Firewall communication log anomaly detection method based on association rule and sequence pattern fusion

Abstract

The invention discloses a firewall communication log anomaly detection method based on association rule and sequence pattern fusion, which comprises the following steps: 1, acquiring and cleaning formatted firewall historical logs, and extracting a source IP, a destination IP, a port, a protocol and an action field; 2, mining a static association rule by adopting an Apriori algorithm; 3, mining a sequential communication mode by adopting an improved PrefixSpan algorithm, and fusing the sequential communication mode with a static rule to construct a comprehensive behavior model; and 4, matching a real-time communication log with the model, and if the real-time communication log meets the front part but does not meet the back part or deviates from the sequence mode, judging that the real-time communication log is abnormal and triggering alarm and visual display. According to the method, the normal communication behavior model can be constructed by using the existing firewall log on the premise that the existing production network architecture is not changed, so that the abnormal communication can be quickly detected and alarmed, and the safety and reliability of the production network can be improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network and information security, and specifically relates to a firewall communication log anomaly detection method based on the fusion of association rules and sequence patterns. BACKGROUND

[0002] With the continuous promotion of industrial internet, enterprise informatization and cloud-edge collaboration, the degree of interconnection and intercommunication of business systems, production networks and office networks is continuously improved, and the network boundary is increasingly complex. As a key device for network boundary security, the firewall is widely deployed in core switches, partition isolation and external export, and the communication log generated by the firewall records information such as source / destination address, port, protocol, action, and has become an important data source for security operation and maintenance, compliance audit and event tracing. At the same time, attack means tend to be automated and concealed, and abnormal communication may appear in a low-frequency, gradual and cross-stage manner, which puts higher requirements on continuous monitoring and rapid identification.

[0003] Existing abnormal detection methods based on firewall logs mainly include rule strategies based on threshold and black / white list, abnormal detection based on statistical features, classification or clustering methods based on machine learning / deep learning, etc. The above methods still have deficiencies in practical application: first, traditional rules and threshold methods rely on manual experience configuration, have high maintenance cost when facing network structure adjustment, business change and policy iteration, and are prone to false negatives or false positives; second, statistical feature methods are mostly based on single indicators or short time windows for judgment, and it is difficult to describe the multi-field combination rules of complex business communication, especially in the scene of increasing communication scale and protocol diversification, the effect is unstable; third, part of the learning method relies strongly on high-quality labeled samples or stable data distribution, and in the industrial or production environment, the abnormal sample is scarce and the data noise is large, the model generalization ability and explainability are insufficient, and it is difficult to support security audit and disposal decision; fourth, many methods focus on the judgment of single log or single session, and lack the description of the temporal context of the communication process, so the recognition ability of slow, phased and cross-strategy concealed abnormal behavior is limited.

[0004] Therefore, how to more effectively describe the multi-field combination characteristics of normal communication and the temporal rules of the communication process under the premise of only relying on the type of available data such as firewall logs, and improve the recognition ability of concealed abnormalities and the explainability of output results, is still a technical problem that needs to be solved in this field. SUMMARY

[0005] This invention addresses the shortcomings of existing technologies by proposing a firewall communication log anomaly detection method based on the fusion of association rules and sequence patterns. The aim is to achieve continuous monitoring and rapid identification of abnormal communication behavior by fully utilizing existing firewall logs without increasing the burden of on-site data collection or relying on a large number of labeled samples. This reduces missed reports, false alarms, and operational configuration costs caused by business changes and policy adjustments, thereby improving the security and operational reliability of industrial control systems and enterprise network boundaries. Furthermore, it enhances the auditing, tracing, and decision support capabilities for security incidents, ultimately ensuring production continuity and the stable operation of critical infrastructure.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution: The present invention provides a firewall communication log anomaly detection method based on the fusion of association rules and sequence patterns, characterized by the following steps: Step 1: Collect historical log data from the firewall and preprocess it to obtain a structured historical log event set E; let any i-th historical log event in E be denoted as e. i = <t i ,srcIP i dstIP i ,port i ,proto i action i >, where t i srcIP represents the time when the i-th historical log event occurred. i dstIP represents the source IP of the i-th historical log event. i The port represents the destination IP address of the i-th historical log event. i The port representing the i-th historical log event, proto i The protocol representing the i-th historical log event, action i Let N represent the action of the i-th historical log event; let N represent the total number of historical log events in E; Step 2: Mine E to obtain the static rule constraint set C; Step 3: Use the improved PrefixSpan algorithm to mine the structured historical log event set E, obtain the time-series communication pattern, and construct a time-series model; Step 4: The static rule constraint set C is weighted and fused with the time series model to generate a comprehensive behavior model M. The comprehensive behavior model M includes: rule / pattern identifier, applicable conditions, constraint field set, expected action or expected sequence position, and threshold parameter. Step 5: Collect real-time communication logs and match and compare them with the comprehensive behavior model M. If the real-time communication logs do not deviate from M, the real-time communication logs are marked as normal behavior, and the next real-time communication log is judged. Otherwise, the real-time communication logs are judged as abnormal behavior logs, and visual alarm information is generated.

