Method for analyzing interaction log, electronic device, and storage medium

Abstract

Embodiments of the present application provide an interaction log analysis method, an electronic device and a storage medium. The method comprises: parsing a to-be-analyzed interaction log of a mobile terminal and a user identification card, and dividing the to-be-analyzed interaction log into a plurality of instruction clusters; storing the instruction clusters in a key data object pool and a key action sequence pool according to cluster feature information of the instruction clusters; extracting global basic information based on key data information corresponding to each instruction cluster in the key data object pool, performing data anomaly analysis on the key data information, and obtaining a data anomaly analysis result; obtaining an action category corresponding to each instruction cluster in the key action sequence pool, performing event anomaly analysis on each instruction cluster based on the global basic information, and obtaining an event anomaly analysis result; and generating and outputting an analysis report of the to-be-analyzed interaction log according to the data anomaly analysis result and the event anomaly analysis result. The present application improves the accuracy and interpretability of interaction log analysis.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an analysis method, electronic device and storage medium for interactive logs. Background Technology

[0002] The interaction between the mobile terminal and the user identification card spans multiple stages, including terminal power-on, network access, authentication, location update, and business application interaction. The interaction logs generated during this process record the issuance of commands, responses, and status changes at different stages, which can be used for terminal-card compatibility verification and abnormal interaction location.

[0003] In existing technologies, log processing typically employs a general log analysis workflow: first, logs are collected and stored; then, they are retrieved and filtered chronologically; next, log lines are extracted in a structured manner using keyword matching, pattern templates, or regular expressions to obtain multiple log segments available for analysis. Based on this, analysts usually need to identify key interactive behaviors and key data fields in the log segments, taking into account relevant specifications and configuration context, and assign the log segments to corresponding problem types or processing paths to complete attribution and classification.

[0004] However, due to the large size of the logs and the fact that the meaning of the fields and the judgment conditions depend on the specifications and configurations, when manually allocating and classifying log fragments, problems such as inconsistent allocation criteria and insufficient understanding of contextual dependencies are likely to occur, resulting in insufficient accuracy and stability of the analysis results. Summary of the Invention

[0005] This application provides an analysis method, electronic device, and storage medium for interactive logs, which aims to improve the accuracy and stability of interactive log analysis results.

[0006] In a first aspect, embodiments of this application provide a method for analyzing interaction logs, including:

[0007] The interaction logs between the mobile terminal and the user identification card are acquired and parsed to obtain the original communication command stream. According to the preset logical association rules, the original communication command stream is divided into multiple command clusters.

[0008] Based on the cluster feature information of the instruction clusters, multiple instruction clusters are classified and stored in the key data object pool and the key action sequence pool according to a preset storage method.

[0009] Based on the key data information corresponding to each instruction cluster in the key data object pool, global basic information is extracted, and data anomaly analysis is performed on the key data information according to preset reference information to obtain the data anomaly analysis results.

[0010] Obtain the action category corresponding to each instruction cluster in the key action sequence pool; based on the global basic information, perform event anomaly analysis on each instruction cluster according to the preset analysis strategy corresponding to the action category, and obtain the event anomaly analysis results.

[0011] Based on the data anomaly analysis results and the event anomaly analysis results, an analysis report of the interaction log to be analyzed is generated and output.

[0012] In one possible implementation, dividing the original communication command stream into multiple command clusters according to preset logical association rules includes:

[0013] In the original communication command stream, the sequential dependency relationship between adjacent command entries is determined based on the command feature information of each command entry;

[0014] Based on the aforementioned dependencies, the instruction entries in the original communication instruction stream are grouped to obtain multiple instruction clusters, and a cluster sequence number corresponding to each instruction cluster is generated.

[0015] The instruction set includes at least one single-type instruction set and / or at least one composite instruction set.

[0016] In one possible implementation, the step of classifying and storing multiple instruction clusters into a key data object pool and a key action sequence pool according to a preset storage method based on the cluster feature information of the instruction clusters includes:

[0017] Extract the cluster feature information of each instruction cluster, and determine the type of each instruction cluster based on the cluster feature information;

[0018] When the instruction cluster is determined to be a key data object class based on the cluster feature information, the key data information corresponding to the instruction cluster is extracted and stored in the key data object pool.

[0019] When the instruction cluster is determined to be a key action object class based on the cluster feature information, the action category of each instruction cluster is determined, and the instruction cluster is stored in the key action sequence pool in the action sequence corresponding to the action category.

[0020] In one possible implementation, storing the instruction cluster into the key action sequence pool corresponding to the action category includes:

[0021] Obtain the cluster sequence number of the instruction cluster, and based on the preceding instruction cluster adjacent to the instruction cluster, obtain the cluster sequence number of the preceding instruction cluster as the preceding cluster sequence number of the instruction cluster;

[0022] The logical channel identifier of each instruction entry within the instruction cluster is parsed, and the logical channel sub-queue corresponding to the instruction cluster is determined from the key action sequence pool based on the logical channel identifier.

[0023] The instruction cluster, the cluster sequence number, and the previous cluster sequence number are written into the logical channel sub-queue to complete the storage of the instruction cluster into the critical action sequence pool.

[0024] In one possible implementation, data anomaly analysis is performed on the key data information based on preset reference information to obtain data anomaly analysis results, including:

[0025] Obtain preset reference information and read key data information from the key data object pool;

[0026] The preset reference information includes preset reference data values ​​and / or preset data format constraint information;

[0027] In the preset reference information, reference data values ​​and / or data format constraint information corresponding to the key data information are matched and obtained according to the data identifier of the key data information;

[0028] Based on the reference data values ​​and / or data format constraints, the key data information is subjected to consistency verification and / or format verification.

[0029] When the consistency check fails or the format check fails, a data anomaly record is generated, and the key data information is marked as abnormal data to obtain the data anomaly analysis results.

[0030] In one possible implementation, the event anomaly analysis results include authentication event anomaly analysis results and / or file operation event anomaly analysis results;

[0031] Accordingly, based on the global basic information, and according to a preset analysis strategy corresponding to the action category, event anomaly analysis is performed on each of the instruction clusters to obtain event anomaly analysis results, including:

[0032] Read and obtain the action category corresponding to each instruction cluster from the key action sequence pool;

[0033] The action categories include network access authentication action categories and / or file operation action categories;

[0034] Based on the global basic information, the instruction cluster of the network access authentication action category is used to determine authentication anomalies, and when the preset authentication anomaly determination conditions are met, an authentication event anomaly record is generated.

