, and the extranet target online log data, the website classification label and the website content introduction thereof are statistically analyzed, and the classification result of the target user online behavior is determined according to the obtained statistical analysis result, the method further includes:

[0025] When it is judged that the classification result of the target user's online behavior belongs to the preset negative slacking behavior classification, a negative slacking warning prompt information is sent to the target user.

[0026] In a possible implementation manner, the network address identifier comprises at least one of an Internet Protocol (IP) address and a domain name.

[0027] The embodiment of the application further provides a user online log processing device based on a large model, comprising a processor, a memory and a system bus.

[0028] The processor and the memory are connected through the system bus.

[0029] The memory is used for storing one or more programs, and the one or more programs comprise instructions, which, when executed by the processor, cause the processor to execute any one of the implementation manners of the above-mentioned user online log processing method based on a large model.

[0030] The embodiment of the application further provides a computer program product, which, when running on a terminal device, causes the terminal device to execute any one of the implementation manners of the above-mentioned user online log processing method based on a large model.

[0031] The embodiment of the application provides a user online log processing method, device and computer program product based on a large model. First, target online log data generated based on a target user's online behavior is acquired, and the target online log data is parsed by using a general large model and a code large model to obtain parsed structured target online log data. Then, the structured target online log data is classified to obtain internal network target online log data and external network target online log data. Next, based on an internal network service matching rule library, a service type label and a service content introduction are matched for the internal network target online log data according to a network address identifier. Then, a website classification label and a website content introduction are matched for the external network target online log data by using an external network website classification database according to the network address identifier. A website classification label is determined for the external network target online log data for which matching fails by using the general large model, and a website content introduction is generated for the external network target online log data for which matching fails by using a multi-modal large model. Thus, the internal network target online log data, the service type label and the service content introduction thereof, and the external network target online log data, the website classification label and the website content introduction thereof can be statistically analyzed, and a classification result of the target user's online behavior is determined according to the obtained statistical analysis result.

[0032] It can be seen that, when the target user online behavior log data generated by the target user online behavior is processed, the multi-modal fusion capability of the general large model, the code large model and the multi-modal large model is relied on, the efficient conversion of the target online log data from unstructured data to structured information is realized first, then the accurate classification of the internal network target online log data and the external network target online log data (i.e. the service type label corresponding to the internal network, the website classification label corresponding to the external network) and the intelligent summary of the website content (i.e. the service content introduction corresponding to the internal network, the website content introduction corresponding to the external network) are completed, and through the statistical analysis of the internal network target online log data and its service type label and service content introduction, and the external network target online log data and its website classification label and website content introduction, the classification result of the target user online behavior (such as whether it belongs to the negative work behavior type or not) is more accurately determined, so that the processing efficiency and accuracy of the target online log can be improved based on the cooperative processing of multiple large models, so as to achieve the ideal processing effect. Further, when it is judged that the target user online behavior belongs to the type of negative work behavior, appropriate measures can be taken immediately, such as sending negative work warning prompt information to the target user, or banning the illegal website, so as to improve the work efficiency of the target user and avoid the generation of negative work behavior. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0034] Figure 1 A flowchart of a user online log processing method based on a large model provided by an embodiment of the present application;

[0035] Figure 2 A process example diagram for classifying and supplementing information of structured target online log data provided by an embodiment of the present application;

[0036] Figure 3 A whole system flowchart of a user online log processing based on a large model provided by an embodiment of the present application;

[0037] Figure 4 A whole system architecture diagram of a user online log processing based on a large model provided by an embodiment of the present application;

[0038] Figure 5 A structure diagram of a user online log processing device based on a large model provided by an embodiment of the present application. DETAILED DESCRIPTION

[0039] With the continuous development of artificial intelligence and Internet technology, more and more users use the Internet for office, entertainment, shopping and other purposes. Based on the complex requirements of Internet security and benign development, the processing of user Internet logs has become a crucial link in network management and security operation.

[0040] At present, there are usually three ways to process user Internet logs:

[0041] (1) Log analysis and classification mode dominated by manual operation.

[0042] Specifically, it relies on manual operation, and first extracts log data in unstructured formats such as txt by technical personnel, and then analyzes it through self-defined rules or simple tools. For website classification, manual judgment or website type judgment based on rules is also needed.

[0043] Since this method completely relies on manual experience, it is not only inefficient, but also requires a lot of time for manual extraction of samples, analysis of data and classification judgment when facing the massive amount of Internet logs generated daily, and cannot realize real-time processing. The accuracy depends on manual experience, and there are problems such as missing analysis and classification errors, especially when dealing with complex domain names or hidden illegal content, the error rate is high. It cannot be applied on a large scale, and as the scale of the organization's network expands, the amount of log data grows exponentially, and manual processing capacity cannot meet the demand, that is, it cannot meet the needs of large-scale network management.

[0044] (2) Log processing system based on simple rule-driven log processing.

[0045] Some enterprises and organizations use log processing tools based on fixed rules to distinguish between internal and external network logs by presetting Internet Protocol Address (IP Address) / domain name matching rules, and rely on keyword matching to identify illegal content.

[0046] However, this method has poor flexibility, and fixed rules cannot adapt to dynamic scenarios such as changes in internal network services, updates of external network domain names, and iterations of illegal content, and need to be manually maintained regularly. The classification and identification capabilities are limited, and only simple keyword or matching logic can be used to process logs, which cannot accurately classify complex external network domain names, and it is also difficult to identify user illegal online behavior and "fishing" behavior without clear keywords. Lack of intelligent optimization mechanism, unable to automatically adjust processing strategies according to changes in log data, long-term use may cause "rule invalidation" problems.