[0007] The firewall communication log anomaly detection method based on association rules and sequence pattern fusion described in this invention is also characterized in that step two includes: Step 2.1: Use the transaction mapping function φ to map e i Transform into the i-th unordered itemset transaction T i This generates a transactional database D={T1,T2,…,T i ,…,T N}; Step 2.2: Use the Apriori algorithm to mine the association rule set X→Y in the transaction database D, where X is the set of items preceding the rule and Y is the set of items following the rule; Step 2.3: Calculate the support (x→y) and confidence (x→y) of any association rule x→y in the association rule set X→Y using equations (4) and (5), respectively: Support(x→y) = |{T i ∈D∶X∪Y⊆T i}∣ / ∣D∣(4) Confidence(x→y)=∣{T i ∈D∶X∪Y⊆T i}∣ / ∣{T i ∈D∶X⊆T i}∣(5) In equations (4) and (5), : represents the separator for set construction / filtering conditions; / represents division; || represents the cardinality of the set; x represents the preceding itemset of any association rule in X, and y represents the following itemset of the corresponding association rule; Step 2.4: Determine whether equation (6) is true. If it is true, then any association rule x→y is a valid static association rule. Otherwise, delete the corresponding association rule x→y to obtain the filtered association rule set X'→Y'. Support(x→y)≥θs Confidence(x→y)≥θc (6) In equation (6), θs is the minimum support threshold and θc is the minimum confidence threshold; Indicates and; Step 2.5: Construct the static rule constraint C of the r-th association rule in the filtered association rule set X'→Y'.r Cond r Act r Thus, the static rule constraint set C is obtained, where Cond r This indicates that the field constraint item is extracted from the set of rules preceding the r-th association rule to form the r-th trigger condition, Act. r This represents the expected action item extracted from the r-th association rule and forming the r-th expected action constraint.

[0008] Furthermore, step three includes: Step 3.1: Divide E into event sequence sets S={S1,S2,…,S...} according to the sliding time window. m ,…,S M}, where S m Let S represent the sequence of events m, and S m = <e m ,1,e m ,2,…,e m , k …,e m , Lm >,e m , k S represents m The k-th event, L m For S m The number of events included; Step 3.2: Construct the sequence mining constraint set Ω, including: sliding time window constraint, maximum interval constraint between adjacent events, minimum interval constraint between adjacent events, length constraint of sequence item, and minimum sequence support threshold constraint; Step 3.3: Use the PrefixSpan algorithm to mine the candidate set of time-series communication patterns P={p1,p2,…,p} in S. w ,…,p W}, where p w This represents the w-th timing communication pattern formed by the combination of key fields; Step 3.4: Select all time-series communication patterns from P that satisfy the sequence mining constraint set Ω and form a time-series communication pattern set Π, thereby mapping the time-series communication pattern set to a time-series model. The time-series model includes at least: pattern identifier, applicable conditions, constraint field set, expected sequence position, and threshold parameter. The threshold parameter includes: pattern support parameter and allowed sliding time window or interval constraint parameter.

[0009] Furthermore, step five includes: Step 5.1: Extract key fields from the real-time communication log and construct event e at time t. t ; Step 5.2, e t Match with C: If an association rule exists such that e t If the set of terms preceding the rule is satisfied but the set of terms following the rule is not satisfied, then generate e. t Static deviation marker DR t =1, otherwise, let DR t =0; Step 5.3, e t Match the real-time event sequence with the time series model: If e t If the real-time event sequence violates the expected sequence position of the time series model, or violates the threshold parameter of the sequence model, then e is generated. t Timing deviation marker DT t =1, otherwise, let DT t =0; Step 5.4, when DR t =1 or DT t When DR = 1, it is determined that the real-time communication log deviates from the comprehensive behavior model M; when DR t =0 and DT t When =0, it is determined that the real-time communication log has not deviated from the comprehensive behavior model M.

