Real-time anomaly detection and tracing method and system for cloud storage logs

Abstract

The invention relates to the technical field of log detection, in particular to a real-time anomaly detection and tracing method and system for a cloud storage log, and the method comprises the following steps: calculating an authentication failure proportion based on a user identifier and an internet protocol address, constructing a proportion change sequence, comparing an abrupt change threshold, screening candidate sections, fitting a slope, and aggregating anomaly records; calculating a fluctuation difference sequence, extracting a causal fracture node, recombining a subsequence graph, extracting a cross-node record and correcting a timestamp, connecting a transmission edge based on the timestamp, and accounting time consumption to construct a traceability path. According to the method, the serious defect that a fixed threshold value cannot sense system load fluctuation is overcome by constructing a dynamic proportion change slope, a causal fracture node is established to drive log atlas recombination so as to break an information barrier of a cross-node distributed environment, and a median function is used for correcting time migration to eliminate disorder interference caused by clock asynchronization; and the accurate risk tracing is realized by connecting the correction timestamp with the access transmission edge.

Description

Technical Field

[0001] This invention relates to the field of log detection technology, and in particular to a method and system for real-time anomaly detection and tracing of cloud storage logs. Background Technology

[0002] The field of log detection technology refers to the technical system for collecting, storing, parsing, analyzing, and managing log data generated during the operation of various information systems. It mainly covers multiple data sources such as operating system logs, application logs, database logs, network device logs, and cloud platform operation logs. Its core aspects include the definition and unified standardization of log data formats, centralized collection mechanisms in distributed environments, log association based on timestamps and session identifiers, construction of log indexing and retrieval structures, formulation of abnormal behavior identification rules, and long-term archiving and audit management of log data. In the context of cloud computing architecture, it also involves log isolation in multi-tenant environments, cross-node log synchronization, log consistency maintenance during elastic scaling, and the design of hierarchical storage structures for massive logs, thus forming a comprehensive technical system for monitoring the operational status and security auditing of large-scale distributed systems.

[0003] The traditional real-time anomaly detection and tracing method for cloud storage logs refers to the process of analyzing and comparing operation logs and access logs generated by cloud storage systems during data reading and writing, object creation and deletion, permission changes, access authentication, and interface calls. This is achieved by pre-defining anomaly threshold rules, using time-window-based access frequency statistics, screening for abnormal behavior through fixed field matching, and connecting access trajectories based on user identifiers and IP addresses. When anomalies such as exceeding access limits, concentrated access during unusual time periods, or cross-regional access are detected, corresponding log entries are recorded. Then, by retrieving information such as operation timestamps, request source addresses, bucket names, and object identifiers, an event timeline is constructed. The source path, operation sequence, and related accounts of abnormal behavior are traced manually or semi-automatically, thereby completing the identification and source location of abnormal operation behaviors in the cloud storage environment.

[0004] Traditional detection methods mainly rely on setting fixed threshold rules and solidified field matching mechanisms to conduct item-by-item comparisons. When faced with massive concurrent access, the solidified thresholds are difficult to adapt to dynamic load fluctuations. Single frequency statistics are prone to missing hidden proportional changes hidden in normal access volume. At the same time, the reconstruction of abnormal behavior trajectories relies heavily on manually retrieving timestamps and request source addresses to piece together the event timeline. Semi-automatic tracing leads to a lengthened abnormal response cycle, and in a distributed interactive environment, causal relationships are easily broken, making it difficult to accurately depict the evolution path and locate the source. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing a real-time anomaly detection and tracing method and system for cloud storage logs.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for real-time anomaly detection and tracing of cloud storage logs, comprising the following steps: S1: Arrange cloud logs to construct target time-series logs, divide the target time-series logs to construct a set time window, divide the total number of authentication failures within the set time window by the total number of access requests to calculate the failure ratio value, calculate the difference in failure ratio values ​​between adjacent time windows, and construct a ratio change sequence. S2: Compare the ratio change sequence with the preset mutation threshold, filter abnormal segments, fit the failure ratio value of the abnormal segments, calculate the ratio change slope, extract the compliance frequency of the ratio change slope exceeding the trigger number threshold, aggregate the corresponding cloud storage request days, and construct an abnormal trigger record set. S3: Collect the timestamps of records in the abnormal trigger record set, perform difference calculation on the timestamps of records adjacent to the same user, construct a time difference array, calculate the difference between adjacent elements in the time difference array, and construct a fluctuation difference sequence; S4: Compare the fluctuation difference sequence with the preset jump threshold, construct a causal break node based on the record node corresponding to the fluctuation difference sequence that exceeds the jump threshold, and extract cross-node log records; S5: Extract the original timestamps of nodes from the cross-node log records, subtract the median of the baseline offset from the original timestamps of the nodes to calculate the corrected timestamps, arrange the corrected timestamps, construct the node access order, connect adjacent identifiers of the access order to construct the transmission edge, compare the transmission edge time with the minimum time, and construct the anomaly tracing path.

[0007] As a further embodiment of the present invention, the proportional change sequence includes a sequence start point, a change amplitude, and a difference polarity; the abnormal trigger record set includes a trigger flag bit, a source port number, and a load data segment; the fluctuation difference sequence includes a sequence peak, a sequence trough, and an oscillation phase; the cross-node log record includes node routing information, a gateway status code, and a protocol version identifier; and the abnormal source tracing path includes a topological directed edge, a link hop count, and a destination network segment address.

[0008] As a further aspect of the present invention, the step of obtaining the ratio change sequence specifically includes: S101: Obtain cloud storage request logs, extract the user identifier and Internet Protocol address carried in the request message, perform multi-dimensional field joint sorting on the user identifier and Internet Protocol address for the cloud storage request logs, and perform ascending sorting and reorganization in combination with the timestamps generated by the log records to construct the target time-series log. S102: For the target time-series log, call the preset monitoring duration parameter to perform sliding segmentation processing, construct a set time window with equal time span, obtain the authentication failure request record and access request record existing in each set time window, perform traversal and accumulation on the authentication failure request record to obtain the total number of authentication failures, perform traversal and accumulation on the access request record to obtain the total number of access requests, perform division operation on the total number of authentication failures and the total number of access requests to generate a failure ratio value; S103: Perform differential operation on the time series set consisting of multiple failure ratio values, call the failure ratio value corresponding to the current time segment and the failure ratio value corresponding to the adjacent previous time segment, calculate the change difference between the current time segment and the adjacent previous time segment based on the difference between the two, establish a set of fluctuation parameters characterizing the trend of ratio evolution through the change difference, and generate a ratio change sequence.

[0009] As a further aspect of the present invention, the step of obtaining the abnormal trigger record set specifically includes: S201: Call the preset mutation threshold, compare the fluctuation parameters in the proportional change sequence with the mutation threshold, extract the time coordinates corresponding to the fluctuation values ​​that exceed the mutation threshold, perform a truncation operation on the set time window according to the time coordinates, and generate abnormal candidate segments. S202: For the abnormal candidate segment, extract the corresponding failure ratio value, obtain the preset baseline ratio, sampling time step, fluctuation frequency, node time consumption range and cluster synchronization cycle, perform fitting derivation on the failure ratio value, and calculate the slope of the ratio change. S203: Call the slope of the proportional change to determine polarity, count the number of consecutive nodes greater than zero, generate the compliance frequency, locate the abnormal candidate segment according to the compliance frequency exceeding the preset number, extract the corresponding cloud storage request logs and perform splicing and merging to obtain the abnormal trigger record set.

