Log analysis method and device based on large model, equipment, medium and product

Abstract

The invention relates to the technical field of information security, in particular to a log analysis method and device based on a large model, equipment, a medium and a product. Retrieving in a pre-constructed knowledge base according to the to-be-analyzed log to obtain a historical log record matched with the to-be-analyzed log; inputting the to-be-analyzed log and the historical log record into a pre-trained large model, and obtaining an analysis result output by the large model; and determining whether the to-be-analyzed log is abnormal based on the analysis result. Log analysis is carried out by retrieving the enhanced hybrid expert generation type large model, each expert model is responsible for processing specific types of data or tasks, and the global model is responsible for integrating the output of each expert model, so that the large model is easier to understand and manage; when new problems are brought by the log data, only one corresponding expert model needs to be newly added, the whole large model does not need to be updated, and the complexity and time consumption of model updating are greatly reduced.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and in particular to a log analysis method, apparatus, device, medium and product based on a large model. Background Technology

[0002] Logs contain a large amount of sensitive information, such as user personal data and financial information. To ensure data security and privacy protection, it is necessary to promptly detect and handle abnormal behavior in logs to prevent data leaks and other security issues. With the widespread use of the internet and various applications, modern application logs may contain multiple types of operations, involving different data structures and relationships. Therefore, the volume and complexity of log data are gradually increasing, making log analysis more difficult.

[0003] In response, related technologies have begun to use large models for log analysis. However, log data is constantly changing, which may bring new problems. Large models also need to be constantly updated to maintain accuracy. The model update process is relatively complex and time-consuming, which cannot meet the real-time requirements of log analysis. Summary of the Invention

[0004] In view of the above problems, this disclosure is made to provide a log analysis method, apparatus, device, medium and product based on a large model.

[0005] According to one aspect of this disclosure, a log analysis method based on a large model is provided, comprising: Obtain the logs to be analyzed; the logs to be analyzed are sensitive logs whose importance and sensitivity meet preset conditions; Based on the log to be analyzed, a search is performed in a pre-built knowledge base to obtain historical log records that match the log to be analyzed. The logs to be analyzed and historical log records are input into a pre-trained large model to obtain the analysis results output by the large model. The large model includes a global model and multiple expert models. Each expert model is used to handle a specific type of analysis task. The global model is used to select the target expert model that matches the logs to be analyzed from multiple expert models based on the logs to be analyzed and historical log records. The target expert model analyzes the logs to be analyzed and historical log records. The analysis result is obtained by integrating the output results of each target expert model from the global model. Based on the analysis results, confirm whether there are any anomalies in the logs to be analyzed.

[0006] The beneficial effects of this solution are as follows: Log analysis is performed by retrieving and enhancing a hybrid expert generative large model. Each expert model is responsible for processing a specific type of data or task, while the global model is responsible for integrating the outputs of each expert model, making the large model easier to understand and manage. When log data brings new problems, only a corresponding expert model needs to be added, without updating the entire large model, which greatly reduces the complexity and time consumption of model updates. By retrieving historical log records in the knowledge base, some historical logs most relevant to the log to be analyzed can be obtained, providing the large model with the most direct support based on historical evidence. This enables the large model to more accurately understand the data source when generating text and retrieving information, and provides more accurate analysis results.

[0007] Furthermore, according to one aspect of the log analysis method based on a large model, the training process of the large model includes: Sample logs are obtained from a pre-built database sensitive log set; the database sensitive log set includes multiple sensitive logs. Search the knowledge base based on the sample logs to obtain multiple historical logs that match the sample logs; The global model calculates the fit between each expert model and the sample log based on the sample log and historical log. It selects the k expert models with the highest fit in the sample log as the target expert models for analyzing the sample log, and the global model assigns weights to each target expert model. The sample logs and historical logs are input into each target expert model. The global model integrates the data and weights output by each target expert model to obtain the output result. Calculate the loss value based on the difference between the output result and the preset expected result; If the loss value does not meet the convergence condition, update the model parameters and weights of each target expert model, and repeat the steps of inputting sample logs and historical logs into each target expert model until the loss value meets the convergence condition, and then end the model training.

[0008] In one or more embodiments, the beneficial effects of this solution are as follows: The large model has a modular structure, consisting of multiple expert models and a global model. If it is necessary to improve the analytical capabilities of the large model in a certain aspect, only a corresponding new expert model needs to be trained or added, without modifying the entire large model. Expert models can also be designed to handle long sequence problems, avoiding the information transmission problems or memory loss issues that may exist with single models. Combining knowledge base retrieval and analysis of multiple target expert models can provide the target expert models with the most relevant prior knowledge to the sample logs, which is beneficial to improving the model's resistance to overfitting. The global model can dynamically select the k expert models with the highest fit for each sample log, so not every expert model participates in the analysis task of the sample logs; instead, the global model dynamically selects the target expert model most suitable for the sample logs to handle this analysis task, greatly improving efficiency. The global model can also dynamically adjust the weights of the target expert models based on the data characteristics of the sample logs and the performance of the expert models, which is beneficial to improving the overall prediction performance. By integrating the results of multiple expert models through the global model, it can better generalize to data that the model has not seen before, find better solutions in noisy and uncertain environments, and improve the model's generalization ability.