[0047] (3) Single AI model assisted log processing method.

[0048] However, there are obvious limitations in this single AI model assisted log processing method: on the one hand, the single AI model has poor adaptability to non-standardized logs such as txt, and there is no automatic feedback optimization mechanism after parsing errors, making it difficult to form a usable parsing script. On the other hand, the judgment of the single AI model is easily affected by data distribution, and the classification accuracy is low when facing small or new domain names, and there is a lack of cross-validation mechanism, resulting in low reliability of domain name classification.

[0049] It can be seen that the existing three methods for processing user online logs all have great problems and are difficult to achieve ideal generation effect. The cooperation of the whole process is poor, and the complete processing links of "parsing-classification-statistics" are not integrated, resulting in that the processing results cannot be directly served for downstream tasks such as violation supervision and employee behavior analysis, and additional manual connection is required, affecting management efficiency.

[0050] To solve the above defects, the present application provides a user online log processing method based on a large model. First, target online log data generated based on target user online behavior is obtained, and the target online log data is parsed using a general large model and a code large model to obtain parsed structured target online log data. Then, the structured target online log data is classified to obtain internal target online log data and external target online log data. Next, based on an internal service matching rule library, service type labels and service content introductions are matched for the internal target online log data according to network address identifiers. Then, using an external website classification database, website classification labels and website content introductions are matched for the external target online log data according to network address identifiers. The general large model is used to determine the website classification labels for the external target online log data that fails to match, and the multi-modal large model is used to generate website content introductions for the external target online log data that fails to match. Thus, the internal target online log data and its service type labels and service content introductions, and the external target online log data and its website classification labels and website content introductions can be statistically analyzed, and the classification result of the target user online behavior can be determined according to the obtained statistical analysis result.

[0051] It can be seen that, when the target user's online behavior log data generated by the target user is processed, the multi-modal fusion capability of the general large model, the code large model and the multi-modal large model is relied on, the efficient conversion of the target online log data from unstructured data to structured information is realized first, then the accurate classification of the internal network target online log data and the external network target online log data (i.e. the service type label corresponding to the internal network, the website classification label corresponding to the external network) and the intelligent summary of the website content (i.e. the service content introduction corresponding to the internal network, the website content introduction corresponding to the external network) are completed, and through the statistical analysis of the internal network target online log data and its service type label and service content introduction, and the external network target online log data and its website classification label and website content introduction, the classification result of the target user's online behavior (such as whether it belongs to the type of negative work slacking behavior) is more accurately determined, so that the processing efficiency and accuracy of the target online log can be improved based on the cooperative processing of multiple large models, so as to achieve the ideal processing effect. Further, when it is judged that the target user's online behavior belongs to the type of negative work slacking behavior, appropriate measures can be taken immediately, such as sending negative work slacking warning prompt information to the target user, or banning the illegal website, so as to improve the work efficiency of the target user and avoid negative work slacking behavior.

[0052] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0053] Referring to Figure 1 A flowchart of a user online log processing method based on a large model provided by the present embodiment is shown. The method comprises the following steps:

[0054] S101: Obtain target online log data generated based on target user's online behavior, and parse the target online log data using a general large model and a code large model to obtain parsed structured target online log data.

[0055] In the embodiment, any online log data processed by the method provided in the application is defined as target online log data, and any user online behavior generating the target online log data is defined as target user online behavior. Moreover, the embodiment does not limit the language type of the obtained target online log data, for example, the target online log data can be Chinese log data or English log data, etc. The embodiment also does not limit the length of the target online log data, that is, it can be sentence text (that is, a collection of individual words) data or chapter text (that is, a collection of individual sentences) data, etc.

[0056] After obtaining the scattered unstructured target online log data generated based on the target user online behavior from various channels, first, the data segments where the various unstructured target online log data are located can be de-duplicated and then aggregated into a target online log data set, denoted as U.

[0057] Then, it can be judged whether it is the first time to process online log data. If so, a structured parsing script (such as a structured Python parsing script, etc.) is generated and stored by using a general large model and a code large model, and then the target online log data is parsed and processed by using the structured parsing script to obtain parsed structured target online log data. Otherwise, if it is not the first time to process online log data, the previously stored structured parsing script can be used to directly parse and process the target online log data, that is, the parsed structured target online log data is obtained, denoted as D, to perform the subsequent step S102. The specific calculation formula of the structured target online log data D is as follows:

[0058]

[0059] Wherein, U represents the target online log data set; p0 represents the previously stored structured parsing script; G * (·) represents the function of generating the optimal structured parsing script (such as a structured Python parsing script, etc.) by using a general large model and a code large model; L represents the sample data randomly sampled from the target online log data, that is, Init=0 represents that it is not the first time to process online log data; and Init=1 represents that it is the first time to process online log data or to process newly added other types of online log data.

[0060] And in this embodiment, it should be noted that the large model (LLM) refers to a deep learning-based language model that can generate new language expressions such as text, sentences, paragraphs, and even articles based on input text content. The large model (LLM) is trained using large-scale language datasets through self-recurrent generation to simulate human instruction generation language expressions (such as text data). Specifically, when generating new text data, the large model (LLM) is based on previously generated content to predict the likelihood of the next language unit until the complete text data is generated.