[0010] The present invention provides an electronic device, including a memory and a processor, characterized in that the memory is used to store a program that supports the processor in executing the firewall communication log anomaly detection method, and the processor is configured to execute the program stored in the memory.

[0011] The present invention discloses a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, performs the steps of the firewall communication log anomaly detection method.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention standardizes and cleans firewall historical logs and extracts key fields, unifying information such as source IP, destination IP, port, protocol, and action into structured data input. This ensures that subsequent rule mining and real-time comparison have consistent data semantics and repeatability, overcoming the problems of inconsistent log fields, noise, and missing data leading to unstable detection in existing technologies. This improves the engineering applicability of anomaly detection and its ability to migrate across devices and policies.

[0013] 2. This invention uses the Apriori algorithm to mine static association rules of multi-field combinations, and explicitly transforms normal policy constraints such as "source / destination / port / protocol → action" into an auditable set of rules. This overcomes the problems of traditional threshold / manual rules relying on experience, high maintenance costs, and insufficient interpretability, thereby reducing the manual configuration and maintenance costs in policy change scenarios and improving the interpretability and verifiability of alarm results.

[0014] 3. This invention uses an improved PrefixSpan algorithm to mine the sequence patterns of the communication process and construct a time-series model. It introduces communication context and time-series constraints at the log level, which overcomes the problem that existing methods rely only on single log entries or short window statistics and are difficult to identify slow, hidden and phased anomalies. This improves the detection capability of low-frequency, gradual, and cross-phase abnormal communication behaviors.

[0015] 4. This invention integrates static association rules with temporal models into a comprehensive behavioral model and executes a "rule matching - comparative analysis - deviation judgment" process in real-time detection. This enables unified judgment of deviation behaviors such as "satisfying the antecedent but not the consequent" and "violating sequence constraints". It overcomes the problem that a single model is difficult to take into account both combination rules and temporal rules, and is prone to missed detections or false alarms. This improves the completeness and robustness of the detection results and reduces the risk of false alarms and missed detections.

[0016] 5. This invention generates alarms and displays them visually after an anomaly is detected. It can output the hit rule / sequence pattern identifier and deviation type corresponding to the anomaly, which overcomes the problem that some learning methods are "black boxed" and thus cannot support security audit and handling decisions. This improves the efficiency of event tracing and the ability to support handling decisions, and is suitable for continuous security operation scenarios of industrial control systems and enterprise network boundaries. Attached Figure Description

[0017] Figure 1 This is an overall schematic diagram of the anomaly detection method for tobacco manufacturing industrial control systems based on communication rule mining, as described in this invention. Figure 2 This is a flowchart illustrating the anomaly detection method for tobacco manufacturing industrial control systems based on communication rule mining, as described in this invention. Detailed Implementation

[0018] In this embodiment, a firewall communication log anomaly detection method based on the fusion of association rules and sequence patterns is described, such as... Figure 1 and Figure 2 As shown, the procedure is as follows: Step 1: Collect historical log data from the firewall and perform data cleaning and formatting preprocessing to obtain a structured historical log event set E; Step 1.1: Parse the key fields of the historical log data to obtain the original structured records; the key fields should include at least: source IP, destination IP, port, protocol, and action; Step 1.2: Process missing fields, remove illegal field values, and remove duplicate records from the original structured records, and format the timestamps uniformly; Step 1.3: Map the processed records to a preset log event representation e. t Where t represents the time when the event occurs, and e t It consists of at least ⟨srcIP,dstIP,port,proto,action>, thus obtaining the structured historical log dataset E; Step 1.4: Let any i-th historical log event in E be denoted as e. i = <t i ,srcIP i dstIP i ,port i ,proto i action i >, where t i srcIP represents the time when the i-th historical log event occurred. i dstIP represents the source IP of the i-th historical log event. i The port represents the destination IP address of the i-th historical log event. i The port representing the i-th historical log event, proto i The protocol representing the i-th historical log event, action i Let N represent the action of the i-th historical log event; let N represent the total number of historical log events in E.