[0010] As a further aspect of the present invention, the process of setting the mutation threshold specifically involves: acquiring a baseline request log under a historical anomaly-free state; dividing the baseline request log into equal-length time segments; calculating the difference in the authentication failure ratio between adjacent time segments to construct a historical fluctuation sequence; statistically analyzing the numerical distribution in the historical fluctuation sequence; calculating the arithmetic mean of the distribution differences to generate a baseline expected value; and calculating the root mean square of the deviation of each numerical value in the historical fluctuation sequence from the baseline expected value to generate a standard deviation; extracting a preset confidence multiple; multiplying the standard deviation by the confidence multiple to obtain a floating tolerance; summing the floating tolerance by the baseline expected value; and defining the merged numerical value as the mutation threshold.

[0011] As a further aspect of the present invention, the step of obtaining the fluctuation difference sequence specifically includes: S301: Obtain the abnormal trigger record set, extract the record timestamp of each log record, call the user identifier to perform grouping and clustering processing on the abnormal trigger record set, perform ascending order reordering based on the global unified time axis dimension for the record timestamps belonging to the same user identifier group, establish an access pipeline corresponding to a single user identity behavior according to the logical order of the record timestamps, and generate a log time sequence arrangement sequence. S302: For the log time sequence, extract the timestamps of two records in adjacent positions, call the numerical subtraction logic operator to calculate the numerical deviation between the timestamp of the next record and the timestamp of the previous record, obtain the time step component that represents the distribution characteristics of the user request time interval, perform linear combination of multiple time step components according to the order of their generation time and fill them into a one-dimensional vector storage container to establish a time difference array. S303: Call the time difference array, extract the two time step components at adjacent index positions, perform a second numerical fluctuation difference calculation, obtain the change value between the time step component at the current index position and the time step component at the previous index position, obtain the fluctuation offset characteristic representing the non-uniformity of the access interval distribution, perform time series feature vectorization mapping processing on the fluctuation offset, and aggregate it into the discrete data sequence set space to generate a fluctuation difference sequence.

[0012] As a further aspect of the present invention, the step of obtaining cross-node log records specifically includes: S401: Call the preset jump threshold, perform a one-to-one comparison operation between the value of each element in the fluctuation difference sequence and the jump threshold, extract the time index corresponding to the element whose value exceeds the jump threshold, perform spatial mapping and positioning on the communication interaction endpoint according to the time index, perform isolation marking on the spatial mapping and positioning result, and establish causal break nodes. S402: For the set of abnormal trigger records, extract the corresponding association matrix, call the causal break node as the boundary parameter to perform structural segmentation on the association matrix, obtain discrete sub-links, perform directed edge connection reorganization on the node elements in the discrete sub-links based on the communication order between the request source address and the response address, construct multi-dimensional topological relationships by combining the hierarchical depth attributes, and establish a sub-sequence graph; S403: Based on the subsequence graph, extract the internal branch directed paths, perform heterogeneity logic judgment on the endpoint identifiers at both ends of each branch directed path, extract the abnormal access data packets corresponding to the paths with inconsistent endpoint identifiers, perform load field parsing and aggregation encapsulation on the abnormal access data packets, convert them into a same-origin traceability text set, and obtain cross-node log records.

[0013] As a further embodiment of the present invention, the method for setting the jump threshold is as follows: obtaining a preset historical business benchmark time series record, extracting the timestamps from the historical business benchmark time series record to construct a benchmark time difference array, calculating the difference between adjacent elements in the benchmark time difference array to obtain a benchmark fluctuation value sequence, calling the mean function to perform an operation on the benchmark fluctuation value sequence to obtain the expected mean of fluctuation, calculating the discrete standard deviation of the benchmark fluctuation value sequence, extracting a preset distribution interval coefficient, performing a multiplication operation on the discrete standard deviation and the distribution interval coefficient to obtain the tolerance extreme value, and performing an addition operation on the expected mean of fluctuation and the difference extreme value to generate the jump threshold.

[0014] As a further aspect of the present invention, the step of obtaining the anomaly tracing path specifically includes: S501: Call the cross-node log record, extract the original timestamp of the node, obtain the global central time base value, calculate the difference between the global central time base value and the original timestamp of the node, obtain the node time offset, extract the sorted center element for the node time offset, establish the median of the base offset, subtract the median of the base offset from the original timestamp of the node to perform numerical alignment calculation, and generate the corrected timestamp. S502: Based on the correction timestamps of multiple records, perform time ascending sorting, extract the corresponding node identifier according to the position, perform association integration, establish node access order, extract the neighboring node identifiers according to the node access order, perform directed connection of neighboring node identifiers along the network request flow, establish access transmission edge, call the correction timestamps corresponding to both ends of the access transmission edge to perform numerical subtraction, and obtain the transmission time value. S503: Call the transmission time value to obtain the preset minimum communication transmission time, compare the transmission time value with the minimum communication transmission time, extract the access transmission edges corresponding to the values ​​less than the minimum communication transmission time, perform head-to-tail topology reassembly and assembly for the selected multiple access transmission edges, draw a directed graph structure covering the network interaction link space, and establish an anomaly tracing path.

[0015] A real-time anomaly detection and tracing system for cloud storage logs, the system being used to implement the aforementioned real-time anomaly detection and tracing method for cloud storage logs, the system comprising: The ratio change analysis module arranges cloud logs to construct target time-series logs, segments the target time-series logs to construct a set time window, divides the total number of authentication failures within the set time window by the total number of access requests to calculate the failure ratio value, calculates the difference in failure ratio values ​​between adjacent time windows, and constructs a ratio change sequence. The abnormal trigger identification module compares the ratio change sequence with a preset mutation threshold, filters abnormal segments, fits the failure ratio value of the abnormal segment, calculates the ratio change slope, extracts the compliance frequency of the ratio change slope exceeding the trigger number threshold, aggregates the corresponding cloud storage request days, and constructs an abnormal trigger record set. The abnormal fluctuation analysis module collects the timestamps of records within the abnormal trigger record set, performs difference calculations on the timestamps of records adjacent to the same user, constructs a time difference array, calculates the difference between adjacent elements in the time difference array, and constructs a fluctuation difference sequence. The node log processing module compares the fluctuation difference sequence with a preset jump threshold, constructs causal break nodes based on the record nodes corresponding to the fluctuation difference sequence that exceeds the jump threshold, and extracts cross-node log records. The anomaly tracing module extracts the original timestamps of nodes from the cross-node log records, calculates the corrected timestamps by subtracting the median of the baseline offset from the original timestamps, arranges the corrected timestamps, constructs the node access order, connects adjacent identifiers in the access order to construct a transmission edge, compares the transmission edge time with the minimum time, and constructs the anomaly tracing path.