[0061] Among them, for the general large model and code large model belonging to the same category of large language model (LLM), the general large model takes natural language as the core, and is a large language model trained by massive multi-modal data (text, image, audio, etc.), with cross-domain knowledge understanding and generation ability. The core goal is to understand and generate human natural language, adapt to most non-specialized general tasks, and solve open problems (such as writing, dialogue, knowledge question and answer). And the code large model is focused on the programming field, and is a large language model trained by code library, API document, programming problem and other massive code corpus, supplemented by a small amount of general corpus fine-tuning, with code generation, completion, debugging and optimization ability. The core goal is to assist developers to efficiently complete programming tasks, reduce development threshold, and solve various problems in the whole programming process.

[0062] Specifically, one optional implementation is that if it is the first time to process online log data, further, first, the content contained in the target online log data can be used to generate a sampling instruction by using a prompt instruction (prompt) template, and the sampling instruction is input into a general large model (the specific model structure is not limited, and can be selected according to actual circumstances and experience values, such as a large model supporting million-level Token input can be selected as a general large model (also can be understood as a model) etc.) for sample sampling processing, to obtain sample sampling data corresponding to the model output of the target online log data. And in actual application, sample data can be first sampled from U in a random manner and represented as L, so that Token (L) < general large model Token. Then the sampling instruction is generated and input into the general large model to sample representative online log data using the sampling capability (which can be represented as Sample(·)) of the general large model, that is, sample sampling data S = Sample(L).

[0063] Among them, an example of the generated sampling instruction can be: "sample online log data with different request types, protocol types, proxy states, response state types, and online exception types", and further, after inputting the generated sampling instruction into the general large model, the output content of the model can be as follows:

[0064] “"[30 / May / 2025:18:37:41 +0800]" 7206 200 TCP_TUNNELED 6516 5833CONNECT tcp www.bing.com 443 / - xxx\8-Internet Proxy User 10.68.211.6 - -"xxx……" – 10.66.184.1 28857 10.68.211.6 53855……443……”.

[0065] Then, the content contained in the sampled data S can be integrated into the prompt template to generate a parsing instruction. This parsing instruction is then input into the large code model (the specific model structure is not limited and can be selected based on actual conditions and experience; for example, open-source large models such as DeepSeek-Coder V2 can be selected as the large code model) for log parsing script generation processing, resulting in a structured parsing script, such as a structured Python parsing script, which can be represented as p0, and p0 = G. * (S)= G * (Sample(L)), and p0∈P, where P denotes script association. An example of structured Python script parsing can be shown below:

[0066] “import re

[0067] import pandas as pd

[0068] import datetime from datetime

[0069] def parse_tag_file(file_path)

[0070] log_patterm=re.compile(

[0071] xxx #1. Timestamp

[0072] xxx #2. Request processing time (milliseconds)

[0073] ... )

[0075] data * []

[0076] ……

[0077] Then, the generated structured parsing script can be used to parse the target online log data, obtain parsed structured target online log data D, and store it (such as storing it in a mysql database), to perform subsequent step S102. The parsed structured target online log data D can be as shown in Table 1 below:

[0078] Table 1

[0079]

[0080] It should be noted that in order to improve the accuracy of the script, the structured parsing script can be tested and verified before being used to parse the target online log data. The parsed structured target online log data D can be obtained and stored by using the structured parsing script that passes the test to parse the target online log data. For example, the corresponding parsing code of the generated structured Python parsing script can be run to verify whether it can correctly parse the log. If no error occurs during code execution, it means that the parsing is passed, i.e., the structured Python parsing script passes the test. Conversely, if an error occurs during code execution, it means that the parsing is not passed, i.e., the structured Python parsing script fails the test.

[0081] In practical applications, the test operator can be set to If the structured parsing script (denoted as p) passes the test, its value can be set to 1, and if the structured parsing script (p) fails the test, its value can be set to 0, as shown in the following formula:

[0082]

[0083] Further, if an error occurs during code execution, i.e., the log parsing is incorrect, the error log and the line data and sample data in the error log can be captured and fed back to the code large model to optimize the previously generated structured parsing script p (such as structured Python parsing script). The specific iteration process is mathematically expressed as follows:

[0084]

[0085] wherein represents the new sample sampling data formed by the original sample sampling data S and the line data set in the error parsing log, and the error parsing warning annotation data is attached; F(·) represents an error feedback operator; p ’ represents the final structured parsing script popt; represents that the code large model is used to optimize the structured parsing script p based on and the parsing function generated by the online log analysis instruction generation; the overall iteration logic is to verify the parsing by running the code corresponding to the previously generated structured parsing script (p), if the parsing is passed, the structured parsing script (p) can be maintained unchanged, if the parsing is failed, the error alarm content and the content contained in the structured parsing script (p) can be integrated into the optimization instruction, and the code large model is fed back to p for iterative optimization until the parsing is passed, and the optimal structured parsing script is obtained.

[0086] S102: classifying the structured target online log data to obtain internal network target online log data and external network target online log data.

[0087] In the embodiment, after obtaining the parsed structured target online log data through step S101, in order to improve the processing efficiency and accuracy of the target online log data and achieve ideal processing effect, the structured target online log data can be further classified once, and the target online log data whose network address identifier (the specific content is not limited, which can be but is not limited to IP or domain name, etc.) matches the internal network segment identifier is screened out from the structured target online log data as internal network target online log data (represented as D 内 ), and the target online log data that fails to match is taken as external network target online log data (represented as D 外 ) to execute subsequent steps S103-S105.