[0019] Step 2: Mine E to obtain a set of static association rules; Step 2.1: Since the input to the Apriori algorithm is a transaction database consisting of multiple itemset transactions, and its frequent itemset counting is based on the set inclusion relation X⊆T; to enable historical log events to participate in inclusion relation judgment and support counting in the form of "field = value" itemsets, and to avoid ambiguity in field position and symbol mixing caused by directly using ordered records, a transaction mapping function φ is defined to transfer e i Transform into the i-th unordered itemset transaction T i This generates the transaction database D={T1,T2,…,T...} required by the Apriori algorithm. i ,…,T N}

[0020] In practice, the mapping rule for the transaction mapping function φ is as follows: Recording e in the log event i For each field f∈F in the predefined key field set F, construct an item item(f)=(f=valuef(e)). i ), Where, valuef(e i ) indicates that e is recorded in the log event. i The possible values ​​of field f; And combine all field items into an itemset transaction T i =φ(e i )={item(f)|f∈F}, where the key field set F includes at least {srcIP,dstIP,port,proto,action}; To ensure the comparability and countability of transaction itemsets, for any transaction T... i Apply a unique constraint to the same field: Only one item is allowed for the same field f (f=v), and missing fields are filled or deleted using a preset null value marker; thus, all transactions constitute a transaction database D for mining frequent itemsets and association rules.

[0021] Step 2.2: Use the Apriori algorithm to mine the association rule set X→Y in the transaction database D, where X is the set of items preceding the rule and Y is the set of items following the rule; and Y contains at least "action=a "item; Step 2.3: Calculate the support (x→y) and confidence (x→y) of any association rule x→y in the association rule set X→Y using equations (4) and (5), respectively: Support(x→y) = |{T i ∈D∶X∪Y⊆T i}∣ / ∣D∣(4) Confidence(x→y)=∣{T i ∈D∶X∪Y⊆T i}∣ / ∣{T i ∈D∶X⊆T i}∣(5) In equations (4) and (5), : represents the separator for set construction / screening conditions; / represents division; || represents the cardinality of the set; x represents the first itemset of a rule in X, and y represents the second itemset of the rule.

[0022] Step 2.4: Filter association rules based on thresholds: If the judgment formula (6) is true, then the association rule x→y is a valid static association rule; otherwise, delete the association rule x→y and obtain the filtered association rule set X'→Y'. Support(x→y)≥θs Confidence(x→y)≥θc (6) In equation (6), θs is the minimum support threshold and θc is the minimum confidence threshold; It indicates that...

[0023] Step 2.5: Construct the static rule constraint C of the r-th association rule r: x'→y' in the filtered association rule set X'→Y'. r Cond r Act r This yields a static rule constraint set C, and for each constraint, its corresponding support and confidence are recorded as rule strength parameters for subsequent real-time matching and deviation determination. Wherein, Cond r This indicates that the field constraint item is extracted from the preceding item of the r-th association rule to form the r-th trigger condition, and Cond r = (f=v)∈X(f(e)=v), Let f(e) represent the value of field f read from any log event record e to be detected, v represent the specific value corresponding to this field, and f(e) = v represent retrieving the value of field f from event e and determining whether it is equal to v. r This indicates that the desired action item is extracted from the r-th association rule and the r-th desired action constraint is formed; and Act r action(e)=a ;a The value to be taken for the action given in the rule.

[0024] Step 3: Use the improved PrefixSpan algorithm to mine the structured historical log event set E, obtain the time-series communication pattern, and construct a time-series model; Step 3.1: Using a sliding time window, divide E into a set of event sequences S={S1,S2,…,S…} in chronological order. m ,…,S M}, where S m Let S represent the sequence of events m, and S m = <e m ,1,e m ,2,…,e m , k …,e m , Lm >,em , k S represents m The k-th event, L m For S m The number of events included; S m Indicates that in the same session, key=<srcIP,dstIP,port,proto> The following is a group of log events arranged chronologically; the session key is used to ensure that log events within the same event sequence have a consistent communication context, making events within the sequence comparable in terms of source / destination address, communication port, and protocol, thereby meeting the modeling requirements of "evolution process of similar events" for subsequent sequence pattern mining; when the time interval between adjacent events is greater than a preset threshold Δt or crosses the window boundary, they are divided into different event sequences.