[0035] Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the network access authentication action category appears within a preset time window, and generate an authentication count record;

[0036] Based on the summary of the authentication event anomaly records and the authentication frequency statistics records, the authentication event anomaly analysis results are obtained;

[0037] And / or based on the global basic information, perform operation anomaly determination on the instruction cluster of the file operation action category, and generate a file operation event anomaly record when the preset operation anomaly determination conditions are met;

[0038] Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the file operation action category appears within a preset time window, and generate an operation count record;

[0039] Based on the file operation event anomaly records and the operation count statistics records, obtain the file operation event anomaly analysis results.

[0040] In one possible implementation, the event anomaly analysis results also include proactive command event anomaly analysis results and / or general event anomaly analysis results;

[0041] The action categories include proactive command action categories and / or general exception action categories;

[0042] Accordingly, the step of performing event anomaly analysis on each instruction cluster based on the global basic information and according to a preset analysis strategy corresponding to the action category, and obtaining the event anomaly analysis results, further includes:

[0043] Based on the global basic information, interaction anomaly determination is performed on the instruction cluster of the active command action category, and an active command event anomaly record is generated when the preset interaction anomaly determination conditions are met.

[0044] Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the active command action category appears within a preset time window, and generate an active command count record;

[0045] Based on the proactive command event anomaly record and the proactive command count record, obtain the proactive command event anomaly analysis results;

[0046] And / or based on the global basic information, perform general anomaly determination on the instruction cluster of the general abnormal action category, and generate a general event anomaly record when the preset general anomaly determination conditions are met;

[0047] Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the general abnormal action category appears within a preset time window, and generate a general abnormality count record;

[0048] Based on the general event anomaly record and the general anomaly count record, obtain the general event anomaly analysis results.

[0049] In one possible implementation, it also includes:

[0050] Based on multiple event anomaly records in the event anomaly analysis results, obtain the cluster sequence number, the previous cluster sequence number, and the timestamp carried by the anomaly instruction cluster corresponding to each event anomaly record;

[0051] Based on the preceding cluster sequence number, and according to a preset preceding cluster quantity threshold, the preceding instruction cluster set corresponding to the abnormal instruction cluster is obtained through iterative positioning.

[0052] In the key action sequence pool and / or the key data object pool, respectively obtain the instruction entry set of each preceding instruction cluster in the preceding instruction cluster set and the timestamp carried by the preceding instruction cluster;

[0053] Based on the timestamp carried by the abnormal instruction cluster and the timestamp carried by each preceding instruction cluster in the preceding instruction cluster set, the preceding instruction cluster set is checked for time sequence to obtain the preceding instruction cluster sequence.

[0054] Based on the set of instruction entries for each preceding instruction cluster in the preceding instruction cluster sequence, extract the preceding cluster feature information for each preceding instruction cluster.

[0055] Obtain cluster feature information of the abnormal instruction cluster, perform dependency analysis and / or correlation analysis on multiple preceding cluster feature information and the cluster feature information of the abnormal instruction cluster, and obtain dependency and correlation information between the abnormal instruction cluster and the preceding instruction cluster set.

[0056] Add the dependency and correlation information to the analysis report and output it.

[0057] Secondly, embodiments of this application provide an analysis apparatus for interaction logs, comprising:

[0058] The log parsing module is used to acquire and parse the interaction logs between the mobile terminal and the user identification card to be analyzed, obtain the original communication command stream, and divide the original communication command stream into multiple command clusters according to preset logical association rules;

[0059] The classification processing module is used to classify and store multiple instruction clusters into a key data object pool and a key action sequence pool according to a preset storage method based on the cluster feature information of the instruction clusters.

[0060] The anomaly analysis module is used to extract global basic information based on the key data information corresponding to each instruction cluster in the key data object pool, and to perform data anomaly analysis on the key data information according to preset reference information to obtain data anomaly analysis results.

[0061] The anomaly analysis module is also used to obtain the action category corresponding to each instruction cluster in the key action sequence pool, and based on the global basic information, perform event anomaly analysis on each instruction cluster according to the preset analysis strategy corresponding to the action category, and obtain the event anomaly analysis results.

[0062] The report output module is used to generate and output an analysis report of the interaction log to be analyzed based on the data anomaly analysis results and the event anomaly analysis results.

[0063] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0064] The memory stores computer-executed instructions;

[0065] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0066] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0067] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0068] This application provides an interaction log analysis method, electronic device, and storage medium. By acquiring and parsing the interaction logs between a mobile terminal and a user identification card to form a raw communication command stream, the method divides the command sequence into multiple command clusters based on preset logical association rules. This allows commands and responses, originally scattered line by line, to be grouped within logical units while preserving contextual relationships, improving the structure and interpretability of the interaction logs. Furthermore, based on the cluster feature information of the command clusters, the command clusters are stored in a key data object pool and a key action sequence pool according to preset storage methods, achieving the classification and organization of key data information and key action information. On this basis, global basic information is extracted from the key data object pool and combined with preset reference information to perform data anomaly analysis on the key data information, enabling the automatic identification and aggregation of anomalies at the key data level, improving the consistency of anomaly judgment. Simultaneously, based on the action categories corresponding to the command clusters in the key action sequence pool and combined with global basic information, event anomaly analysis is performed according to a preset analysis strategy corresponding to the action category. This allows for differentiated and stable judgment paths for anomaly identification of different interaction behaviors, improving the accuracy and interpretability of event anomaly detection. Finally, by combining the results of data anomaly analysis and event anomaly analysis, an analysis report is generated and output, which solves the technical problems of inconsistent allocation of interaction logs between mobile terminals and user identification cards and insufficient understanding of contextual dependencies in existing technologies, resulting in insufficient accuracy and stability of log analysis. Attached Figure Description

[0069] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0070] Figure 1 A schematic diagram of the interaction log analysis method provided in the embodiments of this application;

[0071] Figure 2 This is a schematic diagram of the method flow for outputting an analysis report provided in an embodiment of this application;

[0072] Figure 3 This is a schematic diagram of the data flow for SIM card log analysis provided in an embodiment of this application;

[0073] Figure 4 A schematic diagram of the structure of the decision support library provided in the embodiments of this application;

[0074] Figure 5 A schematic diagram of the structure of the interactive log analysis device provided in the embodiments of this application;

[0075] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0076] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] The inventive concept of this application lies in transforming the analysis object of the interaction log between the mobile terminal and the user identification card from discrete log lines arranged in chronological order to instruction clusters capable of expressing contextual semantics, thereby establishing a processing link from the original instruction byte stream to analysis conclusions that can be directly used for location. Specifically, the interaction log to be analyzed is first parsed, extracting and restoring it to the original communication instruction stream; then, instead of relying on keywords or templates to make fragmented judgments on individual records, instructions with successive relationships, object continuity, or consistency in interaction stages are aggregated into multiple instruction clusters according to preset logical association rules. This allows the analysis unit to carry interaction context and boundary information, providing a consistent semantic basis for subsequent judgments and reducing the instability and misjudgments caused by context fragmentation in general log methods.