[0088] Wherein, the specific calculation formula of the internal network target online log data (D 内 ) and the external network target online log data (represented as D 外 ) is as follows:

[0089]

[0090] Wherein, D represents the parsed structured target online log data, including all single log data to be classified; d represents any single log data in D; d.ip represents the IP address field recorded in the single log d; Ω represents a preset internal network IP segment (identifier) rule set, covering all legal internal network IP segments recognized by enterprises or systems; represents an IP segment matching function, the specific composition content is not limited, which is used to judge whether the IP address of the single log belongs to the internal network segment, and outputs logical true (i.e. True) if the matching is successful, and outputs logical false (i.e. False) if the matching fails; D 内 represents the internal network target online log data subset obtained after one classification, which is composed of logs whose IP addresses match the internal network segment rules; D 外 represents the external network target online log data subset obtained after one classification, which can be understood as the log set D excluding the subset D内 the complement after.

[0091] S103: Based on the internal network service matching rule library, the network address identifier is matched for the internal network target online log data Service type label and service content introduction.

[0092] In this embodiment, the internal network target online log data D 内 After, in order to improve the processing efficiency and accuracy of the target online log data, and to achieve the ideal processing effect, further based on the internal network service matching rule library, according to the network address identifier (specific content is not limited, can be but not limited to IP or domain name, etc.), for the internal network target online log data matching service type label and service content introduction, in order to execute the subsequent step S105.

[0093] Wherein, for each internal network target online log data matching service type label and service content introduction, and get the final set of internal network target online log data after supplement (denoted as D * 内 The specific calculation formula is as follows:

[0094]

[0095] Wherein, d represents any single log in the internal network target online log data D 内 ; d.ip / dns represents the IP address or domain name field recorded in the single internal network log d (adapt to the field storage form of different logs); Γ represents the internal network service matching rule library, which contains content without limitation, can contain but not limited to "network address identifier (IP / domain name) - service type label - service introduction" mapping relationship, for example, IP segment 192.168.0.0 / 24 corresponding "service type label and service content introduction" can be "OA office service and its function related introduction" and so on; F Label (·,·) represents the internal network classification label matching function, the input is the network address identifier (such as IP / domain name) of single log d and internal network service matching rule library Γ, the output is the corresponding internal network service type label (such as "OA office", "internal database", "financial system" and so on); F Intro (·,·) represents the internal network service content introduction generation function, the input is the network address identifier (such as IP / domain name) of single log d and internal network service matching rule library Γ, the output is the detailed introduction content of corresponding internal network service (such as function description, scope of use, etc.); Label 内 (d) represents the internal network service type label corresponding to single internal network log d; Intro 内 (d) represents the internal network service content introduction corresponding to single internal network log d; D *内 represents the final set of the internal network target online log data after the service type label and the service content introduction matching supplement, and each log is associated with the complete information of "original internal network target online log-service type label-service content introduction".

[0096] S104: using the external network website classification database, matching the website classification label and the website content introduction for the external network target online log data according to the network address identifier; and using the general large model to determine the website classification label for the external network target online log data that fails to match, and using the multi-modal large model to generate the website content introduction for the external network target online log data that fails to match.

[0097] In this embodiment, the external network target online log data D 外 is obtained through step S102, and then in order to improve the processing efficiency and accuracy of the target online log data and achieve ideal processing effect, further, since the user may access a domain name or IP and the like network address multiple times, the domain name or IP and the like network address of the external network target online log data D 外 may be first de-duplicated, and then the processing result is subjected to secondary classification matching operation with the network address identifier (the specific content is not limited, which can be but is not limited to IP or domain name and the like) in the external network website classification database, the website classification label and the website content introduction are matched for each piece of de-duplicated external network target online log data, so as to execute subsequent step S105.

[0098] wherein after matching the website classification label and the service content introduction for each piece of de-duplicated external network target online log data, the final set of the external network target online log data supplemented with the historical information in the matched external network website classification database (denoted as D * 外 The specific calculation formula of D

[0099]

[0100] wherein D 外 represents the external network target online log data (subset); d represents D 外Any one of the single logs in d; d.ip / dns represents the IP address or domain name field recorded in the single external network log d; Unique(·) represents a de-duplication function, the input is a set, and the output is a set without duplicate elements, for example, for the overlapping "iflytek.com" and "iflytek.com", the de-duplication function can be used for de-duplication processing; Λ represents an external network website classification database, which specifically contains content without limitation, and can contain but is not limited to the mapping relationship of "network address identifier (IP / domain name)-website classification label-website content introduction", for example, the "website classification label and website content introduction" corresponding to the IP segment 192.xx.0.0 / 55 can be "e-commerce classification and related introduction of a certain e-commerce website" and the like; DNS * 外 represents the set of de-duplicated external network target online log data; represents an external network historical label matching function, the input is the network address identifier x (such as IP / domain name) of the single external network log d and the external network website classification database Λ, and the output is the corresponding matching successful website classification label, and when the matching fails, it is ; represents an external network historical website content introduction matching function, the input is the network address identifier x (such as IP / domain name) of the single external network log d and the external network website classification database Λ, and the output is the corresponding matching successful website content introduction, and when the matching fails, it is ; x represents the network address identifier of the de-duplicated single internal network log d, such as IP / domain name, which can be specifically represented as x=d.ip / dns.

[0101] On this basis, for the external network target online log data whose network address identifier (such as IP / domain name) matching fails, first, as Figure 2 indicated, a voting large model composed of N (the specific value is not limited, which can be valued as any positive odd number greater than 1 according to actual situation and experience value, such as 3, etc.) general large models can be used to vote the website classification of the external network target online log data whose matching fails, and the vote results of each website classification label are counted through the indication function, so as to determine the website classification label corresponding to the external network target online log data whose matching fails according to the statistical results, for example, 3 general large models can be used to form a voting large model to vote the website classification, if the statistical result is 3:0 or 2:1, the website classification label corresponding to the external network target online log data whose matching fails can be directly determined. If the statistical result is 1:1:1, it can be pushed to artificial participation to determine the final website classification label.