[0009] Furthermore, according to one aspect of the log analysis method based on a large model, the knowledge base construction process includes: Get the operation log and extract the operation data from it; Based on the preset data sensitivity classification table, determine the sensitivity level of the database tables in the data being manipulated; the data sensitivity classification table is based on the importance and sensitivity of the data. Based on the sensitivity level of the database table, the operation logs are confirmed to be sensitive logs, and a database sensitive log set is constructed based on the sensitive logs; The sensitive logs in the database sensitive log set are divided into blocks to obtain a block knowledge base. The length of the logs included in the block knowledge base is less than or equal to a preset threshold. The logs included in the segmented knowledge base are transformed into vectors to obtain the knowledge base; the knowledge base includes multiple vector knowledge blocks.

[0010] In one or more embodiments, the beneficial effects of this solution are as follows: by identifying the sensitivity level of the database tables involved in the operation logs, sensitive logs are filtered out, and a database sensitive log set is constructed. This database sensitive log set allows for the filtering of sensitive logs from massive amounts of logs, narrowing the scope of log monitoring. Subsequent log analysis using large models can then focus on the database sensitive log set, improving efficiency.

[0011] Furthermore, according to one aspect of the log analysis method based on a large model, historical log records matching the log to be analyzed are retrieved from a pre-built knowledge base, including: The log to be analyzed is transformed into a vector to obtain the vector to be analyzed; The analysis is performed on the vector to be analyzed in a pre-built knowledge base, and the correlation between the vector to be analyzed and the various vector knowledge blocks included in the knowledge base is calculated. The n most relevant vector knowledge blocks are used as historical log records to match the log to be analyzed.

[0012] In one or more embodiments, the beneficial effect of this solution is that by retrieving multiple historical log records from the knowledge base, it can provide the target expert model with the prior knowledge most relevant to the sample logs, which is conducive to improving the model's resistance to overfitting.

[0013] Furthermore, according to the log analysis method based on a large model of this disclosure, based on the analysis results, it is confirmed whether there are any anomalies in the log to be analyzed, including: Obtain the authorization basis for the log to be analyzed; the authorization basis is prior permission to perform database operations in the log to be analyzed; Convert the analysis results and authorization basis into vector form to obtain the analysis result vector and authorization basis vector; Calculate the similarity between the analysis result vector and the authorization basis vector. If the similarity meets the preset conditions, confirm that there are no anomalies in the log to be analyzed.

[0014] In one or more embodiments, the beneficial effects of this solution are as follows: the analysis results include whether the log to be analyzed involves sensitive data queries, and the specific reasons for the analysis. By checking the authorization criteria, it can be determined whether the business personnel executing the log to be analyzed had applied for authorization approval in advance, and whether the operation content during the approval application is similar to the actual execution operation, thereby determining whether the log to be analyzed meets the authorization criteria.

[0015] Furthermore, according to one aspect of the log analysis method based on a large model, the similarity between the analysis result vector and the authorization basis vector is calculated. When the similarity meets a preset condition, it is confirmed that the log to be analyzed does not contain any anomalies, including: The cosine similarity is calculated by analyzing the cosine value of the angle between the result vector and the authorization basis vector in the vector space, and the first similarity is confirmed based on the cosine value. The overlap ratio of the vocabulary set used in the analysis results vector and the authorization basis vector is calculated by Jaccard coefficient, and the second similarity is confirmed based on the overlap ratio. The cosine similarity of word frequency vectors in the analysis result vector and the authorization basis vector is calculated using statistical methods, and the third similarity is confirmed based on the cosine similarity. If at least two of the first, second, and third similarities meet the preset similarity thresholds, the similarity is confirmed to meet the preset conditions, and there are no anomalies in the log to be analyzed.

[0016] In one or more embodiments, the beneficial effect of this solution is that by comparing similarity in multiple rounds, it is possible to accurately determine whether there are any anomalies in the logs to be analyzed.

[0017] According to another aspect of this disclosure, a log analysis apparatus based on a large model is provided, comprising: The acquisition module is used to acquire logs to be analyzed; the logs to be analyzed are sensitive logs whose importance and sensitivity meet preset conditions. The retrieval module is used to search a pre-built knowledge base based on the log to be analyzed and obtain historical log records that match the log to be analyzed. The model analysis module is used to input the logs to be analyzed and historical log records into a pre-trained large model and obtain the analysis results output by the large model. The large model includes a global model and multiple expert models. Each expert model is used to handle specific types of analysis tasks. The global model is used to select the target expert model that matches the logs to be analyzed from multiple expert models based on the logs to be analyzed and historical log records. The target expert model then analyzes the logs to be analyzed and historical log records. The analysis results are obtained by integrating the output results of each target expert model from the global model. The calculation module is used to confirm whether there are any anomalies in the logs to be analyzed based on the analysis results.

[0018] According to another aspect of this disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the method of one aspect above.