[0079] Building upon this foundation, the analysis path is further organized using a divide-and-conquer approach and a results-oriented methodology: Cluster feature information of instruction clusters is extracted and categorized according to a pre-defined storage method. Content reflecting the global basic state or key fields is stored in a key data object pool, while content reflecting the evolution of key interactive behaviors is stored in a key action sequence pool. Subsequently, based on the key data object pool, global basic information is extracted, and combined with pre-defined reference information, data anomaly analysis is performed on the key data information to form a unified background baseline and data-level anomaly conclusions. Then, using the action categories corresponding to the instruction clusters in the key action sequence pool as indexes, event anomaly analysis is completed under the constraints of global basic information and a pre-defined analysis strategy to obtain behavioral-level anomaly conclusions. Finally, the data anomaly analysis results and event anomaly analysis results are aggregated to generate an analysis report. This ensures that the output not only includes anomaly classification conclusions but also forms a verifiable and reusable location basis under a unified baseline and strategy. Given the realities of inconsistent manual allocation and classification in the background technology, difficulty in grasping contextual dependencies, and low efficiency in large-scale processing, this forms a structured, interpretable, and reproducible analysis scheme for machine-card interaction logs.

[0080] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0081] Figure 1 This is a schematic diagram of the interaction log analysis method provided in the embodiments of this application, such as... Figure 1 As shown, the method includes:

[0082] S11. Obtain and parse the interaction log between the mobile terminal and the user identification card to be analyzed, obtain the original communication command stream, and divide the original communication command stream into multiple command clusters according to the preset logical association rules.

[0083] In this embodiment, the interaction log to be analyzed represents the communication command issuance and response return status between the mobile terminal and the user identification card during the interaction process. Its content is typically presented in the form of multiple interaction records, each containing at least the necessary information to characterize a communication command and its response. By acquiring and parsing this interaction log, the scattered, unstructured text or encoded fields in the original log can be converted into a computable data representation, extracting and reconstructing the original communication command stream for subsequent analysis. The original communication command stream refers to the sequence of communication commands organized according to the interaction sequence recorded in the log, continuously reflecting the command exchange and state evolution during the user identification card interaction process. By parsing and serializing the log data, a unified expression of the interaction behavior is achieved, providing a stable data input format for subsequent logical aggregation and anomaly analysis.

[0084] Next, the original communication command stream is divided into multiple command clusters. Logical association rules are a pre-configured set of association determination rules used to identify logically related communication commands in the original communication command stream and determine their aggregation boundaries. An command cluster is an analysis unit consisting of at least one communication command that satisfies the same logical association rule constraint, used to carry interactive segments with overall meaning. The configuration of logical association rules can be determined based on information such as the response correspondence between communication commands, object consistency, interaction state continuity, and business semantic coherence, enabling the originally linearly arranged communication commands to be aggregated into command clusters with clear boundaries and internal consistency. By dividing the original communication command stream into multiple command clusters, the logical unitization of the interaction log is achieved, making subsequent processing no longer dependent on the isolated interpretation of individual commands, improving the ability to retain contextual relationships and the interpretability of the analysis process, and laying a structured foundation for subsequent classification storage and event anomaly analysis.

[0085] S12, based on the cluster feature information of the instruction cluster, classify and store multiple instruction clusters into the key data object pool and the key action sequence pool according to the preset storage method.

[0086] In this embodiment, instruction clusters are classified based on their cluster feature information and stored in a key data object pool and a key action sequence pool according to a preset storage method. Cluster feature information is a structured description of the overall attributes of an instruction cluster, representing its functional orientation during interaction. It can be generated from the type of communication instructions within the instruction cluster, the interaction object, the data format of instructions and responses, and comprehensive features related to the interaction state. By extracting and summarizing cluster feature information, different instruction clusters can be classified under a unified judgment criterion, laying the foundation for subsequent differentiated storage and analysis.

[0087] The key data object pool stores key data information related to the interaction logs to be analyzed. Key data information refers to data content that reflects the user identification card's capability elements, configuration elements, or provides fundamental support for subsequent event judgment. The key action sequence pool stores action-related information related to the interaction logs to be analyzed. Action-related information refers to information content that represents the meaningful interactive behaviors and their evolution processes between the mobile terminal and the user identification card. Preset storage methods define the storage carriers and organizational forms of different types of information, ensuring that key data information and action-related information are stored separately using different data structures. This guarantees that subsequent analysis processes can read, retrieve, and process information in a data object-oriented and action sequence-oriented manner, respectively. By classifying and pooling instruction clusters according to cluster feature information, the object-oriented and serialized carrying of interaction log information is separated. This allows subsequent processing to use different data reading and calculation paths for different analysis objectives, improving the targeting and efficiency of storage and processing, and providing clear data source boundaries for subsequent global basic information extraction and event anomaly analysis.

[0088] S13. Based on the key data information corresponding to each instruction cluster in the key data object pool, extract global basic information, and perform data anomaly analysis on the key data information according to the preset reference information to obtain the data anomaly analysis results.

[0089] In this embodiment, the key data information corresponding to each instruction cluster in the key data object pool is processed as the basic data source for global information construction and anomaly judgment. Key data information is a data set obtained by parsing and structuring data content related to user identification card attributes, capability elements, or basic interaction states within the instruction cluster. Based on this, the key data information corresponding to each instruction cluster is aggregated from the key data object pool to extract global basic information. Global basic information is the result of extracting global supporting data for the interaction log to be analyzed; it describes in a structured manner the data state or key elements that should be considered basic prerequisites within the scope of the interaction log. The extraction process of global basic information includes merging and unifying similar key data information, and uniformly managing key data information that appears repeatedly or is updated multiple times in different instruction clusters. This ensures that subsequent analysis stages can reference basic data under the same global caliber, reducing judgment bias caused by differences in the interpretation of local fragments. By extracting global basic information, centralized expression and unified referencing of key data information are achieved, providing stable background conditions and judgment baselines for subsequent event anomaly analysis.