[0102] Among them, the specific calculation formula for determining the website classification label of the external network target online log data whose matching fails by using multiple general large models is as follows:

[0103]

[0104] Wherein, DNS 未匹配 represents the set of external network target online log data of failed network address identification (such as IP / domain name) matching (which can be regarded as a cold start object); x represents the network address identification of any log in DNS 未匹配 , such as IP / domain name, etc.; m1, m2, and m3 respectively represent the general large model of the constituent classification large model participating in voting. It can be understood that 3 is only an example value, and in actual application, other positive odd numbers greater than 1, such as 5, 7, 9, etc., can also be taken as values; C represents the combination of external network website classification labels, and the specific content is not limited, which can include but is not limited to social, e-commerce, etc.; Vote(m i , c) represents the website classification voting result of model m i for x (belongs to C); I(·) represents an indicator function, which takes the value 1 if the condition is true, and 0 otherwise; VoteCount(x, c) represents the total number of votes for label c; argmax c VoteCount(x, c) represents the website classification label with the highest number of votes (effective when unique); Label * 外 (x) represents the final website classification label after voting or manual determination.

[0105] Wherein, the N general large models are used to form a voting large model to classify the website of the external network target online log data of failed matching, and the voting result obtained can be shown in Table 2 as follows:

[0106] Table 2

[0107]

[0108] Then, as shown in Figure 2 , the content and network address identification contained in the website classification label of the external network target online log data can be integrated into the prompt instruction template to generate a prompt instruction, and the prompt instruction is input into a multi-modal large model (the specific model structure is not limited, which can be selected according to actual circumstances and experience values, such as the open source multi-modal large model of 1000 questions 30B VL) to generate a website content introduction (i.e., summarize the website introduction), obtain the website content introduction corresponding to the external network target online log data of failed matching and store it. At the same time, the website classification label and the website content introduction corresponding to the external network target online log data of failed matching can also be used to update the external network website classification database to obtain an updated external network website classification database, so as to be used for the next external network classification, improve the classification efficiency and accuracy.

[0109] An example of the generated prompt instruction can be: "summarize the website content and control the introduction content to 100 words". Further, after inputting the generated prompt instruction into the multi-modal large model, an example of the output content of the model can be shown in Table 3.

[0110] Table 3

[0111]

[0112] Specifically, the multi-modal large model is used to generate a specific calculation formula for the website content introduction for the failed matching external network target online log data as follows:

[0113]

[0114] wherein x represents the network address identifier of any log, such as IP / domain name, etc.; H(·) represents a website content summary operator of the modal large model, the input contains the IP / domain name and other network address identifiers of the log, and the output is the website content introduction corresponding to the log; Desc 未匹配 * 外 (x) represents the final introduction content of the website corresponding to x; D * 外 represents a set of external network target online log data matching the historical information in the external network website classification database; D 外 represents the external network target online log data (subset); d.ip / dns represents the IP address or domain name field recorded in a single external network log d; Label * 外 (x) represents the final website classification label determined by voting or manually; D 最终 内 represents a complete set of processing results for external network target online log data (including historical matching + cold start website classification and website content summary).

[0115] Further, as shown in Figure 2 , in order to improve the real-time performance of the log data processing result, a timing task can also be set to regularly vote for the external network website classification label, re-classify and summarize the website content introduction. The timing task realizes the regular update of the external network website classification label and the website content introduction, ensures the timeliness of the website classification and the content introduction, and the specific execution process can be realized by referring to the related content introduced in steps S103-S104 described above. For example, a 3-month time period task can be used to re-classify the website and summarize the website content, realize the dynamic classification and update of the website, and ensure the timeliness of the log data processing.

[0116] ​S105: Perform statistical analysis on the intranet target online log data and its service type label and service content introduction, and the extranet target online log data and its website classification label and website content introduction, and determine the classification result of the target user online behavior according to the obtained statistical analysis result.

[0117] In the embodiment, after obtaining the service type label and service content introduction corresponding to the intranet target online log data through step S103, and obtaining the website classification label and website content introduction corresponding to the extranet target online log data through step S104, further, statistical analysis can be performed on the intranet target online log data and its service type label and service content introduction, and the extranet target online log data and its website classification label and website content introduction, and the classification result of the target user online behavior is more accurately determined according to the obtained statistical analysis result. When it is judged that the classification result of the target user online behavior belongs to the preset negative shirking behavior classification, such as the "fishing" behavior, the negative shirking warning prompt information can be sent to the target user to prompt the target user to quickly engage in learning and work, so as to improve the work efficiency of the target user and avoid continuing to produce negative shirking behavior.

[0118] Among them, the specific sending mode and the message content form of the negative shirking warning prompt information can be set according to the actual situation, such as sending a warning prompt message, multimedia message, instant messaging software message or push information in the form of text and / or picture to the mobile phone of the target user to remind him to quickly engage in learning and work and avoid continuing to produce negative shirking behavior; or, a window interface containing negative shirking warning prompt content such as text and / or picture can also be popped up on the interface of the device operated by the target user to remind the target user to quickly engage in learning and work and avoid continuing to produce negative shirking behavior; or, the target user can also be reminded to quickly engage in learning and work and avoid continuing to produce negative shirking behavior in the form of automatically dialing an intelligent voice call.