[0019] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method of one aspect above.

[0020] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method of the above-described aspect.

[0021] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0022] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0023] Figure 1 This is a system architecture diagram illustrating a log analysis method based on a large model according to an embodiment of this disclosure.

[0024] Figure 2 This is a flowchart illustrating the model training process according to an embodiment of the present disclosure.

[0025] Figure 3 This is a flowchart illustrating a log analysis method based on a large model according to an embodiment of the present disclosure.

[0026] Figure 4 This is a schematic diagram illustrating the structure of a log analysis apparatus based on a large model according to an embodiment of the present disclosure.

[0027] Figure 5 This is a schematic diagram illustrating the structure of a computer device according to an embodiment of the present disclosure.

[0028] Figure 6 This is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0030] Logs contain a large amount of sensitive information, such as user personal data and financial information. To ensure data security and privacy protection, it is necessary to promptly detect and handle abnormal behavior in logs to prevent data leaks and other security issues. Current log data has the following characteristics: Increased data volume: With the popularization of the Internet and various applications, the amount of log data is gradually increasing, and traditional analysis methods may not be able to effectively handle such a large amount of data; Increased complexity: Logs from modern applications may contain multiple types of operations, involving different data structures and relationships, requiring more sophisticated analysis methods to extract useful information; High real-time requirements: Many applications have increasingly high requirements for the real-time performance of data analysis, and need to be able to analyze logs quickly and accurately, identify problems in a timely manner, and make corresponding adjustments. High accuracy requirements: Traditional log analysis methods may not be able to meet the requirements for the accuracy of data analysis results. Methods based on large models can improve the accuracy of log analysis results through technologies such as deep learning. High information confidentiality: Logs contain a large amount of sensitive information, such as user personal data and financial information. To ensure data security and privacy protection, it is necessary to promptly detect and handle abnormal behavior in the logs to prevent data leakage and other security issues.

[0031] In summary, to better address the challenges of increasing data volume, complexity, real-time requirements, and accuracy demands, related technologies have begun to utilize large models for log analysis. However, these large model analysis methods also have the following drawbacks: (1) For the variable data stream processing model using frequent pattern decision tree, since the log data is constantly changing, it may bring new problems. Therefore, the decision tree model also needs to be constantly updated to maintain accuracy. However, the model update process is relatively complex and time-consuming, which cannot meet the real-time requirements of log analysis.

[0032] (2) For long short-term memory neural network models, on the one hand, they are prone to overfitting on the training set and perform poorly when transferring learning between different tasks; on the other hand, when processing very long sequence data, there may still be problems with information transmission or memory loss.

[0033] The above description, with reference to the accompanying drawings, illustrates a log analysis method, apparatus, device, medium, and product based on a large model according to embodiments of the present disclosure. By constructing a retrieval-enhanced hybrid expert-generative large model, the large model possesses a modular structure, consisting of multiple expert models and a global model. Each expert model is responsible for processing a specific type of data or analysis task, while the global model integrates the outputs of each expert model, making the large model easier to understand and manage. It features an expert selection mechanism, allowing the global model to dynamically select the appropriate expert model for the current log. This mechanism dynamically adjusts the weights of expert models based on the log's data characteristics and model performance, thereby improving overall prediction performance. It also possesses generalization ability, combining the prediction results of multiple expert models to better generalize to data unseen by the models, finding better solutions in noisy and uncertain environments, demonstrating a certain generalization advantage. Furthermore, it exhibits higher accuracy, combining expert models and knowledge base retrieval, enabling a more accurate understanding of the data source when generating text and retrieving information, providing more precise answers and results.

[0034] To facilitate understanding of this embodiment, a detailed description of the large-model-based log analysis method disclosed in this disclosure is provided first. The execution entity of the large-model-based log analysis method provided in this disclosure is generally a computer device with a certain computing capability. This computer device may include, for example, a terminal device, a server, or other processing devices. The terminal device can be a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, handheld device, computing device, vehicle-mounted device, wearable device, etc. In some possible implementations, this large-model-based log analysis method can be implemented by the processor calling computer-readable instructions stored in memory.

[0035] like Figure 1 The diagram shown is a system architecture diagram of the log analysis method based on a large model provided in this embodiment of the disclosure, including a knowledge base construction module 1, a model training module 2, and a log analysis module 3. The following is a detailed description of each module: Knowledge Base Construction Module 1: Used to filter sensitive logs and build a segmented vector knowledge base. Specifically, it includes: Step 1: Obtain the operation log and extract the operation data from it.

[0036] In this embodiment, the operation log can specifically be a database operation log. A database operation log is a log file that records detailed information about all operations and accesses in the database, including who performed which operation on which database at what time. It is used to audit the access and operation of the database and to track the security and compliance of the database. The main fields include, but are not limited to, log type, log generation time, operation data content, destination resource name, destination resource address, destination resource port, destination resource account, login username, login address, etc.

[0037] The operation data content is as follows: "select grantee, name from sys.plsqldev_authorization where granteein (user, 'PUBLIC') or grantee in (select role from sys.session_roles)"; Step 2: Based on the preset data sensitivity classification table, confirm the sensitivity level of the database tables in the data being operated on.