[0090] Next, data anomaly analysis is performed on key data information based on preset reference information. The reference information is a pre-established and configurable reference basis used to provide criteria for judging the rationality of key data information. It limits the expected range of key data information in terms of semantics, value, and structural expression, supporting systematic anomaly identification of key data information. During the data anomaly analysis process, for the key data information corresponding to each instruction cluster in the key data object pool, a comparative analysis and validity verification are performed based on the reference information. Inconsistencies, deviations, or unusability between the key data information and the reference information are identified, and the identified anomalies are formed into data anomaly analysis results. The data anomaly analysis results are the distribution and characteristics of anomalies at the key data level in the interaction log to be analyzed. This can reflect anomalies in the key elements related to the user identification card itself, and can also provide constraints and judgment clues for subsequent event anomaly analysis related to action categories. By setting up reference information-driven data anomaly analysis, automated verification and anomaly aggregation of key data information are achieved, reducing reliance on manual experience-based judgment, improving the stability and repeatability of key data level problem identification, and providing directly referable data anomaly basis for subsequent analysis report generation.

[0091] S14. Obtain the action category corresponding to each instruction cluster in the key action sequence pool. Based on the global basic information, perform event anomaly analysis on each instruction cluster according to the preset analysis strategy corresponding to the action category, and obtain the event anomaly analysis results.

[0092] In this embodiment, the action category corresponding to each instruction cluster is read from the critical action sequence pool. The action category represents the interactive behavior attribute corresponding to the instruction cluster; it is a category identifier abstracted from the behavior of the instruction cluster during the interaction process, used to distinguish the judgment focus and abnormal manifestations of different types of interactive behaviors. By obtaining the action category, the instruction clusters in the critical action sequence pool can be mapped to an analysis method that matches their behavioral attributes, avoiding misjudgment or omission caused by placing interactive behaviors of different natures under the same judgment criterion. The introduction of action categories enables categorized management of critical actions, providing clear instructions for subsequent category-based analysis strategy invocation, and improving the targeting and consistency of event anomaly analysis.

[0093] After obtaining the action category, event anomaly analysis is performed on each instruction cluster based on global basic information and the preset analysis strategy corresponding to the action category. The preset analysis strategy is a pre-configured and maintainable set of analysis rules used to specify the anomaly judgment conditions, judgment process, and result output method to be considered under a specific action category. Global basic information (i.e., global constants) serves as the background constraint and judgment baseline for event anomaly analysis, used to uniformly interpret key fields, state changes, and interaction results in the instruction cluster, ensuring consistency in the judgment criteria for the same type of event in different log fragments. During the event anomaly analysis process, for each instruction cluster, the corresponding preset analysis strategy is selected according to its action category to perform structured verification and anomaly identification on the interactive behavior information carried by the instruction cluster. During the identification process, the correspondence between instructions and responses within the instruction cluster, the rationality of the interaction results, and the consistency of constraints with the global basic information are comprehensively considered to form event anomaly analysis results that can characterize the nature and manifestation of the anomaly. By using a matching mechanism between action categories and analysis strategies, differentiated analysis of key action instruction clusters is achieved, transforming event anomaly identification from general rules to specialized judgments oriented towards behavioral attributes. This improves the accuracy, interpretability, and reusability of anomaly detection and provides structured evidence of event anomalies for the generation of subsequent analysis reports.

[0094] S15: Based on the data anomaly analysis results and event anomaly analysis results, generate and output an analysis report of the interaction logs to be analyzed.

[0095] In this embodiment, the analysis report is used to uniformly present the key data status and key interaction events of the interaction logs to be analyzed. Its content includes at least data anomaly analysis results reflecting anomalies at the key data level and event anomaly analysis results reflecting anomalies at the interaction event level, enabling the report to simultaneously cover analytical conclusions from both the data anomaly and behavioral anomaly perspectives. By integrating data anomaly analysis results and event anomaly analysis results within the same reporting framework, anomaly information from different dimensions can corroborate each other and form a complete analytical view, reducing the biased attribution or difficulty in localization caused by conclusions based on only a single dimension.

[0096] When generating the analysis report, the data anomaly analysis results provide a basis for summarizing the distribution and characteristics of anomalies in key data information, while the event anomaly analysis results provide a basis for summarizing event anomaly information identified by action category. The report generation process merges and organizes these two types of results, transforming anomaly information into a problem-oriented expression. This allows the analysis object, anomaly nature, and anomaly manifestation to be output in a structured manner, facilitating direct use in scenarios such as maintenance troubleshooting, quality backtracking, and problem reproduction. By integrating and summarizing the data anomaly analysis results and the event anomaly analysis results, a transformation from raw interaction logs to readable analysis conclusions is achieved. This improves the accessibility and reusability of anomaly information, reduces the workload of analysts in manually comparing and classifying raw logs segment by segment, and enhances the stability of the analysis process and the consistency of the results through report-based output.

[0097] In one embodiment, acquiring and parsing the interaction logs between the mobile terminal and the user identification card to obtain the original communication command stream includes: acquiring the interaction logs between the mobile terminal and the user identification card to be analyzed, and reading each interaction record sequentially according to the timestamp carried in the interaction record in the interaction log to be analyzed, and organizing them into an original communication command stream according to the order of events.

[0098] In this embodiment, the interaction records in the interaction log to be analyzed typically carry key information about a single machine-card interaction. Their fields are usually in hexadecimal string format, representing the command content of the command application protocol data unit and its corresponding response content, and carrying a timestamp describing the time of occurrence. By parsing the interaction records, the timestamp and instruction data can be extracted while preserving the original semantics, providing a stable sorting basis for subsequent organization processes. This achieves a computable representation of the interaction records, providing a continuously processable data foundation for forming the original communication instruction stream.

[0099] Based on the timestamps carried by the interaction records in the analysis log, when each interaction record is read sequentially and organized into the original communication command stream according to its chronological order, the timestamps are used to record the relative positions of the interaction records on the timeline, restoring the discrete records in the original log into a sequence structure with a clear chronological relationship. The sequential reading process can be completed according to the natural arrangement of the interaction records in the log. During the reading process, the timestamp of each interaction record is extracted and standardized, enabling interaction records from different stages to be compared under a unified time caliber. When the interaction records can be directly distinguished in chronological order based on their timestamps, the original communication command stream can be organized in ascending order of timestamps to ensure the time consistency of the interaction link. When there are parallel situations due to identical timestamps or insufficient time resolution, the original order of appearance of the interaction records in the log can be maintained as a supplementary constraint on the chronological order, avoiding the introduction of unrealistic causal relationships by rearrangement. By using timestamps as the primary method and the original log order as a secondary method, a stable restoration of the temporal relationship of the interaction process is achieved, enabling the original communication command stream to continuously reflect the command exchange, response return, and state evolution process between the mobile terminal and the user identification card at different stages. By constructing the original communication command stream, the interaction logs to be analyzed are transformed from a searchable set of records into an analyzable time-series command sequence, thereby improving the stability of analysis results in large-scale log scenarios.