[0016] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by combining target time-series logs and time windows to construct a dynamic proportional change sequence and calculate the slope, the drawback of fixed thresholds being unable to perceive load fluctuations is overcome. For abnormal trigger records, user identifiers are extracted to calculate time fluctuation difference sequences, and a graph-based reorganization of discrete records driven by causal break nodes is established. This breaks down information barriers in cross-node environments and displays the collaborative attack transmission link. The median function is used to calculate the benchmark offset and correct the node timestamp, eliminating the timing disorder interference caused by multi-node clock asynchrony. Based on the corrected timestamp, the transmission edge is connected and the communication time is calculated, constructing a strictly directional tracing path to achieve fully automated risk tracing based on strict causal logic. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the workflow of the present invention; Figure 2 This is a detailed flowchart of S1 of the present invention; Figure 3 This is a detailed flowchart of the S2 process of the present invention; Figure 4 This is a detailed flowchart of the S3 process of the present invention; Figure 5 This is a detailed flowchart of the S4 process of the present invention; Figure 6 This is a detailed flowchart of S5 of the present invention; Figure 7 This is a system flowchart of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0020] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0021] Please see Figure 1 This invention provides a technical solution: a method for real-time anomaly detection and tracing of cloud storage logs, comprising the following steps: S1: Obtain cloud storage request logs, sort the cloud storage request logs in ascending order based on user identifier and Internet Protocol address to construct target time-series logs, divide the target time-series logs to construct set time windows, calculate the total number of authentication failures and the total number of access requests within the set time window, divide the total number of authentication failures by the total number of access requests to calculate the failure ratio value, and calculate the difference between the failure ratio values ​​corresponding to adjacent set time windows to construct a ratio change sequence. S2: Compare the proportional change sequence with the mutation threshold. Based on the corresponding position of the proportional change sequence that exceeds the mutation threshold, filter and construct abnormal candidate segments within a set time window. Use a linear regression function to fit the corresponding failure proportion value within the abnormal candidate segment to calculate the proportional change slope. Filter the qualified frequency of proportional change slope that is greater than zero and exceeds the trigger number threshold. Extract the cloud storage request logs within the corresponding abnormal candidate segment and aggregate them to construct an abnormal trigger record set. S3: Collect the timestamps of records within the abnormal trigger record set, perform difference calculations on adjacent timestamps for the same user identifier to construct a time difference array, and calculate the difference between adjacent elements in the time difference array to construct a fluctuation difference sequence; S4: Compare the fluctuation difference sequence with the jump threshold, construct causal break nodes based on the record nodes corresponding to the fluctuation difference sequence that exceeds the jump threshold, reconstruct the graph structure of the abnormal trigger record set through the causal break nodes to construct a subsequence graph, and extract cross-node log records based on the subsequence graph; S5: Extract the original timestamps of nodes from the cross-node log records, calculate the difference between the central time base value and the original timestamp of the node to construct the node time offset, calculate the base offset median by performing a median function on the node time offset, subtract the base offset median from the original timestamp of the node to calculate the corrected timestamp, arrange the corrected timestamps in ascending order to construct the node access order, connect adjacent node identifiers in the node access order to construct access transmission edges, calculate the transmission time values ​​at both ends of the access transmission edge, and construct the anomaly tracing path based on the comparison result of the transmission time value and the minimum transmission time.

[0022] The proportional change sequence includes the sequence start point, change amplitude, and difference polarity; the abnormal trigger record set includes the trigger flag, source port number, and load data segment; the fluctuation difference sequence includes the sequence peak, sequence trough, and oscillation phase; the cross-node log record includes node routing information, gateway status code, and protocol version identifier; and the abnormal source tracing path includes the topology directed edge, link hop count, and destination network segment address.

[0023] Please see Figure 2 The specific steps for obtaining the proportional change sequence are as follows: S101: Obtain cloud storage request logs, extract the user identifier and Internet Protocol address carried in the request message, perform multi-dimensional field joint sorting on the user identifier and Internet Protocol address for the cloud storage request logs, and perform ascending sorting and reorganization in combination with the timestamps generated by the log records to construct the target time-series log. By sending a Hypertext Transfer Protocol (HTTP) fetch command to the cloud storage unified gateway on port 8080, the raw communication log data file generated by the distributed storage nodes over the past 24 hours was retrieved. This log data file is stored in a Lightweight Data Exchange (LTE) format and contains 100,000 unprocessed request records. Data cleaning was performed on the retrieved raw communication log data file. The log records were scanned line by line, and the key-value pair structure of each record was extracted. It was determined whether each record completely contained core fields. If a record was missing critical user-level credentials or network layer addressing node fields, it was marked as dirty data and removed from the memory processing queue. After filtering, 98,500 valid log records were retained. The user identifier string and Internet Protocol address (IPA) value string carried in the request messages of the cleaned valid log records were extracted. The extracted 32-bit user identifier string was defined as the first sorting key, and the extracted 32-bit IPA value string was defined as the second sorting key. For all valid log records, a multi-dimensional field joint sorting operation is performed. First, an ascending comparison of all records is executed based on the dictionary sequence value of the first sorting key. When multiple log records are found to have the same user identifier string, a secondary ascending comparison is performed using the second sorting key for these records, completing the clustering and reorganization of the physical location of the same entity's access source in the multi-dimensional space. Based on the dual sorting by user identifier and Internet Protocol address, the 64-bit precise timestamp data automatically added when the valid log records were generated is extracted as the third sorting key. Within each clustered and reorganized user group, the timestamp value is used to perform another ascending sort, placing log objects with smaller timestamps (earlier generation time) at the top and log objects with larger timestamps (later generation time) at the bottom. The 1-dimensional log sequence data, after multi-dimensional field joint sorting and timestamp ascending sorting, is persistently written to a high-speed disk cache pool, constructing a target time-series log with strict time and user attribute incrementing characteristics. To illustrate the execution process, we assume that three disorganized logs from the gateway, all originating from the same access source, are retrieved. All three logs share the user ID "user 1001" and the corresponding Internet Protocol address "192.168.1.1," but their request timestamps are 1620000010, 1620000001, and 1620000005, respectively. By executing the sorting and reorganization logic described above, since the first two keywords are identical, a third sorting keyword comparison is triggered. The record with timestamp 1620000001 is placed first, the record with timestamp 1620000005 is placed second, and the record with timestamp 1620000010 is placed third, thus generating a strictly time-aligned target time-series log.

[0024] S102: For the target time-series log, call the preset monitoring duration parameter to perform sliding segmentation processing, construct a set time window with equal time span, obtain the authentication failure request record and access request record existing in each set time window, perform traversal and accumulation on the authentication failure request record to obtain the total number of authentication failures, perform traversal and accumulation on the access request record to obtain the total number of access requests, perform a division operation on the total number of authentication failures and the total number of access requests to generate a failure ratio value; Dynamic slicing is performed on the target time-series log. A preset monitoring duration parameter is obtained and set to 300 seconds. Using 300 seconds as a fixed benchmark, a sliding segmentation operation is performed along the global timeline of the target time-series log in an increasing direction. The log records passed through in each sliding process are extracted and packaged to construct 50 set time windows with consecutive beginnings and ends and equal time spans of 300 seconds. All log data encapsulated in the first set time window is obtained, and the status code field of each log is parsed. When the status code value is equal to 401 or 403, it is identified as an authentication failure request record. When the status code value is equal to 200 or other normal response codes, it is recorded as an access request record along with the failure record. By performing a line-by-line traversal and cumulative statistics on all records in the first set time window, a total of 120 authentication failure request records and a total of 3000 access request records (including normal and abnormal records) are found in this time window. The proportion parameter is calculated by calling the division arithmetic logic. The specific calculation formula is as follows: Failure rate = Total number of authentication failures within the set time window / Total number of access requests within the set time window; Substituting the specific values ​​obtained from the aforementioned statistics into the formula, we get: Failure rate = 120 / 3000 = 0.04; Repeat the above traversal and division operation logic for all 50 set time windows to obtain 50 corresponding failure ratio values. Store these ratio values ​​in contiguous memory space for subsequent trend calculation.

[0025] Table 1. Statistics on the Request Status of Setting a Time Window; Table 1 lists the specific parameters obtained after performing the above sliding segmentation process and traversal accumulation in the first three set time windows.