[0025] Step 3.2: Construct the sequence mining constraint set Ω, including: sliding time window constraint, maximum interval constraint between adjacent events, minimum interval constraint between adjacent events, length constraint of sequence item, and minimum sequence support threshold constraint; Step 3.3: Use the PrefixSpan algorithm to mine the candidate set of time-series communication patterns P={p1,p2,…,p} in S. w ,…,p W}, where p w This represents the w-th sequence pattern formed by combining key fields; Step 3.4: Select all sequence patterns from P that satisfy the sequence mining constraint set Ω and form a sequence pattern set Π, thereby mapping the sequence pattern set to a time series model. The time series model includes at least: pattern identifier, applicable conditions, constraint field set, expected sequence position, and threshold parameters (including pattern support parameters and allowed sliding time window or interval constraint parameters).

[0026] Step 4: Encapsulate the static rule constraint set C into a static rule module R, and encapsulate the temporal model into a temporal pattern module T. Then, merge the static rule module R and the temporal pattern module T with a unified data structure into a comprehensive behavioral model M. The comprehensive behavioral model M includes: rule / pattern identifier, applicable conditions, constraint field set, expected action or expected sequence position, and threshold parameter. Configure deviation judgment weight parameters for the static rule module R and the temporal pattern module T in the comprehensive behavioral model M, respectively, for subsequent deviation judgment.

[0027] Step 5: Collect real-time communication logs and match and compare them with the comprehensive behavior model M. If the real-time communication logs do not deviate from M, they are marked as normal behavior, and the next real-time communication log is evaluated. Otherwise, the real-time communication logs are determined to be abnormal behavior logs, and alarm information is generated. The abnormal behavior and alarm information are then visualized on the interface. In this embodiment, the alarm information includes at least: the time of the anomaly, source IP, destination IP, port, protocol, action, the matched rule / sequence pattern identifier, deviation type, and anomaly level.

[0028] Step 5.1: Extract key fields from the real-time communication log and construct event e at time t. t ; Step 5.2, e t Match with C: If an association rule exists such that e t If the first term of the rule is satisfied but the second term is not satisfied, then e is generated. t Static deviation marker DR t =1, otherwise, let DR t =0.

[0029] Step 5.3, e t Match the real-time event sequence with the time series model: If the e t If the real-time event sequence violates the expected sequence position of the time series model, or violates the threshold parameters of the sequence pattern (including allowed sliding time windows or interval constraint parameters), then e is generated. t Timing deviation marker DT t =1, otherwise, let DT t =0.

[0030] Step 5.4, when DR t =1 or DT t When DR = 1, the real-time communication log is determined to deviate from the comprehensive behavior model M; when DR = 1, the real-time communication log is determined to deviate from the comprehensive behavior model M. t =0 and DT t When =0, it is determined that the real-time communication log has not deviated from the comprehensive behavior model M.

[0031] In this embodiment, an electronic device includes a memory and a processor. The memory is used to store a program that supports the processor in executing the above-described firewall communication log anomaly detection method, and the processor is configured to execute the program stored in the memory.

[0032] In this embodiment, a computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the firewall communication log anomaly detection method described above.

Claims

1. A method for detecting anomalies in firewall communication logs based on the fusion of association rules and sequence patterns, characterized in that, The procedure is as follows: Step 1: Collect historical log data from the firewall and preprocess it to obtain a structured historical log event set E; let any i-th historical log event in E be denoted as e. i = <t i ,srcIP i dstIP i ,port i ,proto i action i >, where t i srcIP represents the time when the i-th historical log event occurred. i dstIP represents the source IP of the i-th historical log event. i The port represents the destination IP address of the i-th historical log event. i The port representing the i-th historical log event, proto i The protocol representing the i-th historical log event, action i Let N represent the action of the i-th historical log event; let N represent the total number of historical log events in E; Step 2: Mine E to obtain the static rule constraint set C; Step 3: Use the improved PrefixSpan algorithm to mine the structured historical log event set E, obtain the time-series communication pattern, and construct a time-series model; Step 4: The static rule constraint set C is weighted and fused with the time series model to generate a comprehensive behavior model M. The comprehensive behavior model M includes: rule / pattern identifier, applicable conditions, constraint field set, expected action or expected sequence position, and threshold parameter. Step 5: Collect real-time communication logs and match and compare them with the comprehensive behavior model M. If the real-time communication logs do not deviate from M, the real-time communication logs are marked as normal behavior, and the next real-time communication log is judged. Otherwise, the real-time communication logs are judged as abnormal behavior logs, and visual alarm information is generated.