[0100] In one embodiment, the original communication command stream is divided into multiple command clusters according to preset logical association rules, including:

[0101] S111, In the original communication instruction stream, the sequential dependency relationship between adjacent instruction entries is determined based on the instruction feature information of each instruction entry;

[0102] S112, based on the dependencies, group the instruction entries in the original communication instruction stream to obtain multiple instruction clusters, and generate a cluster sequence number corresponding to each instruction cluster; wherein, the instruction cluster includes at least one single-type instruction cluster and / or at least one composite instruction cluster.

[0103] In this embodiment, instruction feature information typically includes, but is not limited to, the timestamp of the instruction entry, the instruction direction identifier, the header and data fields of the command application protocol data unit (APDU), and the status word field in the response APDU. After parsing the above instruction feature information, a comprehensive judgment is made on the consistency of instruction type, continuity of object pointing, response guidance relationship, and continuity of interaction state between two adjacent instruction entries to determine whether the subsequent instruction entry is triggered by the previous instruction entry or is a contextual prerequisite, thus forming a dependency relationship between adjacent instruction entries. This achieves an explicit expression of the implicit context in the original communication instruction stream, providing a reliable aggregation basis for subsequent structured analysis at the instruction cluster level.

[0104] After determining the dependencies, when traversing the original communication command stream, if a dependency is found between adjacent command entries, they are grouped into the same group and the group is continuously expanded until a dependency is broken, the interaction object is switched, or the interaction stage represented by the response status word transitions. At this point, the current group ends and a new group is started, forming multiple command clusters. For example, there may be a succession relationship where a file selection command is immediately followed by a response retrieval command, or an extension relationship where a binary read command or a record read command appears after completing file selection and response retrieval; or a succession relationship where a terminal feature configuration command is followed by a proactive retrieval command and then a terminal response. These succession relationships can be identified through the byte characteristics of the command entries and the guiding semantics of the response status word, forming reusable logical units at the grouping level.

[0105] For interaction sequences oriented towards critical business processes, the grouping process can also aggregate authentication commands with subsequent network access-related interactions, or incorporate critical operation commands such as update binary commands with their adjacent successor commands into the same logical unit, forming a business process-oriented instruction cluster. By performing continuous grouping based on dependencies, transactional segmentation of the original communication instruction stream is achieved, enabling subsequent processing to analyze instruction clusters rather than individual instructions, thus improving the ability to preserve the interaction context.

[0106] While generating instruction clusters, a corresponding cluster sequence number is generated for each instruction cluster. This sequence number is used to uniquely identify and sequentially locate instruction clusters within the same analysis of the interaction logs to be analyzed. The cluster sequence number can be generated using an incremental numbering or coded numbering method. Its generation is typically based on the order in which the instruction cluster appears in the original communication instruction stream, and can be associated with information such as the start timestamp, start position, or number of instruction entries within the cluster to enhance traceability, ensuring that the instruction cluster can be stably indexed and referenced in subsequent processing stages. By setting cluster sequence numbers, serialized management of instruction clusters is achieved, facilitating rapid location and backtracking of instruction clusters during report generation or anomaly detection.

[0107] The instruction clusters formed based on the grouping mechanism include at least single-type instruction clusters and composite instruction clusters. Single-type instruction clusters are aggregated based on user identification card instruction interaction rules, typically forming logical combinations around the same type of basic instruction rules. Single-type instruction clusters include file access-related instruction combinations and card-initiated interaction-related instruction combinations; for example, selecting a SIM card file, reading file response data, and reading file content can constitute a basic instruction cluster. Composite instruction clusters are aggregated based on business processes, typically manifesting as logical combinations around the same business stage or key business objective. For example, SIM authentication commands and location file update commands involved in the network registration process can constitute an instruction cluster. By simultaneously supporting both single-type and composite instruction clusters, the interpretability of instruction rules is maintained while considering the overall business process. This allows subsequent analysis to accurately focus on specific instruction semantics while preserving cross-instruction contextual relationships at the business link level, improving the systematic and comprehensive nature of problem localization.

[0108] In one embodiment, the classification and storage of data in step S12 above into a key data object pool and a key action sequence pool are further explained below. Based on the above embodiment, it includes:

[0109] S121, extract the cluster feature information of each instruction cluster, and determine the type of each instruction cluster based on the cluster feature information.

[0110] Specifically, the cluster feature information extraction process is typically based on summarizing the instruction feature information of instruction entries within an instruction cluster. This includes the instruction word features of the command application protocol data unit (APDU) within the instruction cluster, the status word semantics of the response APDU, the consistency of the operation object, and the positional features of the instruction cluster during the interaction phase. By structurally summarizing the above feature information, instruction clusters that only reflect routine interactions and contribute little to problem localization can be distinguished from instruction clusters that contain key data or key behaviors and support global judgment. Under a unified judgment standard, the type of instruction cluster can be determined and the corresponding storage action can be triggered. This achieves automated screening and classification of instruction clusters, reducing the workload of relying on manual experience for fragment allocation in large-scale interaction logs.

[0111] S122, when determining that the instruction cluster is a key data object class based on the cluster feature information, extract the key data information corresponding to the instruction cluster and store the key data information in the key data object pool.

[0112] Specifically, key data information comprises critical attributes, capability elements, or global status elements of the SIM card. Its extraction typically involves parsing command APDUs and response APDUs within the instruction set, converting raw hexadecimal fields into directly referenceable structured data content, and establishing a mapping relationship with corresponding data identifiers for subsequent rapid retrieval and reuse. In the SIM card interaction mechanism scenario, key data information can cover data objects that can globally impact the overall judgment, such as the Answer To Reset (ATR), Protocol and Parameters Selection (PPS), Integrated Circuit Card Identifier (ICCID), File Directory (EFDIR), Terminal Profile, Universal Subscriber Identity Module Application Identifier (USIM AID), and key file content related to network access capabilities. By storing key data information as data objects, a stable data foundation is provided for subsequent extraction of global basic information and anomaly detection.

[0113] S123, when determining that an instruction cluster is a key action object class based on cluster feature information, determine the action category of each instruction cluster, and store the instruction cluster in the key action sequence pool corresponding to the action category.