[0038] The data sensitivity classification table is based on the importance and sensitivity of the data. It is a data classification and grading mechanism established by user units in accordance with relevant policies. It is based on the importance of the data in economic and social development, as well as the degree of harm to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is tampered with, damaged, leaked, or illegally obtained, illegally used, or illegally shared. For example, in this embodiment, the data is divided into three levels from high to low importance and sensitivity: core data, important data, and general data.

[0039] Specifically, the database table in the data being manipulated is sys.plsqldev_authorization; Data sensitivity classification table, for example: UNIT_ID_SXX_XXXX_YYYYMMDD, Sensitivity Level 2; DW_MK_XXXX_VALUEUP_02, Sensitivity Level 2; For example, sensitivity levels can be divided into 3, 2, 1 and 0 from high to low. The sensitivity level of a database table can be determined from the data sensitivity classification table.

[0040] Step 3: Based on the sensitivity level of the database table, confirm that the operation log is a sensitive log, and build a database sensitive log set based on the sensitive log.

[0041] Specifically, database tables with a sensitivity level of 1 or higher, along with their corresponding database operation logs, can be designated as sensitive logs. Here, "level 1" is merely an example; you can choose an appropriate sensitivity level as the threshold based on your specific circumstances.

[0042] Step 4: Divide the sensitive logs in the database sensitive log set into blocks to obtain a block knowledge base.

[0043] Specifically, a segmented knowledge base is constructed based on the database's sensitive log set, and the sensitive logs in the segmented knowledge base are divided into multiple log blocks using a recursive segmentation technique. The recursive segmentation technique involves repeatedly applying segmentation rules to recursively decompose the logs. First, commas are used for splitting. If the size of the resulting log block does not exceed a threshold, the log block is retained. If the size exceeds the threshold, spaces are used for further splitting, and so on. This process of recursively applying segmentation rules based on log block size continues until all log blocks are smaller than the threshold, ultimately resulting in the segmented knowledge base.

[0044] Step 5: Perform vector transformation on the logs included in the segmented knowledge base to obtain the knowledge base.

[0045] Specifically, by using a model based on self-attention mechanisms, such as BERT, to perform vector transformation on the segmented knowledge base, dynamic word meaning understanding can be achieved. This means that the large model can adaptively adjust the representation of words according to the context, so that the same word has different vector expressions in different contexts, and finally obtains a segmented vector knowledge base, i.e., a knowledge base.

[0046] Model Training Module 2: Used to train a large model, which consists of multiple expert models and a global model. Each expert model is responsible for processing a specific type of data or analysis task, while the global model is responsible for integrating the output results of the various expert models.

[0047] For example, expert model A is good at analyzing abnormal batch data downloads, expert model B is good at analyzing access to sensitive database tables outside of working hours, expert model C is good at analyzing permission-crossing queries, and a global model (such as a gated network model) is used to dynamically combine expert models and determine the weight of each expert model.

[0048] like Figure 2 The diagram shown is a flowchart of the model training process, including: S201: Retrieve multiple sample logs from a pre-built database sensitive log set.

[0049] S202: Search the knowledge base based on the sample logs to obtain multiple historical logs that match each sample log.

[0050] Specifically, for any sample log Transform its vector to obtain the sample vector According to the sample vector Retrieved from the knowledge base Each vector knowledge block serves as a sample log. The historical logs are embedded into a dense vector.

[0051] S203: The global model calculates the fit between each expert model and the sample log based on the sample log and historical log, and selects the target expert model for analyzing the sample log.

[0052] Specifically, expert models are used This indicates that the global model uses... This embodiment selects a gating network as the global model. The gating network learns the features of the input sample logs to determine which expert model to pass to for further analysis and processing. It can dynamically select the most suitable expert model for processing the current sample log, thereby improving the overall model's performance and effectiveness. This mechanism allows the gating network to flexibly adjust and optimize according to the different characteristics and needs of the sample logs, thus better accomplishing complex tasks and problem-solving.

[0053] The formula for calculating fit is as follows: ; in, This represents the fit between the i-th expert model and the input data s, where s includes sample logs and historical logs. It is the original score of the i-th expert model by the gated network G based on historical logs. This is the weight matrix. It is the added random noise:

[0054] The function is used to ensure that random noise is positive and smooth. The function is A smoothed version of the function is beneficial for optimization and improving numerical stability. Without noise, expert models with slightly higher scores will always be selected, and other expert models will never have a chance to be trained. Adding noise gives expert models with slightly lower scores a chance to be selected, ensuring that all expert models can be fully trained.

[0055] Let the gating network be The expression is: ; in, For sampling function, Indicates selection Individual fit The largest expert model will be used as the target expert model for this study.

[0056] ; in, Represents the i-th expert model The value of the function. For expert models that are not selected, The value of the function is ,go through If the value after the function is 0, it will not be selected.