2. The firewall communication log anomaly detection method based on association rules and sequence pattern fusion as described in claim 1, characterized in that, Step two includes: Step 2.1: Use the transaction mapping function φ to map e i Transform into the i-th unordered itemset transaction T i This generates a transactional database D={T1,T2,…,T i ,…,T N }; Step 2.2: Use the Apriori algorithm to mine the association rule set X→Y in the transaction database D, where X is the set of items preceding the rule and Y is the set of items following the rule; Step 2.3: Calculate the support (x→y) and confidence (x→y) of any association rule x→y in the association rule set X→Y using equations (4) and (5), respectively: Support(x→y)=∣{T i ∈D︰X∪Y⊆T i }∣ / ∣D∣(4) Confidence(x→y)=∣{T i ∈D︰X∪Y⊆T i }∣ / ∣{T i ∈D︰X⊆T i }∣(5) In equations (4) and (5), : represents the separator for set construction / filtering conditions; / represents division; || represents the cardinality of the set; x represents the preceding itemset of any association rule in X, and y represents the following itemset of the corresponding association rule; Step 2.4: Determine whether equation (6) is true. If it is true, then any association rule x→y is a valid static association rule. Otherwise, delete the corresponding association rule x→y to obtain the filtered association rule set X'→Y'. Support(x→y)≥θs Confidence(x→y)≥θc (6) In equation (6), θs is the minimum support threshold and θc is the minimum confidence threshold; Indicates and; Step 2.5: Construct the static rule constraint C of the r-th association rule in the filtered association rule set X'→Y'. r Cond r Act r Thus, the static rule constraint set C is obtained, where Cond r This indicates that the field constraint item is extracted from the set of rules preceding the r-th association rule to form the r-th trigger condition, Act. r This represents the expected action item extracted from the r-th association rule and forming the r-th expected action constraint.

3. The firewall communication log anomaly detection method based on association rules and sequence pattern fusion according to claim 2, characterized in that, Step three includes: Step 3.1: Divide E into event sequence sets S={S1,S2,…,S...} according to the sliding time window. m ,…,S M }, where S m Let S represent the sequence of events m, and S m = <e m ,1,e m ,2,…,e m , k …,e m , Lm >,e m , k S represents m The k-th event, L m For S m The number of events included; Step 3.2: Construct the sequence mining constraint set Ω, including: sliding time window constraint, maximum interval constraint between adjacent events, minimum interval constraint between adjacent events, length constraint of sequence item, and minimum sequence support threshold constraint; Step 3.3: Use the PrefixSpan algorithm to mine the candidate set of time-series communication patterns P={p1,p2,…,p} in S. w ,…,p W }, where p w This represents the w-th timing communication pattern formed by the combination of key fields; Step 3.4: Select all time-series communication patterns from P that satisfy the sequence mining constraint set Ω and form a time-series communication pattern set Π, thereby mapping the time-series communication pattern set to a time-series model. The time-series model includes at least: pattern identifier, applicable conditions, constraint field set, expected sequence position, and threshold parameter. The threshold parameter includes: pattern support parameter and allowed sliding time window or interval constraint parameter.

4. The firewall communication log anomaly detection method based on association rules and sequence pattern fusion according to claim 3, characterized in that, Step five includes: Step 5.1: Extract key fields from the real-time communication log and construct event e at time t. t ; Step 5.2, e t Match with C: If an association rule exists such that e t If the set of terms preceding the rule is satisfied but the set of terms following the rule is not satisfied, then generate e. t Static deviation marker DR t =1, otherwise, let DR t =0; Step 5.3, e t Match the real-time event sequence with the time series model: If e t If the real-time event sequence violates the expected sequence position of the time series model, or violates the threshold parameter of the sequence model, then e is generated. t Timing deviation marker DT t =1, otherwise, let DT t =0; Step 5.4, when DR t =1 or DT t When DR = 1, it is determined that the real-time communication log deviates from the comprehensive behavior model M; when DR t =0 and DT t When =0, it is determined that the real-time communication log has not deviated from the comprehensive behavior model M.

5. An electronic device, comprising a memory and a processor, characterized in that, The memory is used to store a program that supports the processor in executing the firewall communication log anomaly detection method according to any one of claims 1-4, and the processor is configured to execute the program stored in the memory.

6. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program, when executed by the processor, performs the steps of the firewall communication log anomaly detection method according to any one of claims 1-4.

Images