[0026] S103: Perform differential operation on the time series set consisting of multiple failure ratio values, call the failure ratio value corresponding to the current time segment and the failure ratio value corresponding to the adjacent previous time segment, calculate the change difference between the current time segment and the adjacent previous time segment based on the difference between the two, establish a set of fluctuation parameters representing the trend of ratio evolution through the change difference, and generate a ratio change sequence. A difference operation is performed on a time series set consisting of 50 failure ratio values ​​arranged chronologically by their generation time. The index position of the current time segment is extracted from the time series set, and the failure ratio value corresponding to that index position is obtained. Simultaneously, the failure ratio value corresponding to the index position of the adjacent time segment is also obtained. Subtraction arithmetic logic is then used to calculate the difference in change between the current time segment and the adjacent time segment. The specific formula is as follows: Change in variance = Failure rate of the current time segment - Failure rate of the adjacent previous time segment; The measured data obtained in the previous steps is extracted and calculated. Given that the failure rate for the current second time segment is 0.06 and the failure rate for the adjacent first time segment is 0.04, the following calculation is obtained by substituting these two parameter values ​​into the formula: The difference in variation = 0.06 - 0.04 = 0.02; By sequentially performing the subtraction arithmetic logic on all elements in the time series set, a total of 49 variation quantities representing the jump amplitude of the ratio between adjacent windows are calculated. All the variation quantities obtained from the calculation are vectorized and assembled according to the absolute chronological order of the original time windows to establish a set of fluctuation parameters characterizing the evolution trend and jump direction of the business failure ratio. The discrete values ​​in this set of fluctuation parameters are integrated to generate a continuous ratio change sequence.

[0027] Please see Figure 3 The specific steps for obtaining the exception trigger record set are as follows: S201: Call the preset mutation threshold, compare the fluctuation parameters in the proportional change sequence with the mutation threshold, extract the time coordinates corresponding to the fluctuation values ​​that exceed the mutation threshold, perform a truncation operation on the set time window according to the time coordinates, and generate abnormal candidate segments. The specific process for setting the mutation threshold is as follows: First, obtain the baseline request logs under historical anomaly-free conditions. Then, divide the baseline request logs into equal-length time segments, calculate the difference in the authentication failure rate between adjacent time segments, and construct a historical fluctuation sequence. Next, statistically analyze the numerical distribution in the historical fluctuation sequence, calculate the arithmetic mean of the distribution differences to generate the baseline expected value, and calculate the root mean square of each value in the historical fluctuation sequence that deviates from the baseline expected value to generate the standard deviation. Finally, extract a preset confidence multiple, multiply the standard deviation by the confidence multiple to obtain the floating tolerance, sum the floating tolerance with the baseline expected value, and define the resulting combined value as the mutation threshold. Obtain the baseline request logs after 15 consecutive days of operation without any abnormal status alarms. Physically segment these logs into 300-second time segments. Calculate the difference between the authentication failure rates of every two adjacent time segments. Concatenate all the resulting differences to construct a historical fluctuation sequence containing 4320 elements. Extract the numerical distribution characteristics from this historical fluctuation sequence and perform a mean calculation. The specific formula is as follows: Benchmark expected value = Sum of all distribution differences in the historical fluctuation series / Total number of differences in historical time segments; The sum of all distribution differences is 86.4. Given that the total number of differences across historical time segments is 4320, substituting these values ​​into the formula yields: The baseline expected value = 86.4 / 4320 = 0.02; Based on this benchmark expectation, the root mean square arithmetic logic is further invoked to extract the sequence deviation characteristics. The specific formula is as follows: Standard deviation = (Sum of squares of the differences between each distribution difference in the historical fluctuation series and the benchmark expected value / Total number of differences in historical time segments)^0.5; The sum of squares of 4320 data points was calculated to be 3.888. Substituting this into the formula, we get: The standard deviation is calculated as (3.888 / 4320)^0.5 = 0.03. Extract the confidence factor preset in the configuration file. This confidence factor is set to 3.0 based on the high probability confidence interval of the normal distribution. Then, use multiplication logic to calculate the extreme value tolerance. The specific formula is as follows: Float tolerance = Standard deviation * Confidence factor; Substituting the parameter values, the calculation yields: Floating tolerance = 0.03 * 3.0 = 0.09; This tolerance limit is further combined with the benchmark value, and the specific formula is as follows: Mutation threshold = baseline expected value + floating tolerance; Substituting the parameter values, the calculation yields: Mutation threshold = 0.02 + 0.09 = 0.11; The dynamically set mutation threshold of 0.11 is invoked, and all fluctuation parameters within the current measured proportional change sequence are read and compared sequentially. When the fluctuation value corresponding to the 8th time segment reaches 0.15, it is determined that the value 0.15 exceeds the mutation threshold of 0.11, and the absolute timestamp coordinates corresponding to the fluctuation value are extracted. Taking the occurrence time point corresponding to this time coordinate as the center point, extending forward 150 seconds and backward 150 seconds, a physical cutting and stripping operation is performed on the original time window. The stripped time segments containing violent fluctuations are separately encapsulated to generate anomaly candidate segments.

[0028] S202: For abnormal candidate segments, extract the corresponding failure ratio values, obtain the preset baseline ratio, sampling time step, fluctuation frequency, node time consumption range, and cluster synchronization cycle, and perform fitting derivation on the failure ratio values ​​using the following formula: ; The slope of the proportional change is obtained through calculation; in, The slope of the proportional change. The failure rate is calculated by dividing the total number of authentication failures by the total number of access requests within a specified time window. The baseline ratio is obtained by reading historical authentication ratio parameters from a preset period of stable system operation. The normalized value representing the sampling time step is obtained by mapping the time span of the current anomaly candidate segment to a preset standard time segment length. The normalized value representing the frequency of fluctuations is calculated by dividing the number of fluctuations caused by the failure ratio within the anomaly candidate segment by the total number of records in that segment. The normalized value representing the range of node response times is obtained by extracting the difference between the maximum and minimum node response times of all records within the anomaly candidate segment and then performing dimensionless processing. The normalized value representing the cluster synchronization cycle is obtained by reading the preset synchronization interval configuration parameters of the cloud storage cluster and calculating it based on the global reference time. Extract the isolated and encapsulated anomaly candidate segments and read the failure ratio values ​​carried within them as the basis for target calculation. Obtain the preset cloud storage underlying parameter variables, where the baseline ratio is obtained by inverting the authentication success rate in the historical monitoring records during the stable operation phase of the system, and its specific value is set to 0.015. Obtain the normalized value of the sampling time step, which is obtained by calculating the total span of the current anomaly candidate segment (300 seconds) and dividing it by the standard time segment length (300 seconds) and performing a mapping operation, and its value is 1.0. For the normalized value of the fluctuation frequency, count the number of times the failure ratio within the anomaly candidate segment jumps and fluctuates, which is 15 times. The total number of records in this segment is 300. Divide the number of fluctuations by the total number of records to obtain a value of 0.05. From all communication records within this segment, the maximum node response time (1.8 seconds) and the minimum node response time (0.2 seconds) are selected. Subtraction is performed to obtain a difference of 1.6 seconds, which is then divided by the response timeout limit constant of 2.0 seconds to achieve dimensionless processing, resulting in a normalized value of 0.8 for the node response time range. The preset synchronization interval configuration parameter of the cloud storage cluster is read, with a physical value set to 0.5 seconds. This value is divided by the global base time of 1.0 second to perform a conversion operation, obtaining a normalized value of 0.5 for the cluster synchronization cycle. For all obtained numerical parameters, the proportional change slope calculation formula is called to perform fitting derivation. The specific formula is as follows: ; Substituting the actual values ​​of the parameters into the calculation logic, the actual failure rate within the anomaly candidate segment is known to be 0.065. The slope of the proportional change = (0.065 - 0.015) / 1.0 + 0.05 * (absolute value (0.8 - 0.5) / 0.5)^0.5; The slope of the proportional change = 0.05 / 1.0 + 0.05*(0.3 / 0.5)^0.5; The slope of the proportional change = 0.05 + 0.05 * 0.6^0.5; It is known that the square root of 0.6 is approximately 0.774; The slope of the proportional change = 0.05 + 0.05 * 0.774 = 0.05 + 0.0387 = 0.0887; The advantage of this operational logic lies in the fact that by introducing the normalized value of the node latency difference and the normalized value of the cluster synchronization cycle into the difference operation, and introducing a square root operation at the end to nonlinearly amplify and map the unstable fluctuations of the underlying synchronization delay, it deeply explores the implicit amplification correlation effect of the backend data node synchronization blockage on the frontend gateway authentication failure rate.