[0057] And among them The function is used to transform the fitness scores of the selected k expert models into a probability distribution. For example, if expert models A and B are selected, their fitness scores, after passing through the Softmax function, might become [0.7, 0.3, 0, 0...]. This means that the gating network decides to select expert models A and B, giving A 70% weight and B 30% weight, while other expert models do not participate in the analysis of this sample log and have a weight of 0.

[0058] S204: The global model inputs sample logs and historical logs into each target expert model, and integrates the data and weights output by each target expert model to obtain the output result.

[0059] S205: Calculate the loss value based on the difference between the output result and the preset expected result.

[0060] Assuming the sample logs and historical logs are the input data s, the output of the i-th objective expert model is: The expected result is as follows The loss function is: ; in, It is the gating network that assigns the first The weights of each objective expert model can be dynamically adjusted based on the data characteristics of the sample logs and the performance of the model. Indicates the first The error of a target expert model, This means converting the error into a score; the smaller the error, the higher the score.

[0061] Gated networks are , No. The output of the target expert model is: So for the current input Output results It is the weighted sum of all the target expert models: ; S206: If the loss value does not meet the convergence condition, update the model parameters and weights of each objective expert model, return to S204, and continue until the loss value meets the convergence condition to end model training.

[0062] Specifically, when determining whether the loss value meets the convergence condition, the judgment is not based on a single sample log, but on all sample logs in the same batch, and the model converges based on the average loss value of this batch of sample logs.

[0063] Suppose a batch includes: Sample Log 1 → Gated Network → Select [Expert Model A, C] → Output y1 → Loss Value L1; Sample Log 2 → Gated Network → Select [Expert Model B, D] → Output y2 → Loss Value L2; ...... Sample Log 32 → Gated Network → Select [Expert Model A, E] → Output y32 → Loss Value L32; The average batch loss value L = (L1 + L2 + ... + L32) / 32.

[0064] When L stops decreasing significantly after several consecutive iterations, the model can be considered to have converged.

[0065] Log Analysis Module 3: Apply the trained large model in practice to analyze whether the logs are abnormal.

[0066] Specifically, it includes: S1: Obtain the logs to be analyzed; The logs to be analyzed are sensitive logs from the database sensitive log set, which can specifically be SQL statements.

[0067] S2: Search the knowledge base based on the log to be analyzed to obtain the historical log records that match it.

[0068] Specifically, the log to be analyzed is transformed into a vector to obtain the vector to be analyzed; based on the vector to be analyzed, a search is performed in the knowledge base to calculate the relevance between the vector to be analyzed and each vector knowledge block; the n vector knowledge blocks with the highest relevance are used as historical log records that match the log to be analyzed.

[0069] S3: Input the logs to be analyzed and historical log records into the pre-trained large model to obtain the analysis results output by the large model.

[0070] Specifically, a large model is used to analyze and identify SQL statements, and a detailed analysis is performed on the specific operations and database tables involved in the SQL statements to determine whether the operations of the SQL statements contain sensitive database tables. Based on the database tables, it is confirmed whether user query operations are included, thereby obtaining the business scenario of the SQL statements, i.e., the analysis results.

[0071] Assume the log to be analyzed (SQL statements) is as follows: Select from DW_MK_XXXX_VALUEUP_02 where bill_id='xxxxx'; The analysis results include: The SQL statement involves sensitive data query because the table name DW_MK_XXXX_VALUEUP_02 in the SQL statement is a database table marked as sensitivity level 2. The query operation involves the user's specific information and is therefore a sensitive data query.

[0072] S4: Based on the analysis results, confirm whether there are any anomalies in the log to be analyzed.

[0073] Specifically, it includes the following steps: ① Obtain the authorization basis for the log to be analyzed.

[0074] The authorization basis is prior permission to execute database operations in the log to be analyzed. The actual authorization basis comes from official documents, complaint tickets, user authorizations, and is filled in by business personnel. It must be filled in according to specific formats such as basis name, basis number, basis title, and specific content. This example uses "querying the table of newly added target customers for user value enhancement activities" as a specific case for illustration: Based on the name: Requesting access to the table of newly added target customers for the user value enhancement campaign due to official document requirements; Based on document number: 20250126xxx; Based on the title: Operations on database table DW_MK_XXXX_VALUEUP_02; Based on the content: Due to the official document requirement, the database table DW_MK_XXXX_VALUEUP_02 was manipulated to query information with bill_id 'xxxxx'; Once the data is entered, the algorithm will automatically determine whether it meets the requirements based on the name, number, title, and content.

[0075] ② Convert the analysis results and authorization basis into a computer-comparable vector form to obtain the analysis result vector and authorization basis vector.

[0076] ③ Calculate the similarity between the analysis result vector and the authorization basis vector. If the similarity meets the preset conditions, confirm that there are no anomalies in the log to be analyzed.