[0119] It should be noted that the specific content contained in the preset negative shirking behavior classification can be set according to the actual situation, and the present application embodiment does not limit it, such as setting the preset negative shirking behavior classification as "fishing" behavior such as browsing shopping websites or engaging in social communication.

[0120] Specifically, when performing statistical analysis on the intranet target online log data and its service type label and service content introduction, and the extranet target online log data and its website classification label and website content introduction, first, the online log data can be statistically analyzed and displayed in the dimensions of unit, organization, individual, online type, etc., and the specific calculation formula is as follows:

[0121]

[0122] wherein Result represents the complete log set after the whole process (i.e. the internal network target Internet log data and its service type label and service content introduction, and the external network target Internet log data and its website classification label and website content introduction); r represents a single log data record in Result; θ represents a statistical dimension, which can be but is not limited to subject unit (Dept), affiliated organization (Group), user personal (Person), access type (Category), etc., such as "R&D Department", "E-commerce website", etc.; k represents the number of statistical dimensions (supporting single dimension or cross statistics); θ1,...,θ k represents the selected k statistical dimensions (such as "Dept+Category"); w1,...,w k represents the specific value of the corresponding dimension (such as "R&D Department", "E-commerce website", etc.); Count(·) represents the counting function (returns the number of elements in the set); Label * 外 (x) represents the final website classification label after voting or manual judgment; Stat(θ1,...,θ k ) represents the statistical result, i.e. the total number of Internet log data meeting the "dimension θ i w i " condition, examples can be shown in Table 4 as follows:

[0123] Table 4

[0124]

[0125] Then, the Internet violation access situation can be counted, and the violation website can be banned, and the specific calculation formula is as follows:

[0126]

[0127] wherein V represents a violation type set (such as various preset violation labels, etc.); Result represents the complete log set after the whole process (i.e. the internal network target Internet log data and its service type label and service content introduction, and the external network target Internet log data and its website classification label and website content introduction); r represents a single log data record in Result; r.Category represents the access type label of the single log r; θ1,...,θ k represents the selected k statistical dimensions (such as department, individual, etc.); w1,...,w k represents the specific value of the corresponding dimension; r.x represents the IP address or domain name accessed by the single log r; Stat v (θ1,...,θ k) represents the multi-dimensional violation access statistical result (the total number of logs meeting the "violation type + dimension condition"); I(·) represents the indicator function, which returns True if the condition is true, otherwise returns False; Block(x) represents the blocking decision function (returns True to prohibit access to IP / domain name x).

[0128] In addition, for enterprises and organizations, the online access of employees (users) during working hours can also be counted, and employees (users) who are negative and lazy can be identified according to access type, duration, frequency, etc. For example, if an employee (user) spends a long time shopping, watching short videos, and visiting entertainment websites during working hours, it can be determined that the employee (user) is negative and lazy. The specific calculation formula is as follows:

[0129]

[0130] where T represents the working hours, such as [9:00, 18:00]; E represents the set of entertainment types (such as shopping, short video, etc. Non-work website classification label); p represents the employee (user) to be determined; r.p represents the employee (user) associated with log r; r.t represents the access time; r.dur represents the access duration; r.Category represents the access type label; represents the duration / number threshold for determining negative and lazy employees (fishing), and the specific value is not limited, such as 120 minutes and 10 times, respectively); ∑...r.dur represents the total duration of the employee (user) p accessing the entertainment type during working hours; Count(.) represents the total number of times the employee (user) p accesses the entertainment type during working hours; I(·) represents the indicator function, which returns True if the condition is true, otherwise returns False; Fish(p) represents the negative and lazy employee (fishing) determination result, and returns True if the employee (user) is a negative and lazy employee (fishing).

[0131] To facilitate understanding of the above-mentioned user online log processing method based on a large model, the present application also provides a whole system flow chart for user online log processing based on a large model, as shown in Figure 3 The whole system flow chart for processing user online logs can include the following four steps:

[0132] (1) Multi-source log aggregation and structured analysis: Collecting scattered original online log data in unstructured formats such as txt, merging and deduplicating to form a complete data set. In the first analysis, representative log samples containing request types, protocol types, etc. are sampled by a general large model, and a Python parsing script is generated by a code large model. After iterative optimization through testing-feedback, the full amount of logs is processed. In the non-first analysis, the pre-set optimal parsing script is directly used to convert unstructured logs into structured data and import into the database.

[0133] (2) Log classification and internal network information completion: According to the internal network IP network segment rules, the structured log is split into internal network and external network subsets through the IP matching function. The internal network "IP / domain name-service type label-service introduction" mapping library is called to automatically supplement the classification label (such as "OA office") and service description for the internal network log, forming the final internal network result set; the external network log enters the special processing link.

[0134] (3) External log deduplication, classification and information completion: The IP / domain name of the external log is deduplicated, and the classification database of the external website is matched to supplement the classification label and website introduction for the existing record; the cold start IP / domain name is voted by the voting model composed of N (such as 3) general large models (the voting structure is 3:0 or 2:1, then the label is automatically determined, if it is 1:1:1, manual intervention is needed), and then the website content introduction is generated through the multi-modal large model, and the final external network result set is integrated and formed to update the external network website classification database.

[0135] (4) Full log statistics, violation control and fishing identification: The final results of internal network and external network are integrated to form a full log set, and the access frequency, frequency, etc. of units, organizations, individuals, and online types are counted; based on the preset violation types, the violation IP / domain name is identified and blocked; at the same time, within the preset working period, the total time and number of employees accessing shopping, short video, and other negative and lazy work websites (i.e. entertainment websites, fishing websites, etc.) are counted, and compared with the threshold to determine the negative and lazy employees, providing support for network security and employee efficiency management.