[0114] Specifically, action categories are used to semantically categorize the interactive behaviors represented by instruction clusters, enabling subsequent analysis to select differentiated judgment strategies based on behavioral attributes and maintain consistency. In the SIM card interaction log, the determination of action categories can be comprehensively judged by combining the instruction word characteristics, response status semantics, and interaction purpose of key instructions within the instruction cluster, ensuring that the same type of key action can be stably identified and included in the same action sequence in different log fragments. In the scenario of the SIM card interaction mechanism, key action objects typically cover network access authentication-related interactions that can affect network access and service capabilities, file operation-related interactions that update or erase files on the card, proactive command-related interactions triggered by the card and required to be executed by the terminal, as well as other interactive behaviors and their abnormal manifestations with diagnostic value. Writing instruction clusters into the corresponding action sequences in the key action sequence pool according to action categories realizes the serialized storage and domain-based management of key actions, improving the pertinence and interpretability of event anomaly identification.

[0115] In another embodiment, instruction clusters are further classified as one-time objects and discarded. These instruction clusters typically represent routine, repetitive, or non-critical interaction segments during the interaction process. After necessary parsing and confirmation, they can be released directly and no longer participate in subsequent data anomaly or event anomaly analysis. For example, in file interaction scenarios, there are numerous combinations of normal file selection commands and response retrieval commands for non-critical files, or further, routine read chains containing binary read commands / log read commands. In state maintenance scenarios, there are interaction segments with repetitive state commands and consistent response state words. Filtering these instruction clusters effectively reduces noise and conserves resources in the interaction logs, ensuring stable processing efficiency for subsequent analysis even in large-scale data scenarios.

[0116] In one embodiment, the action categories in the key action sequence pool include network access authentication action categories, file operation action categories, proactive command action categories, and general action categories. The network access authentication action category comprises interactive behaviors related to the cellular network access process. When a network access authentication-related record is detected in the interaction log to be analyzed, the corresponding instruction cluster is stored in the key action sequence pool as the action sequence corresponding to the network access authentication action category. The file operation action category comprises interactive behaviors that operate on files within the user identification card. File write / erase actions and file interaction anomalies are uniformly considered as the key coverage objects of the file operation action category. When an operation affecting file writing or erasing is detected, regardless of whether the command execution is successful or not, the corresponding instruction cluster is stored in the key action sequence pool as the action sequence corresponding to the file operation action category. Furthermore, when there is an anomaly in the file operation command or response application protocol data unit, even if no actual update occurs, the corresponding instruction cluster is still stored in the action sequence.

[0117] For file interaction command clusters that do not belong to the file operation action category, it is further determined whether the corresponding file belongs to the scope of critical data information. If it does, the critical data information is extracted according to the critical data object processing mechanism and stored in the critical data object pool; otherwise, it is not entered into the critical data object pool and critical action sequence pool according to the preset storage method. Active command action categories are used to characterize interactive behaviors related to the active communication mechanism between the user identification card and the mobile terminal. The corresponding active command-related command clusters are all processed as critical action objects and stored in the critical action sequence pool as the action sequence corresponding to the active command action category. General action categories are used to cover other interactive behaviors besides the above action categories, such as user identification card reset, status management, SMS sending and receiving, application custom commands, and other behavioral interactions, as well as general situations caused by non-network authentication, non-file operations, and non-active commands, including command errors, response data errors, abnormal status word returns, and consistency-breaking anomalies such as command and response mismatch. The corresponding command clusters are all stored in the critical action sequence pool as the action sequence corresponding to the general action category.

[0118] Next, to support isolation analysis in multi-application concurrent scenarios, logical channel sub-queues are further set up within each action sequence. When the four types of actions are placed into the corresponding action sequence, they need to be placed into their respective logical channel sub-queues according to the instruction logical channel number. In a specific embodiment, based on the above embodiment, the instruction cluster is stored in the key action sequence pool as the action sequence corresponding to the action category, including:

[0119] S1231, obtain the cluster sequence number of the instruction cluster, and obtain the cluster sequence number of the preceding instruction cluster based on the preceding instruction cluster adjacent to the instruction cluster, and use it as the preceding cluster sequence number of the instruction cluster.

[0120] Specifically, the cluster sequence number is used to uniquely identify the instruction clusters within the same interactive log analysis process, providing a stable index entry point for subsequent event anomaly analysis, statistical analysis, and report location. The preceding cluster sequence number represents the sequential association between the current instruction cluster and its preceding adjacent instruction clusters, ensuring that the relative positional relationship of instruction clusters in the original communication instruction stream is preserved even when subsequent analysis is carried out using the critical action sequence pool as a carrier. The preceding cluster sequence number is obtained based on the cluster sequence numbers of adjacent preceding instruction clusters. By reading the cluster sequence numbers already generated by those preceding instruction clusters and writing them into the association field of the current instruction cluster, a front-to-back link between instruction clusters is formed. This achieves an explicit expression of the sequential relationship of instruction clusters within the critical action sequence pool, facilitating rapid backtracking of adjacent contexts during subsequent analysis of abnormal events, and improving the interpretability and consistency of location.

[0121] S1232, parse the logical channel identifier of each instruction entry in the instruction cluster, and determine the logical channel sub-queue corresponding to the instruction cluster from the key action sequence pool based on the logical channel identifier.

[0122] Specifically, the logical channel identifier (LCI) is the communication channel affiliation of a user identification card (SIM card) in multi-application or multi-session concurrent scenarios. It is a crucial identifier used in SIM card interaction to isolate command streams from different sessions. The parsing of the logical channel identifier is typically based on the Class Byte (CLA) field of the Command Application Protocol (CIP) data unit. By decoding the encoded bits related to the logical channel in the CLA, the logical channel number to which the command entry belongs is obtained, and the channel affiliation of the command cluster is summarized accordingly. Since command entries within the same command cluster usually belong to the same logical channel, the logical channel identifier of the command cluster is determined by confirming the consistency of the logical channel identifiers of command entries within the command cluster, and this identifier serves as the basis for storage routing. When cross-channel information exists within a command cluster, an affiliation strategy based on the dominant channel of the command cluster can be adopted to ensure the storage consistency of the command cluster as a logical unit.

[0123] The logical channel sub-queue is an organizational unit within the critical action sequence pool used to divide storage queues according to logical channels. Different logical channel sub-queues are isolated from each other, enabling instruction clusters from different channels to be queued and analyzed independently, reducing contextual interference caused by interleaving of instructions from multiple channels. By parsing the logical channel identifier and routing it to the logical channel sub-queue, channel-level isolated storage of critical action instruction clusters is achieved, improving the stability of subsequent event anomaly analysis in multi-logical channel scenarios.