[0077] Specifically, the system determines whether a basis is standardized based on the "basis title." Standardized basis refers to the database table and fields explicitly described in the title. If the basis is non-standardized, key information can be extracted by analyzing the "basis content" to identify the corresponding standardized basis and thus obtain the authorization basis. Based on the actual SQL statement operation, the database table and field descriptions of the data sensitivity classification table are loaded. The business logic of the actual SQL statement operation (i.e., the analysis result vector) is obtained through the large model. The similarity between the actual operation's business logic and the authorization basis vector is determined to automatically decide whether the SQL statement complies with the authorization.

[0078] The similarity can be calculated in the following ways: Method 1: Determine the similarity by using cosine similarity. Calculate the cosine of the angle between the analysis result vector and the authorization basis vector in the vector space. If the cosine value is greater than or equal to 0.5, it is considered to meet the preset similarity threshold. Here, 0.5 is just an example preset similarity threshold, and users can choose a suitable threshold themselves. Method 2: Determine by using the Jaccard coefficient. Calculate the value of the intersection of the analysis result vector and the authorization basis vector in the vector space divided by the union, which is the overlap ratio of the vocabulary set used. If the overlap ratio is greater than or equal to 0.5, it is considered to meet the preset similarity threshold. Method 3: Use the statistical method TF-IDF to determine the cosine similarity between the word frequency vectors in the analysis result vector and the authorization basis vector. If the cosine similarity is greater than or equal to 0.5, it is considered to meet the preset similarity threshold.

[0079] If the SQL statement is judged similarly by two or more of the above three methods, then the SQL statement is considered to be authorized and there is no anomaly.

[0080] Based on the above embodiments, this embodiment also provides a log analysis method based on a large model, such as... Figure 3 The diagram shows a flowchart of a log analysis method based on a large model, including S301-S304: S301: Obtain the log to be analyzed.

[0081] Among them, the logs to be analyzed are sensitive logs whose importance and sensitivity meet the preset conditions.

[0082] S302: Search the pre-built knowledge base based on the log to be analyzed to obtain historical log records that match the log to be analyzed.

[0083] S303: Input the logs to be analyzed and historical log records into the pre-trained large model to obtain the analysis results output by the large model.

[0084] The large model includes a global model and multiple expert models. Each expert model is used to handle specific types of analysis tasks. The global model is used to select the target expert model that matches the log to be analyzed from multiple expert models based on the log to be analyzed and historical log records. The target expert model analyzes the log to be analyzed and historical log records. The analysis results are obtained by integrating the output results of each target expert model from the global model.

[0085] S304: Based on the analysis results, confirm whether there are any anomalies in the log to be analyzed.

[0086] In one or more embodiments, the training process for a large model includes: Sample logs are obtained from a pre-built database sensitive log set; the database sensitive log set includes multiple sensitive logs. Search the knowledge base based on the sample logs to obtain multiple historical logs that match the sample logs; The global model calculates the fit between each expert model and the sample log based on the sample log and historical log. It selects the k expert models with the highest fit in the sample log as the target expert models for analyzing the sample log, and the global model assigns weights to each target expert model. The sample logs and historical logs are input into each target expert model. The global model integrates the data and weights output by each target expert model to obtain the output result. Calculate the loss value based on the difference between the output result and the preset expected result; If the loss value does not meet the convergence condition, update the model parameters and weights of each target expert model, and repeat the steps of inputting sample logs and historical logs into each target expert model until the loss value meets the convergence condition, and then end the model training.

[0087] The large model has a modular structure, consisting of multiple expert models and a global model. If the analytical capabilities of the large model need to be improved in a specific area, only a corresponding new expert model needs to be trained or added, without modifying the entire large model. Expert models can also be designed to handle long sequence problems, avoiding the information transfer problems or memory loss issues that may exist with single models. Combining knowledge base retrieval and analysis of multiple target expert models provides the target expert models with the most relevant prior knowledge to the sample logs, which helps improve the model's resistance to overfitting. The global model can dynamically select the k expert models with the highest fit for each sample log. Therefore, not every expert model participates in the sample log analysis task; instead, the global model dynamically selects the most suitable target expert model to handle this analysis task, greatly improving efficiency. The global model can also dynamically adjust the weights of the target expert models based on the data characteristics of the sample logs and the performance of the expert models, which helps improve overall predictive performance. By integrating the results of multiple expert models, the global model can better generalize to data that the model has not seen before, finding better solutions in noisy and uncertain environments, thus improving the model's generalization ability.

[0088] In one or more embodiments, the process of building the knowledge base includes: Get the operation log and extract the operation data from it; Based on the preset data sensitivity classification table, determine the sensitivity level of the database tables in the data being manipulated; the data sensitivity classification table is based on the importance and sensitivity of the data. Based on the sensitivity level of the database table, the operation logs are confirmed to be sensitive logs, and a database sensitive log set is constructed based on the sensitive logs; The sensitive logs in the database sensitive log set are divided into blocks to obtain a block knowledge base. The length of the logs included in the block knowledge base is less than or equal to a preset threshold. The logs included in the segmented knowledge base are transformed into vectors to obtain the knowledge base; the knowledge base includes multiple vector knowledge blocks.