[0136] In addition, in order to realize the above-mentioned user online log processing method based on large model provided by the present application, in actual application, the whole processing system can be designed by adopting hierarchical architecture, including application layer, model layer and storage layer, as shown in Figure 4 Each layer cooperates to ensure efficient and accurate implementation of online log analysis, data mining, statistical application and other processes. The specific implementation functions of each layer are described as follows:

[0137] I. Application layer

[0138] (1) Online log structured analysis module, used to undertake user online log analysis and aggregation responsibilities, to analyze the input raw log, and complete user online log aggregation, laying a solid foundation for subsequent data processing.

[0139] (ii) Online log classification and information supplement module, used for focusing on internal network log data classification and introduction processing, as well as external network log data classification and intelligent introduction. For internal network logs, information is supplemented and introduced according to the internal network information base; for external network logs, data classification is carried out and intelligent introduction is generated, and the value of log data is mined to provide high-quality input for statistical applications.

[0140] (iii) Full-amount log statistics and application module, used for developing illegal website statistics control and fishing employee identification statistics work. For full-amount logs, illegal website conditions are counted and controlled, and fishing employees are identified and counted, realizing the business application of log data.

[0141] II. Model layer

[0142] It includes general large models, code large models, voting large models, and multi-modal large models. Among them, the general large model is used to assist sample analysis in log analysis scenarios; the code large model is used to generate log analysis scripts; the voting large model is used for external network cold start classification voting; the multi-modal large model is used for multi-dimensional log analysis, and each model cooperates to ensure system function implementation.

[0143] III. Storage layer

[0144] (i) User online log library, used to store raw online log data in unstructured formats such as txt, providing data input for the online log structured analysis module in the application layer, and is the source data for log processing, supporting data tracing in the whole process.

[0145] (ii) Python script library, used to store various log analysis Python scripts, providing script support for the online log structured analysis module in the application layer, ensuring efficient and standardized log analysis process, and supporting dynamic script updates to adapt to new log format requirements.

[0146] (iii) Structured log library, used to store structured online logs after analysis, providing data basis for each module in the application layer and model layer analysis, facilitating subsequent data mining, statistical application, etc., and improving the continuity of data processing.

[0147] (iv) Internal network information base, used to gather IP / domain names, classification labels, content introductions, etc. of internal network services, providing rules and knowledge support for the structured log data mining value module in the application layer to process internal network logs, and ensuring the accuracy of internal network log classification and introduction.

[0148] (v) External network information base, used to store IP / domain names, historical classification labels, introductions, etc. of external network access objects, providing historical reference for the structured log data mining value module in the application layer to process external network logs, while retaining newly generated external network classification introduction information to facilitate continuous optimization of external network log processing.

[0149] In summary, the embodiment provides a user online log processing method based on a large model. First, target online log data generated based on target user online behavior is obtained, and a general large model and a code large model are used to analyze the target online log data to obtain structured target online log data after analysis. Then, the structured target online log data is classified to obtain intranet target online log data and extranet target online log data. Next, based on an intranet service matching rule library, a network address identifier is used to match a service type label and a service content introduction for the intranet target online log data. Then, an extranet website classification database is used to match a website classification label and a website content introduction for the extranet target online log data. A general large model is used to determine a website classification label for the extranet target online log data that fails to match, and a multi-modal large model is used to generate a website content introduction for the extranet target online log data that fails to match. Thus, the intranet target online log data, the service type label and the service content introduction, and the extranet target online log data, the website classification label and the website content introduction can be statistically analyzed, and a classification result of the target user online behavior is determined based on the statistical analysis result.

[0150] It can be seen that, when the target online log data generated based on the target user online behavior is processed, the multi-modal fusion capability of the general large model, the code large model and the multi-modal large model is relied on to efficiently convert the target online log data from unstructured data to structured information, accurately classify the intranet target online log data and the extranet target online log data (i.e., the service type label corresponding to the intranet and the website classification label corresponding to the extranet), intelligently summarize the website content (i.e., the service content introduction corresponding to the intranet and the website content introduction corresponding to the extranet), and more accurately determine the classification result of the target user online behavior (such as whether it belongs to the type of negative slacking behavior) through statistical analysis of the intranet target online log data, the service type label and the service content introduction, and the extranet target online log data, the website classification label and the website content introduction. Thus, the processing efficiency and accuracy of the target online log can be improved based on the collaborative processing of multiple large models to achieve an ideal processing effect. Furthermore, when it is determined that the target user online behavior belongs to the type of negative slacking behavior, appropriate measures can be taken immediately, such as sending a negative slacking warning prompt to the target user or banning the illegal website, so as to improve the work efficiency of the target user and avoid negative slacking behavior.

[0151] Further, the embodiment of the present application also provides a user online log processing device based on a large model, which comprises a processor, a memory and a system bus.

[0152] The processor and the memory are connected through the system bus.

[0153] The memory is configured to store one or more programs including instructions that, when executed by the processor, cause the processor to perform any of the implementation methods of the large model-based user online log processing method described above.