[0029] S203: Use the slope of the proportional change to determine polarity, count the number of consecutive nodes greater than zero, generate the compliance frequency, locate the abnormal candidate segment based on the compliance frequency exceeding the preset number, extract the corresponding cloud storage request logs and perform splicing and merging to obtain the abnormal trigger record set; The system calls upon the proportional change slope data set to perform a polarity determination operation. It reads the proportional change slope values ​​one by one and compares them with the polarity boundary baseline of 0. When a proportional change slope value greater than 0 is read, its polarity state is marked as a positive abrupt change point, and a continuous counter is activated to perform cumulative calculations, increasing the number of consecutive nodes greater than 0 by one unit, thereby dynamically updating the target frequency. During the polarity determination traversal, if a proportional change slope value less than or equal to 0 is encountered, the continuous counter is immediately reset and the counting restarts. The maximum number of occurrences within the preset system tolerance limit is 3. When the detected target frequency reaches 4 times, exceeding the preset tolerance limit, it is determined that a continuously deteriorating chain of anomalies has occurred within the current detection cycle. Based on the time span corresponding to this compliance frequency, the core anomaly candidate segment is accurately located. All scattered cloud storage request log data contained in this segment are extracted. Based on the memory block copy operation, these scattered request log objects are concatenated and processed in chronological order of occurrence. After the merging is completed, the scattered memory space is released, resulting in a set of anomaly trigger records containing a complete chain of evidence of risk fluctuations.

[0030] Table 2. Judgment Table of Slope Polarity and Frequency of Meeting Standards for Abnormal Candidate Sections; Table 2 shows the specific state markers generated after polarity determination for three consecutive segments and the corresponding achievement frequency evolution process.

[0031] Please see Figure 4 The specific steps for obtaining the fluctuation difference sequence are as follows: S301: Obtain the set of abnormal trigger records, extract the record timestamp of each log record, call the user identifier to perform grouping and clustering processing on the set of abnormal trigger records, perform ascending order reordering based on the global unified time axis dimension for the record timestamps belonging to the same user identifier group, establish an access pipeline corresponding to a single user identity behavior according to the logical order of the record timestamps, and generate a log time sequence arrangement sequence. The system retrieves the assembled set of exception trigger records and scans each request log data block within it. It extracts the 64-bit timestamp from the header of each log record and the 32-bit user identifier string from the authentication field. The extracted user identifier strings are then used to perform grouping and clustering on the entire exception trigger record set. A key-value hash table is initialized in memory, using the same user identifier string as the unique key and appending the memory addresses of log objects belonging to that identifier as the corresponding values ​​to the hash table. This breaks down the disorganized records into multiple independent identity space groups. For all record timestamps stored within a group belonging to the same user identifier (e.g., user 1005), a quicksort mechanism is used to perform an ascending reordering based on a globally unified timeline. The system compares the number of seconds since each record occurred within the group, moving the pointers of earlier occurring records to the head of the list and later occurring records to the tail. Based on the strict physical logical order presented by the sorted record timestamps, a pipeline of all actions initiated by that single user identity is established. After clustering and sorting, all structured data is written from the in-memory hash table to a persistent storage sequence, generating a log time-series sequence that can be called by streaming analysis.

[0032] S302: For the log time sequence, extract the timestamps of two records in adjacent positions, call the numerical subtraction logic operator to calculate the numerical deviation between the timestamp of the next record and the timestamp of the previous record, obtain the time step component that represents the distribution characteristics of the user request time interval, perform linear combination of multiple time step components according to the order of their generation time and fill them into a one-dimensional vector storage container to establish a time difference array. A cursor reading mechanism is initiated for the time-series logs generated after aggregation. The timestamp values ​​of two records in adjacent positions are extracted sequentially along the sequence direction using a single-step approach. A numerical subtraction logic operator is then used to calculate the absolute deviation between the timestamp of the next record and the timestamp of the previous record. The specific formula is as follows: Time step component = timestamp of the next position - timestamp of the previous position; Assuming the timestamp value at the previous position in the current pipeline is 1620000000 and the timestamp value at the next position is 1620000005, substituting these two values ​​into the above formula yields the following result: Time step component = 1620000005 - 1620000000 = 5; The value 5 represents the actual pause in seconds between two user packet requests, i.e., the time step component characterizing the distribution of user request time intervals. Sliding extraction and subtraction operations are continuously performed on the entire log time sequence to obtain hundreds or thousands of component values ​​representing the pause time for each access. Multiple time step components are linearly combined according to the absolute chronological order of the corresponding network events, and then appended to a pre-allocated one-dimensional vector storage container. This establishes a complete time difference array describing the frequency characteristics of user packet sending, such as a set of numerical arrays containing sequences of 5, 2, 10, 1, etc.

[0033] S303: Call the time difference array, extract the two time step components at adjacent index positions, perform a second numerical fluctuation difference calculation, obtain the change value between the time step component at the current index position and the time step component at the previous index position, obtain the fluctuation offset that represents the non-uniformity of the access interval distribution, perform time series feature vectorization mapping processing on the fluctuation offset, and aggregate it into the discrete data sequence set space to generate a fluctuation difference sequence. The system calls the time difference array stored in memory and uses a two-pointer traversal technique to extract two time step components at adjacent index positions within the array. It then performs a second value fluctuation difference calculation on these two components. The specific execution formula is as follows: Change value = Current index position time step component - Previous index position time step component; Extract the data elements from the time difference array obtained in the previous steps and perform calculations. Given that the time step component value at the current index position is 2 and the time step component value at the previous index position is 5, substitute these two values ​​into the formula to obtain: Change value = 2 - 5 = -3; To obtain the fluctuation offset that characterizes the non-uniformity of the access interval distribution, the absolute value span of this fluctuation value is extracted. The specific formula is as follows: Fluctuation offset = absolute value (change value); Substituting the change value, the calculated fluctuation offset is 3. This value of 3 intuitively reveals the amplitude characteristics of the abnormal and sudden change in the client's packet sending rhythm. The above two difference and absolute value extraction operations are continuously performed on all elements inside the time difference array. All the obtained fluctuation offset values ​​are processed by time series feature vectorization mapping according to the original index position relationship, and are sequentially loaded and aggregated into a continuous discrete data sequence set space, and encapsulated to generate the final fluctuation difference sequence used for jump analysis.