[0124] S1233, write the instruction cluster, cluster sequence number and previous cluster sequence number into the logical channel sub-queue to complete the storage of the instruction cluster into the critical action sequence pool.

[0125] Specifically, during the writing process, the instruction cluster, as the original carrying unit for event anomaly analysis, is completely preserved. The cluster sequence number is used to provide a unique index for the current instruction cluster, and the previous cluster sequence number is used to maintain the link relationship with the preceding adjacent instruction cluster. This enables the critical action sequence pool to not only carry critical action objects according to the action sequence, but also to retain the relative order and context association of instruction clusters within each logical channel sub-queue.

[0126] In one embodiment, data anomaly analysis is performed on key data information based on preset reference information to obtain data anomaly analysis results, including:

[0127] S131, obtain preset reference information and read key data information from the key data object pool; wherein, the preset reference information includes preset reference data values ​​and / or preset data format constraint information.

[0128] Specifically, the preset reference information provides executable judgment criteria for key data information. It is configured and can be read and invoked before the interaction log analysis task begins. The preset reference information includes at least preset reference data values ​​and / or preset data format constraints. The preset reference data values ​​describe the expected or standard values ​​of a certain type of key data information in a specific analysis scenario. The preset data format constraints describe the expression rules that this type of key data information should meet in terms of encoding method, field structure, length range, and legal character set. To ensure the repeatability and consistency of subsequent verification processes, the preset reference information, after being read, can be organized into a mapping structure indexed by the data identifiers of the key data information. This allows each type of key data information to quickly locate its corresponding reference data value and / or data format constraints through its data identifier.

[0129] S132, in the preset reference information, according to the data identifier of the key data information, match and obtain the reference data value and / or data format constraint information corresponding to the key data information.

[0130] Specifically, the data identifier of key data information is used to uniquely represent the category and semantic affiliation of the key data information, enabling similar data obtained from different sources and at different stages to be uniformly merged and covered by the same verification rule. When reading key data information based on the key data object pool, the data identifier and data content can be read one by one according to the data records in the key data object pool, and the temporal correlation information between them and the source instruction set can be maintained so that the abnormal result can be traced back to the specific interaction stage in case of anomaly.

[0131] The data identifier matching process binds data semantics with verification rules, ensuring consistent verification logic for the same type of critical data across different log samples. When preset reference information is configured with both reference data values ​​and data format constraints, both can be loaded simultaneously to support parallel execution of consistency and format verification. This covers both the rationality and interpretability of the data within a single verification process. Through this data identifier-driven matching mechanism, the verification process for critical data information is standardized and automated, providing clear criteria for subsequent anomaly record generation.

[0132] S133, Based on the reference data values ​​and / or data format constraints, perform consistency verification and / or format verification on the key data information.

[0133] Specifically, consistency checks are used to determine whether the content of key data information meets the expected relationship defined by the reference data value. This expected relationship can be complete consistency, set inclusion, or consistency within an acceptable range, adapting to the stability characteristics of different key data. For example, for key data objects that should not typically change or whose changes are strictly constrained during the card's lifecycle, a strict consistency check can be applied between their key data information and the reference data value to quickly identify data states that do not conform to the standard value. Format checks are used to determine whether the data representation of key data information meets the rules defined by preset data format constraints. These rules may include length constraints, field boundary constraints, encoding constraints, and structural constraints, ensuring that key data information can be stably parsed and reliably referenced. For example, when critical data corresponds to basic interactive data such as reset responses or protocol and parameter selections, format verification can check its byte length and field structure; when critical data corresponds to identification data such as integrated circuit card identification codes or general user identification module application identifiers, format verification can check its encoding method, value length, and the legality of hexadecimal fields; when critical data corresponds to file directories, terminal feature configurations, or key file content related to network access, format verification can check its data structure integrity and field interpretability, reducing misjudgments in subsequent event anomaly analysis due to data expression anomalies. Through consistency verification and format verification, dual protection of the semantic correctness and expression correctness of critical data information is achieved, improving the coverage and stability of data anomaly identification.

[0134] S134. When the consistency check or format check fails, a data anomaly record is generated, and key data information is marked as anomaly data to obtain data anomaly analysis results.

[0135] Specifically, data anomaly logs are used to structurally describe the attribution and manifestation of anomalies. They can at least associate key data information with data identifiers, anomaly type identifiers, and the verification criteria that triggered the anomaly, enabling the anomaly results to be directly referenced and used for location and interpretation in subsequent analysis report generation. Simultaneously, key data information is anomaly-marked. Through the anomaly log generation and anomaly marking mechanism, traceable evidence of data anomalies is provided for subsequent report generation, and the efficiency of anomaly aggregation and the consistency of judgment are improved when analyzing large-scale interactive logs.

[0136] In one embodiment, the event anomaly analysis results include authentication event anomaly analysis results and / or file operation event anomaly analysis results, to cover the abnormal behavior of mobile terminals and user identification cards in two high-frequency key interaction scenarios: network access and file access update.

[0137] The authentication event anomaly analysis results target key action command clusters related to network access authentication, reflecting information such as whether the authentication interaction is complete, whether the authentication process meets expectations, and whether there are any anomalies in the authentication results. For example, the authentication event anomaly analysis results can comprehensively present the occurrence of authentication commands in the interaction log to be analyzed, the correspondence between requests and responses, whether the response status and response data meet the judgment constraints, and whether the frequency of occurrence of authentication action command clusters within a preset time window shows characteristics of abnormal amplification or repeated triggering. This allows subsequent analysis reports to directly point to the abnormal location and abnormal form of the critical link of network access, improving the efficiency of problem localization and the consistency of judgment criteria.

[0138] File operation event anomaly analysis results focus on key action command clusters related to file access and file updates, reflecting whether there are risky actions or abnormal behaviors in the operation of file objects on the user identification card. File operation-related command clusters typically manifest as continuous interactions surrounding file object selection, reading, updating, and response confirmation. Especially when operations involving binary update commands or other operations that write or erase file content, their correctness and frequency directly relate to the reliability of business functions and the risk to card lifespan. For example, file operation event anomaly analysis results can comprehensively present whether there are missing file objects, abnormal file control parameters or file header information, command-response mismatches, missing responses, or abnormal status returns during file operations. Furthermore, by combining the timestamps carried by the command clusters, it can statistically analyze the frequency of similar file operation command clusters within a preset time window to identify patterns of repeated updates, frequent erasures, or concentrated abnormal triggering within a short period, improving the reusability and interpretability of large-scale interaction log analysis.