[0154] Reference Figure 5 As shown in the figure, it shows a structural schematic diagram of a large model-based user online log processing device suitable for use to implement the embodiments of the present application. The large model-based user online log processing device in the embodiments of the present application can include but is not limited to a terminal, a server, etc. equipped with a general large model, a code large model, a multi-modal large model. Figure 5 The large model-based user online log processing device shown is only an example of an electronic device and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0155] As Figure 5 As shown in the figure, the large model-based user online log processing device can include a processor (such as a central processor, a graphics processor, etc.) 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or loaded into a random access memory (RAM) 503 from a storage device 508. In the state that the large model-based user online log processing device is powered on, various programs and data required for device operation are also stored in the RAM 503. The processor 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0156] Generally, the following devices can be connected to the I / O interface 505: input devices 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 508 including, for example, a memory card, a hard disk, etc.; and communication devices 509. The communication devices 509 can allow the electronic device to communicate wirelessly or by wire with other devices to exchange data. Although Figure 5 The large model-based user online log processing device is shown with various devices, but it should be understood that all the shown devices are not required to be implemented or possessed. More or fewer devices can be alternatively implemented or possessed.

[0157] Further, the embodiments of the present application also provide a computer readable storage medium, wherein instructions are stored in the computer readable storage medium, and when the instructions run on a terminal device, the terminal device executes any of the implementation methods of the large model-based user online log processing method described above.

[0158] Further, the embodiments of the present application further provide a computer program product, which, when running on a terminal device, causes the terminal device to execute any one of the above-mentioned implementation methods of the user online log processing method based on a large model.

[0159] From the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus necessary universal hardware platforms. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network communication device such as a media gateway, etc.) execute the methods described in the various embodiments or some parts of the embodiments of the present application.

[0160] It should be noted that the various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be mutually referred to. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts are referred to the method part.

[0161] It should also be noted that the terms such as first and second in the present document are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0162] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for processing user internet access logs based on a large model, characterized in that, include: Obtain target internet access log data generated based on the target user's internet access behavior, and parse the target internet access log data using a general large model and a code large model to obtain parsed structured target internet access log data; The structured target internet access log data is classified to obtain internal network target internet access log data and external network target internet access log data; Based on the intranet service matching rule base, service type tags and service content descriptions are matched to the target intranet internet access log data according to the network address identifier; Using an external website classification database, website classification tags and website content descriptions are matched to the external target internet access log data according to network address identifiers; a general large model is used to determine website classification tags for external target internet access log data that fails to match, and a multimodal large model is used to generate website content descriptions for external target internet access log data that fails to match. Statistical analysis is performed on the intranet target internet access log data and its service type tags and service content descriptions, as well as the extranet target internet access log data and its website category tags and website content descriptions. Based on the statistical analysis results, the classification results of the target user's internet access behavior are determined.

2. The method according to claim 1, characterized in that, The process of parsing the target internet access log data using a general large model and a code large model to obtain parsed structured target internet access log data includes: A sampling instruction is generated using the target internet access log data, and input into a general large model for sample sampling processing to obtain sample sampling data corresponding to the target internet access log data. The sampled data is used to generate parsing instructions, which are then input into the code model to generate a log parsing script, resulting in a structured parsing script. The target internet access log data is parsed using the structured parsing script to obtain the parsed structured target internet access log data.

3. The method according to claim 1, characterized in that, The process of parsing the target internet access log data using a general large model and a code large model to obtain parsed structured target internet access log data includes: The target internet access log data is parsed using a pre-stored structured parsing script to obtain parsed structured target internet access log data; wherein, the structured parsing script is pre-generated using a general large model and a code large model.

4. The method according to claim 1, characterized in that, The process of classifying the structured target internet access log data to obtain internal network target internet access log data and external network target internet access log data includes: From the structured target internet access log data, target internet access log data whose network address identifier matches the internal network segment identifier is selected as internal network target internet access log data, and target internet access log data that fails to match is selected as external network target internet access log data.

5. The method according to claim 1, characterized in that, The process of determining website category tags for unmatched external network target browsing log data using a general large model, and generating website content descriptions for unmatched external network target browsing log data using a multimodal large model, includes: A large voting model composed of N general models is used to classify and vote on the website category of the external network target access log data that failed to match. The voting results of each website category label are statistically analyzed by an indicator function, and the website category label corresponding to the external network target access log data that failed to match is determined based on the statistical results; where N is a positive odd number greater than 1. Using the website category tags and network address identifiers of the external network target's internet access log data, a prompt instruction is generated. This instruction is then input into a multimodal large model to generate website content descriptions, resulting in website content descriptions corresponding to the external network target's internet access log data that failed to match.

6. The method according to claim 1, characterized in that, After determining website category tags for unmatched external network target browsing log data using a general large model, and generating website content descriptions for unmatched external network target browsing log data using a multimodal large model, the method further includes: By using the website category tags and website content descriptions corresponding to the failed external network target browsing log data, the external network website category database is updated to obtain the updated external network website category database.

7. The method according to claim 1, characterized in that, After performing statistical analysis on the intranet target internet access log data and its service type tags and service content descriptions, as well as the external network target internet access log data and its website category tags and website content descriptions, and determining the classification result of the target user's internet access behavior based on the obtained statistical analysis results, the method further includes: When it is determined that the target user's online behavior belongs to the preset category of passive shirking behavior, a passive shirking warning message is sent to the target user.

8. The method according to any one of claims 1-7, characterized in that, The network address identifier includes at least one of Internet Protocol (IP) address and domain name.

9. A user internet access log processing device based on a large model, characterized in that, include: Processor, memory, system bus; The processor and the memory are connected via the system bus; The memory is used to store one or more programs, the one or more programs including instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-8.

10. A computer program product, characterized in that, The program product includes a computer program that, when executed by an electronic product, can implement the method described in any one of claims 1-8.

Images