[0034] Please see Figure 5 The specific steps for obtaining cross-node log records are as follows: S401: Call the preset jump threshold, compare the value of each element in the fluctuation difference sequence with the jump threshold one by one, extract the time index corresponding to the element whose value exceeds the jump threshold, perform spatial mapping and positioning on the communication interaction endpoint according to the time index, perform isolation marking on the spatial mapping and positioning result, and establish causal break nodes. The specific method for setting the jump threshold is as follows: obtain a preset historical business benchmark time series record, extract the timestamps from the historical business benchmark time series record to construct a benchmark time difference array, calculate the difference between adjacent elements in the benchmark time difference array to obtain a benchmark fluctuation value sequence, call the mean function to perform an operation on the benchmark fluctuation value sequence to obtain the expected mean of fluctuation, calculate the discrete standard deviation of the benchmark fluctuation value sequence, extract the preset distribution interval coefficient, perform a multiplication operation on the discrete standard deviation and the distribution interval coefficient to obtain the tolerance extreme value, and perform an addition operation on the expected mean of fluctuation and the difference extreme value to generate the jump threshold; Obtain the preset historical business benchmark time series records, extract the normal timestamp information from these records to construct a benchmark time difference array containing 1000 normal interval elements, and calculate the subtraction difference between adjacent elements in this array to obtain the benchmark fluctuation value sequence. Call the mean summation function to perform a summation operation on all elements in this sequence and divide by the total number of elements to obtain the expected mean of fluctuation, which is 1.2. Extract each benchmark fluctuation value in this sequence, calculate the square of the difference between it and the expected mean of fluctuation, and take the square root of the arithmetic mean to obtain the discrete standard deviation, which is 0.4. Extract the preset distribution interval coefficient parameter from the configuration file, whose set value is 2.5, and call the multiplication logic operation to calculate the tolerance extreme value. The specific formula is as follows: Tolerance extreme value = Discrete standard deviation * Distribution interval coefficient; Substituting the measured values ​​into the calculation, we get: The tolerance limit is 0.4 * 2.5 = 1.0; The obtained mean expected fluctuation value is combined with the calculated tolerance extreme value by performing an addition operation. The specific formula is as follows: Jump threshold = expected mean of fluctuation + tolerance extreme value; Substituting the specific values ​​above, we get: The transition threshold = 1.2 + 1.0 = 2.2; The jump threshold 2.2 is invoked, and each element in the fluctuation difference sequence is compared with it one by one. When scanning to the 12th index position, the fluctuation offset value is found to be 3. The time series index 12 corresponding to the value 3 exceeding the jump threshold 2.2 is extracted. Based on this time series index, the original record is traced back to extract the physical location of the endpoint network card where the communication interaction occurred. Spatial mapping is performed to locate the source Internet Protocol address 192.168.1.5. The spatial mapping location result of this address is isolated and colored, and an independent causal break node is established in the graph model library to indicate that the communication link has a break that cannot be explained by normal business logic at this time point.

[0035] S402: For the set of abnormal trigger records, extract the corresponding association matrix, call the causal break node as the boundary parameter to perform structural segmentation on the association matrix, obtain discrete sub-links, perform directed edge connection reorganization on the node elements in the discrete sub-links based on the communication order between the request source address and the response address, and construct multi-dimensional topological relationships by combining the hierarchical depth attribute to establish a sub-sequence graph; For the set of abnormal trigger records, the source addressing and destination addressing fields within each log entry are traversed and parsed. These fields are then combined pairwise to convert them into row and column element values ​​with directional attributes, constructing an association matrix reflecting the intertwined communication state within the entire cluster. The causal break nodes established in the preceding steps are used as physical boundary parameters. When an addressing path in a row of the association matrix crosses the time range or address space corresponding to that causal break node, a mandatory structural splitting and cutting operation is performed on that row. After splitting, the originally continuous global communication network is physically blocked and dismantled, resulting in multiple shorter and physically isolated discrete sub-links. Based on the communication order rules between sending data packets from the source address to generating response messages at the receiving address, directed edge reassembly operations are performed on the node elements within each discrete sub-link, ensuring that the arrows of the directed edges strictly point to the receiving end of the message flow. By combining the hierarchical depth attribute of communication through the gateway to the underlying storage layer, i.e., the gateway is defined as layer 1, the edge node as layer 2, and the core data disk as layer 3, a multi-dimensional topological relationship is woven through this vertically layered architecture to establish a complete subsequence map that describes the distribution of data flow within the truncated abnormal network segment.

[0036] Please refer to Table 3, which shows the specific form of the associated data drawn by the above multidimensional topology rules.

[0037] Table 3. Connectivity of Multidimensional Topological Subsequence Map; S403: Extract internal branch directed paths based on subsequence graph, perform heterogeneity logic judgment on the endpoint identifiers of the two ends of each branch directed path, extract abnormal access data packets corresponding to paths with inconsistent endpoint identifiers, perform load field parsing and aggregation encapsulation on abnormal access data packets, convert them into a same-origin traceability text set, and obtain cross-node log records. Based on the constructed subsequence graph, a breadth-first search algorithm is used to extract the internal branched directed paths. For each extracted branched directed path, the subnet mask information carried by the endpoint identifiers at both ends is parsed to perform heterogeneity logic judgment. When the virtual LAN segment to which the source endpoint identifier belongs is segment 192.168.1.0 and the intranet area to which the receiving endpoint identifier belongs is segment 10.0.0.0, the inconsistency between the two identifiers is determined, triggering a heterogeneous communication alarm. The bidirectional original message content corresponding to the path with inconsistent endpoint identifiers is extracted and confirmed as an abnormal access data packet. The deep packet parsing module is called to perform binary payload field parsing on the abnormal access data packet, extracting the specified extended fields of its hypertext request header and the payload content body in the attached Extensible Markup Language format. The extracted discrete payload text fragments, along with the generation time and endpoint identification code, are aggregated and encapsulated, converted into a regular same-source traceability text set through a unified encoding format, and persistently written to an independent advanced threat tracking database, resulting in cross-node log records that break down single-point information silos.

[0038] Please see Figure 6 The specific steps for obtaining the anomaly tracing path are as follows: S501: Call cross-node log records, extract the original timestamp of the node, obtain the global central time base value, calculate the difference between the global central time base value and the original timestamp of the node, obtain the node time offset, extract the sorted center element for the node time offset, establish the median of the base offset, subtract the median of the base offset from the original timestamp of the node to perform numerical alignment calculation, and generate the corrected timestamp. The system retrieves cross-node log records stored in the database and extracts the original timestamps of each participating node from the accompanying source header information. It then connects to the National Time Service Center's external interface to retrieve the current global central time base value, accurate to milliseconds, which is 1620000010.5. Finally, it uses subtraction logic to calculate the difference between the global central time base value and the extracted original timestamps of the nodes to obtain the node time offset. The specific formula is as follows: Node time offset = Global central time base value - Node original timestamp; Set the original timestamp of a certain edge node to 1620000009.0, and calculate its time offset as 1.5 seconds. For all 20 nodes participating in network interaction, calculate and extract their time offsets. Sort these 20 values ​​in ascending order, and extract the average of the middle two values ​​(10th and 11th positions) to establish a median offset representing the overall network clock deviation from the mean. This median offset is calculated to be 1.2 seconds. Use this median offset to perform numerical alignment and compensation calculations on the original timestamps of each node. The specific formula is as follows: Correction timestamp = original timestamp of node + median baseline offset; The original timestamp of the node, 1620000009.0, was extracted and substituted into the value to calculate the corrected timestamp of the record, which is 1620000010.2 seconds. This operation eliminates the out-of-order event phenomenon caused by the inability of the underlying distributed physical clock to be absolutely synchronized.

[0039] S502: Based on the corrected timestamps of multiple records, perform time ascending sorting, extract the corresponding node identifier according to the position, perform association integration, establish node access order, extract the identifiers of adjacent nodes according to the node access order, connect the identifiers of adjacent nodes along the network request flow, establish access transmission edge, call the corrected timestamps corresponding to both ends of the access transmission edge to perform numerical subtraction, and obtain the transmission time value. Based on the corrected timestamp values ​​generated from multiple log records updated on the same link, the timestamps are sorted in absolute ascending order by time, placing the timestamps with smaller values ​​earlier and the timestamps with larger values ​​later. According to the strict order formed after correction, the independent network interface node identifier corresponding to each record is extracted, and time-series-based association integration is performed to establish the actual node access order of the packet traversing the entire data center. For the reordered node access order structure, the identifiers of two adjacent nodes in the sequence chain are extracted, and a virtual directed connection is drawn along the network data request flow from sender to receiver, establishing an access propagation edge representing a single data jump in the topology space. The corrected timestamps of the preceding and following nodes at both ends of this access propagation edge are extracted and subtracted, with the specific formula as follows: Transmission time = Next node correction timestamp - Previous node correction timestamp Given that the corrected timestamp of the previous node completing forwarding is 1620000010.2 seconds, and the corrected timestamp of the next node receiving the message is 1620000010.6 seconds, substituting these two values ​​into the logical formula, the transmission time of this access transmission edge is calculated to be 0.4 seconds. This time accurately reflects the physical dwell time of the message as it traverses this optical fiber and the network switching equipment.