[0089] In one or more embodiments, a search is performed in a pre-built knowledge base based on the log to be analyzed to obtain historical log records that match the log to be analyzed, including: The log to be analyzed is transformed into a vector to obtain the vector to be analyzed; The analysis is performed on the vector to be analyzed in a pre-built knowledge base, and the correlation between the vector to be analyzed and the various vector knowledge blocks included in the knowledge base is calculated. The n most relevant vector knowledge blocks are used as historical log records to match the log to be analyzed.

[0090] In one or more embodiments, based on the analysis results, it is confirmed whether there are any anomalies in the log to be analyzed, including: Obtain the authorization basis for the log to be analyzed; the authorization basis is prior permission to perform database operations in the log to be analyzed; Convert the analysis results and authorization basis into vector form to obtain the analysis result vector and authorization basis vector; Calculate the similarity between the analysis result vector and the authorization basis vector. If the similarity meets the preset conditions, confirm that there are no anomalies in the log to be analyzed.

[0091] In one or more embodiments, the similarity between the analysis result vector and the authorization basis vector is calculated. When the similarity meets a preset condition, it is confirmed that there are no anomalies in the log to be analyzed, including: The cosine similarity is calculated by analyzing the cosine value of the angle between the result vector and the authorization basis vector in the vector space, and the first similarity is confirmed based on the cosine value. The overlap ratio of the vocabulary set used in the analysis results vector and the authorization basis vector is calculated by Jaccard coefficient, and the second similarity is confirmed based on the overlap ratio. The cosine similarity of word frequency vectors in the analysis result vector and the authorization basis vector is calculated using statistical methods, and the third similarity is confirmed based on the cosine similarity. If at least two of the first, second, and third similarities meet the preset similarity thresholds, the similarity is confirmed to meet the preset conditions, and there are no anomalies in the log to be analyzed.

[0092] According to another aspect of the embodiments of this disclosure, a log analysis apparatus based on a large model is provided, such as... Figure 4 As shown, the device includes: The acquisition module 401 is used to acquire the logs to be analyzed; wherein, the logs to be analyzed are sensitive logs whose importance and sensitivity meet preset conditions; The retrieval module 402 is used to retrieve historical log records that match the log to be analyzed by searching a pre-built knowledge base based on the log to be analyzed. The model analysis module 403 is used to input the logs to be analyzed and historical log records into a pre-trained large model and obtain the analysis results output by the large model. The large model includes a global model and multiple expert models. Each expert model is used to handle specific types of analysis tasks. The global model is used to select the target expert model that matches the logs to be analyzed from multiple expert models based on the logs to be analyzed and historical log records. The target expert model analyzes the logs to be analyzed and historical log records. The analysis results are obtained by integrating the output results of each target expert model from the global model. Calculation module 404 is used to confirm whether there are any anomalies in the log to be analyzed based on the analysis results.

[0093] The log analysis device based on a large model provided in this disclosure and the log analysis method based on a large model provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0094] This disclosure also provides a computer device for performing the above-described large-model-based log analysis method. Please refer to... Figure 5 It illustrates a schematic diagram of a computer device provided by some embodiments of this disclosure. For example... Figure 5 As shown, the computer device 5 includes: a processor 500, a memory 501, a bus 502, and a communication interface 503. The processor 500, the communication interface 503, and the memory 501 are connected via the bus 502. The memory 501 stores a computer program that can run on the processor 500. When the processor 500 runs the computer program, it executes the log analysis method based on a large model provided in any of the foregoing embodiments of this disclosure.

[0095] The memory 501 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 503 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0096] Bus 502 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. Memory 501 is used to store programs. After receiving an execution instruction, processor 500 executes the program. The log analysis method based on a large model disclosed in any of the foregoing embodiments of this disclosure can be applied to processor 500, or implemented by processor 500.

[0097] The processor 500 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 500 or by instructions in software form. The processor 500 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPTA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 501. The processor 500 reads the information in memory 501 and, in conjunction with its hardware, completes the steps of the above method.

[0098] The computer device provided in this disclosure and the log analysis method based on a large model provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they employ, operate, or implement.

[0099] This disclosure also provides a computer-readable storage medium corresponding to the large-model-based log analysis method provided in the foregoing embodiments. The computer-readable storage medium is an optical disc, on which a computer program (i.e., a computer program product) is stored. When the computer program is run by a processor, it executes the large-model-based log analysis method provided in any of the foregoing embodiments.

[0100] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0101] The computer-readable storage medium provided in the above embodiments of this disclosure and the log analysis method based on a large model provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0102] This disclosure also provides a computer program product; please refer to [reference needed]. Figure 6 The computer program product 600 carries program code, namely computer program 601. The instructions included in the computer program 601 can be used to execute the steps of the log analysis method based on the large model described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0103] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0104] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0105] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0106] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0107] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0108] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0109] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0110] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A log analysis method based on a large model, characterized in that, include: Obtain the logs to be analyzed; wherein, the logs to be analyzed are sensitive logs whose importance and sensitivity meet preset conditions; Based on the log to be analyzed, a search is performed in a pre-built knowledge base to obtain historical log records that match the log to be analyzed. The log to be analyzed and the historical log records are input into a pre-trained large model to obtain the analysis results output by the large model. The large model includes a global model and multiple expert models, each expert model handling a specific type of analysis task. The global model, based on the log to be analyzed and the historical log records, selects a target expert model from the multiple expert models that matches the log to be analyzed. The target expert model then analyzes the log to be analyzed and the historical log records. The analysis result is obtained by integrating the output results of each target expert model from the global model. Based on the analysis results, it was confirmed whether the log to be analyzed contained any anomalies.

2. The log analysis method based on a large model as described in claim 1, characterized in that, The training process of the large model includes: Sample logs are obtained from a pre-built set of sensitive database logs; wherein, the set of sensitive database logs includes multiple sensitive logs; Based on the sample logs, a search is performed in the knowledge base to obtain multiple historical logs that match the sample logs; The global model calculates the fit between each expert model and the sample log based on the sample log and the historical log, selects the k expert models with the highest fit in the sample log as the target expert models for analyzing the sample log, and assigns weights to each target expert model by the global model. The sample logs and the historical logs are input into each of the target expert models. The global model integrates the data output by each of the target expert models and the weights to obtain the output result. Calculate the loss value based on the difference between the output result and the preset expected result; When the loss value does not meet the convergence condition, update the model parameters and weights of each target expert model, and repeat the step of inputting the sample logs and the historical logs into each target expert model until the loss value meets the convergence condition, and end the model training.

3. The log analysis method based on a large model as described in claim 1 or 2, characterized in that, The process of constructing the knowledge base includes: Obtain the operation log and extract the operation data content from the operation log; Based on a preset data sensitivity classification table, the sensitivity level of the database tables in the operation data content is determined; wherein, the data sensitivity classification table is classified based on the importance and sensitivity of the data; Based on the sensitivity level of the database table, the operation log is confirmed to be a sensitive log, and a database sensitive log set is constructed based on the sensitive log; The sensitive logs in the database sensitive log set are divided into blocks to obtain a block knowledge base, wherein the length of the logs included in the block knowledge base is less than or equal to a preset threshold. The logs included in the segmented knowledge base are vectorized to obtain the knowledge base; wherein the knowledge base includes multiple vector knowledge blocks.

4. The log analysis method based on a large model as described in claim 1, characterized in that, Based on the log to be analyzed, a search is performed in a pre-built knowledge base to obtain historical log records that match the log to be analyzed, including: The log to be analyzed is transformed into a vector to obtain the vector to be analyzed; Based on the vector to be analyzed, a search is performed in a pre-built knowledge base, and the correlation between the vector to be analyzed and each vector knowledge block included in the knowledge base is calculated. The n vector knowledge blocks with the highest relevance are used as historical log records that match the log to be analyzed.

5. The log analysis method based on a large model as described in claim 1, characterized in that, Based on the analysis results, it was confirmed whether the log to be analyzed contained any anomalies, including: Obtain the authorization basis for the log to be analyzed; the authorization basis is prior permission to execute database operations in the log to be analyzed; The analysis results and the authorization basis are converted into vector form to obtain the analysis result vector and the authorization basis vector; Calculate the similarity between the analysis result vector and the authorization basis vector. If the similarity meets a preset condition, confirm that the log to be analyzed has no anomalies.

6. The log analysis method based on a large model as described in claim 5, characterized in that, Calculate the similarity between the analysis result vector and the authorization basis vector. When the similarity meets a preset condition, confirm that the log to be analyzed has no anomalies, including: The cosine similarity is used to calculate the cosine of the angle between the analysis result vector and the authorization basis vector in the vector space, and the first similarity is confirmed based on the cosine value. The overlap ratio of the vocabulary set used in the analysis result vector and the authorization basis vector is calculated by using the Jaccard coefficient, and the second similarity is confirmed based on the overlap ratio. The cosine similarity between the word frequency vectors in the analysis result vector and the authorization basis vector is calculated using statistical methods, and the third similarity is confirmed based on the cosine similarity. If at least two of the first similarity, the second similarity, and the third similarity satisfy a preset similarity threshold, the similarity is confirmed to meet the preset condition, and the log to be analyzed is found to be free of anomalies.

7. A log analysis device based on a large model, characterized in that, include: The acquisition module is used to acquire logs to be analyzed; wherein, the logs to be analyzed are sensitive logs whose importance and sensitivity meet preset conditions; The retrieval module is used to search in a pre-built knowledge base based on the log to be analyzed, and obtain historical log records that match the log to be analyzed. The model analysis module is used to input the log to be analyzed and the historical log records into a pre-trained large model, and obtain the analysis results output by the large model. The large model includes a global model and multiple expert models, each expert model handling a specific type of analysis task. The global model is used to select a target expert model that matches the log to be analyzed from the multiple expert models based on the log to be analyzed and the historical log records. The target expert model then analyzes the log to be analyzed and the historical log records. The analysis result is obtained by integrating the output results of each target expert model from the global model. The calculation module is used to confirm whether there are any anomalies in the log to be analyzed based on the analysis results.

8. A computer embedded device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 6.

Images