[0040] S503: Call the transmission time value, obtain the preset minimum communication transmission time, compare the transmission time value with the minimum communication transmission time, extract the access transmission edges corresponding to the values ​​that are less than the minimum communication transmission time, perform head-to-tail topology reassembly and assembly for the multiple access transmission edges selected, draw a directed graph structure covering the network interaction link space, and establish an anomaly tracing path. The minimum communication transmission time is obtained by reading the local preset normal communication connectivity test log of the system's historical stable operation phase, extracting multiple one-way data packet transmission time samples between corresponding nodes in a congestion-free network environment, sorting each one-way data packet transmission time sample in ascending order, and after removing abnormal outliers caused by system clock errors, extracting the minimum effective positive delay span in the sorted queue as the minimum communication transmission time.

[0041] The system retrieves the 0.4-second transmission time value obtained through computation and then reads the preset minimum communication transmission time from the baseline configuration library. This minimum transmission time is obtained by conducting 100 normal communication connectivity network control message protocol probe tests on the nodes at both ends of the corresponding link during the stable operation phase in the early stages of the system without any large traffic surges. 100 one-way data packet transmission time samples between the corresponding nodes are extracted under congestion-free network conditions. These 100 samples are sorted in ascending order of value. After removing the first 5 and the last 5 outliers caused by system kernel interrupt clock errors, the smallest positive delay span of 0.1 seconds is extracted from the remaining 90 valid sequences and directly used as the minimum communication transmission time configuration parameter. The currently obtained transmission time value of 0.4 seconds is compared with the extracted minimum communication transmission time of 0.1 seconds. If the transmission time value is not less than the minimum communication transmission time, it is determined that there is abnormal congestion or backlog on that transmission edge. Extract all access transmission edges with congestion defects corresponding to values ​​greater than the minimum transmission time of the communication. For the multiple slow access transmission edges selected, perform topology reassembly and assembly based on the head-to-tail connection between the receiver and the next sender. Draw a directed graph structure on the visualization interface that covers the physical spatial distribution of abnormal network interaction links. Finally, establish a complete abnormal source tracing path for identifying the attack propagation path.

[0042] Please see Figure 7 A real-time anomaly detection and tracing system for cloud storage logs, the system being used to execute the aforementioned real-time anomaly detection and tracing method for cloud storage logs, the system comprising: The ratio change analysis module arranges cloud logs to construct target time-series logs, segments the target time-series logs to construct a set time window, divides the total number of authentication failures within the set time window by the total number of access requests to calculate the failure ratio value, calculates the difference in failure ratio values ​​between adjacent time windows, and constructs a ratio change sequence. The anomaly trigger identification module compares the proportional change sequence with the preset mutation threshold, filters out abnormal segments, fits the failure ratio value of the abnormal segment, calculates the slope of the proportional change, extracts the compliance frequency of the proportional change slope exceeding the trigger number threshold, aggregates the corresponding cloud storage request days, and constructs an anomaly trigger record set. The abnormal fluctuation analysis module collects the timestamps of records within the abnormal trigger record set, performs difference calculations on the timestamps of records adjacent to the same user, constructs a time difference array, calculates the difference between adjacent elements in the time difference array, and constructs a fluctuation difference sequence. The node log processing module compares the fluctuation difference sequence with a preset jump threshold, constructs causal break nodes based on the record nodes corresponding to the fluctuation difference sequence that exceeds the jump threshold, and extracts cross-node log records. The anomaly tracing module extracts the original timestamps of nodes from the cross-node log records, calculates the corrected timestamps by subtracting the median of the baseline offset from the original timestamps, arranges the corrected timestamps, constructs the node access order, connects adjacent identifiers in the access order to construct a transmission edge, compares the transmission edge time with the minimum time, and constructs the anomaly tracing path.

[0043] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0044] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0045] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0046] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0047] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0048] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0049] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0050] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0051] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0052] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of protection of the described technical solutions.

Claims

1. A method for real-time anomaly detection and source tracing of cloud storage logs, characterized in that, Includes the following steps: S1: Arrange cloud logs to construct target time-series logs, divide the target time-series logs to construct a set time window, divide the total number of authentication failures within the set time window by the total number of access requests to calculate the failure ratio value, calculate the difference in failure ratio values ​​between adjacent time windows, and construct a ratio change sequence. S2: Compare the ratio change sequence with the preset mutation threshold, filter abnormal segments, fit the failure ratio value of the abnormal segments, calculate the ratio change slope, extract the compliance frequency of the ratio change slope exceeding the trigger number threshold, aggregate the corresponding cloud storage request days, and construct an abnormal trigger record set. S3: Collect the timestamps of records in the abnormal trigger record set, perform difference calculation on the timestamps of records adjacent to the same user, construct a time difference array, calculate the difference between adjacent elements in the time difference array, and construct a fluctuation difference sequence; S4: Compare the fluctuation difference sequence with the preset jump threshold, construct a causal break node based on the record node corresponding to the fluctuation difference sequence that exceeds the jump threshold, and extract cross-node log records; S5: Extract the original timestamps of nodes from the cross-node log records, subtract the median of the baseline offset from the original timestamps of the nodes to calculate the corrected timestamps, arrange the corrected timestamps, construct the node access order, connect adjacent identifiers of the access order to construct the transmission edge, compare the transmission edge time with the minimum time, and construct the anomaly tracing path.

2. The real-time anomaly detection and tracing method for cloud storage logs according to claim 1, characterized in that, The proportional change sequence includes the sequence start point, change amplitude, and difference polarity; the abnormal trigger record set includes the trigger flag, source port number, and load data segment; the fluctuation difference sequence includes the sequence peak, sequence trough, and oscillation phase; the cross-node log record includes node routing information, gateway status code, and protocol version identifier; and the abnormal source tracing path includes the topology directed edge, link hop count, and destination network segment address.

3. The real-time anomaly detection and tracing method for cloud storage logs according to claim 1, characterized in that, The specific steps for obtaining the proportional change sequence are as follows: S101: Obtain cloud storage request logs, extract the user identifier and Internet Protocol address carried in the request message, perform multi-dimensional field joint sorting on the user identifier and Internet Protocol address for the cloud storage request logs, and perform ascending sorting and reorganization in combination with the timestamps generated by the log records to construct the target time-series log. S102: For the target time-series log, call the preset monitoring duration parameter to perform sliding segmentation processing, construct a set time window with equal time span, obtain the authentication failure request record and access request record existing in each set time window, perform traversal and accumulation on the authentication failure request record to obtain the total number of authentication failures, perform traversal and accumulation on the access request record to obtain the total number of access requests, perform division operation on the total number of authentication failures and the total number of access requests to generate a failure ratio value; S103: Perform differential operation on the time series set consisting of multiple failure ratio values, call the failure ratio value corresponding to the current time segment and the failure ratio value corresponding to the adjacent previous time segment, calculate the change difference between the current time segment and the adjacent previous time segment based on the difference between the two, establish a set of fluctuation parameters characterizing the trend of ratio evolution through the change difference, and generate a ratio change sequence.

4. The real-time anomaly detection and tracing method for cloud storage logs according to claim 3, characterized in that, The specific steps for obtaining the set of abnormal trigger records are as follows: S201: Call the preset mutation threshold, compare the fluctuation parameters in the proportional change sequence with the mutation threshold, extract the time coordinates corresponding to the fluctuation values ​​that exceed the mutation threshold, perform a truncation operation on the set time window according to the time coordinates, and generate abnormal candidate segments. S202: For the abnormal candidate segment, extract the corresponding failure ratio value, obtain the preset baseline ratio, sampling time step, fluctuation frequency, node time consumption range and cluster synchronization cycle, perform fitting derivation on the failure ratio value, and calculate the slope of the ratio change. S203: Call the slope of the proportional change to determine polarity, count the number of consecutive nodes greater than zero, generate the compliance frequency, locate the abnormal candidate segment according to the compliance frequency exceeding the preset number, extract the corresponding cloud storage request logs and perform splicing and merging to obtain the abnormal trigger record set.

5. The real-time anomaly detection and tracing method for cloud storage logs according to claim 4, characterized in that, The process of setting the mutation threshold is as follows: obtain the baseline request log under the historical state without anomalies, divide the baseline request log into time segments of equal length, calculate the difference in the authentication failure ratio between adjacent time segments, and construct a historical fluctuation sequence; perform statistics on the numerical distribution in the historical fluctuation sequence, calculate the arithmetic mean of the distribution difference to generate the baseline expected value, and calculate the root mean square of each value in the historical fluctuation sequence that deviates from the baseline expected value to generate the standard deviation. Extract the preset confidence multiple, multiply the standard deviation by the confidence multiple to obtain the floating tolerance, sum the floating tolerance with the benchmark expected value, and define the combined value as the mutation threshold.

6. The real-time anomaly detection and tracing method for cloud storage logs according to claim 4, characterized in that, The specific steps for obtaining the fluctuation difference sequence are as follows: S301: Obtain the abnormal trigger record set, extract the record timestamp of each log record, call the user identifier to perform grouping and clustering processing on the abnormal trigger record set, perform ascending order reordering based on the global unified time axis dimension for the record timestamps belonging to the same user identifier group, establish an access pipeline corresponding to a single user identity behavior according to the logical order of the record timestamps, and generate a log time sequence arrangement sequence. S302: For the log time sequence, extract the timestamps of two records in adjacent positions, call the numerical subtraction logic operator to calculate the numerical deviation between the timestamp of the next record and the timestamp of the previous record, obtain the time step component that represents the distribution characteristics of the user request time interval, perform linear combination of multiple time step components according to the order of their generation time and fill them into a one-dimensional vector storage container to establish a time difference array. S303: Call the time difference array, extract the two time step components at adjacent index positions, perform a second numerical fluctuation difference calculation, obtain the change value between the time step component at the current index position and the time step component at the previous index position, obtain the fluctuation offset characteristic representing the non-uniformity of the access interval distribution, perform time series feature vectorization mapping processing on the fluctuation offset, and aggregate it into the discrete data sequence set space to generate a fluctuation difference sequence.

7. The real-time anomaly detection and tracing method for cloud storage logs according to claim 6, characterized in that, The specific steps for obtaining cross-node log records are as follows: S401: Call the preset jump threshold, perform a one-to-one comparison operation between the value of each element in the fluctuation difference sequence and the jump threshold, extract the time index corresponding to the element whose value exceeds the jump threshold, perform spatial mapping and positioning on the communication interaction endpoint according to the time index, perform isolation marking on the spatial mapping and positioning result, and establish causal break nodes. S402: For the set of abnormal trigger records, extract the corresponding association matrix, call the causal break node as the boundary parameter to perform structural segmentation on the association matrix, obtain discrete sub-links, perform directed edge connection reorganization on the node elements in the discrete sub-links based on the communication order between the request source address and the response address, construct multi-dimensional topological relationships by combining the hierarchical depth attributes, and establish a sub-sequence graph; S403: Based on the subsequence graph, extract the internal branch directed paths, perform heterogeneity logic judgment on the endpoint identifiers at both ends of each branch directed path, extract the abnormal access data packets corresponding to the paths with inconsistent endpoint identifiers, perform load field parsing and aggregation encapsulation on the abnormal access data packets, convert them into a same-origin traceability text set, and obtain cross-node log records.

8. The real-time anomaly detection and tracing method for cloud storage logs according to claim 7, characterized in that, The specific method for setting the jump threshold is as follows: obtain a preset historical business benchmark time series record, extract the timestamps from the historical business benchmark time series record to construct a benchmark time difference array, calculate the difference between adjacent elements in the benchmark time difference array to obtain a benchmark fluctuation value sequence, call the mean function to perform an operation on the benchmark fluctuation value sequence to obtain the expected mean of fluctuation, calculate the discrete standard deviation of the benchmark fluctuation value sequence, extract a preset distribution interval coefficient, perform a multiplication operation on the discrete standard deviation and the distribution interval coefficient to obtain the tolerance extreme value, and perform an addition operation on the expected mean of fluctuation and the difference extreme value to generate the jump threshold.

9. The real-time anomaly detection and tracing method for cloud storage logs according to claim 7, characterized in that, The specific steps for obtaining the anomaly tracing path are as follows: S501: Call the cross-node log record, extract the original timestamp of the node, obtain the global central time base value, calculate the difference between the global central time base value and the original timestamp of the node, obtain the node time offset, extract the sorted center element for the node time offset, establish the median of the base offset, subtract the median of the base offset from the original timestamp of the node to perform numerical alignment calculation, and generate the corrected timestamp. S502: Based on the correction timestamps of multiple records, perform time ascending sorting, extract the corresponding node identifier according to the position, perform association integration, establish node access order, extract the neighboring node identifiers according to the node access order, perform directed connection of neighboring node identifiers along the network request flow, establish access transmission edge, call the correction timestamps corresponding to both ends of the access transmission edge to perform numerical subtraction, and obtain the transmission time value. S503: Call the transmission time value to obtain the preset minimum communication transmission time, compare the transmission time value with the minimum communication transmission time, extract the access transmission edges corresponding to the values ​​less than the minimum communication transmission time, perform head-to-tail topology reassembly and assembly for the selected multiple access transmission edges, draw a directed graph structure covering the network interaction link space, and establish an anomaly tracing path.

10. A real-time anomaly detection and tracing system for cloud storage logs, characterized in that, The system is used to implement the real-time anomaly detection and source tracing method for cloud storage logs as described in any one of claims 1-9, and the system includes: The ratio change analysis module arranges cloud logs to construct target time-series logs, segments the target time-series logs to construct a set time window, divides the total number of authentication failures within the set time window by the total number of access requests to calculate the failure ratio value, calculates the difference in failure ratio values ​​between adjacent time windows, and constructs a ratio change sequence. The abnormal trigger identification module compares the ratio change sequence with a preset mutation threshold, filters abnormal segments, fits the failure ratio value of the abnormal segment, calculates the ratio change slope, extracts the compliance frequency of the ratio change slope exceeding the trigger number threshold, aggregates the corresponding cloud storage request days, and constructs an abnormal trigger record set. The abnormal fluctuation analysis module collects the timestamps of records within the abnormal trigger record set, performs difference calculations on the timestamps of records adjacent to the same user, constructs a time difference array, calculates the difference between adjacent elements in the time difference array, and constructs a fluctuation difference sequence. The node log processing module compares the fluctuation difference sequence with a preset jump threshold, constructs causal break nodes based on the record nodes corresponding to the fluctuation difference sequence that exceeds the jump threshold, and extracts cross-node log records. The anomaly tracing module extracts the original timestamps of nodes from the cross-node log records, calculates the corrected timestamps by subtracting the median of the baseline offset from the original timestamps, arranges the corrected timestamps, constructs the node access order, connects adjacent identifiers in the access order to construct a transmission edge, compares the transmission edge time with the minimum time, and constructs the anomaly tracing path.

Images