[0139] In one embodiment, step S14 is further described below. Based on the above embodiment, obtaining the event anomaly analysis results includes:

[0140] S1401, Read and obtain the action category corresponding to each instruction cluster from the critical action sequence pool; wherein, the action category includes network access authentication action category and / or file operation action category.

[0141] Specifically, the network access authentication action category represents interactive behaviors related to the network access authentication link, while the file operation action category represents interactive behaviors related to accessing, updating, or file operation anomalies on the user identification card file object. By directly reading the action category from the critical action sequence pool, rapid routing of critical action command clusters is achieved, enabling different types of command clusters to enter the analysis path that matches their business semantics, reducing misjudgments caused by mixing authentication links and file links under the same judgment logic.

[0142] S1402, based on global basic information, performs authentication anomaly determination on the instruction cluster of network access authentication action category, and generates authentication event anomaly record when the preset authentication anomaly determination conditions are met.

[0143] S1403, based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the network access authentication action category appears within the preset time window, and generate an authentication count record;

[0144] S1404. Based on the summary of authentication event anomaly records and authentication frequency statistics, obtain the authentication event anomaly analysis results.

[0145] In this embodiment, global basic information may include, but is not limited to, Integrated Circuit Card Identifier (ICCID), File Directory (EFDIR), Terminal Profile, Universal User Identification Module (UPIN) Application Identifier, Personal Identification Number (PIN) status, and the currently selected file path, among other data states that have a global impact within the interaction log. The authentication anomaly determination comprehensively verifies the correspondence between command application protocol data units and response APDUs within the instruction cluster, the semantics of response status words, and the integrity of response data based on preset authentication anomaly determination conditions, identifying anomalies in the authentication link that affect the success rate and stability of network entry. For example, when an instruction cluster lacking a network entry authentication action category is found in the interaction log to be analyzed, it can be considered an authentication link missing anomaly; when the authentication command type is inconsistent with the expected authentication link or the response data does not match the command, it can be considered an authentication command anomaly or an authentication failure anomaly. An authentication event anomaly record is generated when the preset authentication anomaly determination conditions are met.

[0146] To identify frequently triggered issues in the authentication chain, the system records the frequency of each authentication action type within a preset time window based on the timestamp carried by the instruction cluster, generating an authentication frequency statistics record. The preset time window can be a fixed-length window to adapt to different analysis granularity requirements; for example, a minute-level window can be used to capture anomalies triggered in a concentrated period, while an hour-level window can be used to capture persistently recurring anomalies. The start and end boundaries of the time window are uniformly marked by the instruction cluster timestamp, ensuring consistency between the statistical scope and the log timeline. The authentication frequency statistics record quantifies the trigger intensity of authentication actions within the same time window. Through the time window counting mechanism, rapid quantification of authentication frequency anomalies is achieved, providing a supplementary dimension for authentication anomaly judgment and enhancing the interpretability of anomaly conclusions. Subsequently, the authentication event anomaly records and the authentication frequency statistics records are summarized to obtain the authentication event anomaly analysis results. This ensures that the authentication event anomaly analysis results simultaneously cover both the correctness of authentication interaction and the intensity of authentication triggering, facilitating the direct presentation of the authentication chain anomaly type and severity in the analysis report.

[0147] S1405, based on global basic information, performs operation anomaly determination on instruction clusters of file operation action categories, and generates file operation event anomaly records when the preset operation anomaly determination conditions are met;

[0148] S1406, Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the file operation action category appears within the preset time window, and generate an operation count record;

[0149] S1407, Based on the file operation event exception records and operation count statistics records, obtain the file operation event exception analysis results.

[0150] In this embodiment, the operation anomaly determination verifies the consistency of command APDUs and response APDUs within the file operation instruction cluster based on preset operation anomaly determination conditions, and categorizes anomalies by combining key data states related to the file object. For example, when a file operation is interrupted due to a missing response APDU, a mismatch between the response APDU and the command APDU, or a return of an abnormal status word semantics, a file response anomaly can be determined. When the file object is inconsistent with the expected file list or file control parameter requirements, a file object missing or file header anomaly can be determined. When the instruction cluster exhibits update or write behavior to file content and its interaction result is abnormal, a file operation anomaly can be determined. When the preset operation anomaly determination conditions are met, a file operation event anomaly record is generated, enabling the structured retention of file chain anomalies and supporting subsequent aggregation and localization. By extracting and recording file operation anomalies from the original APDU stream, centralized management of file operation risks and abnormal interactions is achieved, improving the efficiency and stability of file problem localization in large-scale log scenarios.

[0151] To identify frequent file operations and potential write / erase risks, the system records the frequency of file operation action categories within a preset time window based on the timestamps carried by the instruction clusters, generating an operation frequency statistics record. This record quantifies the density characteristics of file operations over time. Finally, the file operation event anomaly records and operation frequency statistics records are summarized to obtain the file operation event anomaly analysis results. This ensures that the file operation event anomaly analysis results can simultaneously consider the correctness and frequency characteristics of file operations in the same output, providing directly referable event anomaly and statistical evidence for subsequent analysis report generation.

[0152] Next, in another embodiment, the event anomaly analysis results also include proactive command event anomaly analysis results and / or general event anomaly analysis results. Action categories include proactive command action categories and / or general anomaly action categories.

[0153] Specifically, the proactive command event anomaly analysis results focus on proactive command-related interactions triggered by the user identification card and executed by the mobile terminal. This reflects whether the triggering, acquisition, execution, and response loop of the proactive command is complete, and whether the execution result meets expectations. Proactive commands in the interaction log typically manifest as a set of instruction exchanges with clear semantic continuity. Anomalies may include incomplete execution loops after the proactive command is triggered, abnormal execution result codes, and inconsistencies between the terminal execution state and the interaction stage. By aggregating these anomalies into proactive command event anomaly analysis results, the efficiency and interpretability of locating terminal-side execution anomalies and card-side triggering anomalies are improved.

[0154] The general anomaly action categories can cover behavioral segments such as user identification card reset-related interactions, status management-related interactions, SMS sending and receiving interactions, and application-defined command-related interactions. They can also cover consistency-breaking segments such as command APDU format errors, missing response APDUs, mismatches between response APDUs and command APDUs, and abnormal response status words leading to abnormal transitions during the interaction phase. For example, the frequent reset phenomenon manifested by the repeated occurrence of user identification card reset-related interactions within a short period. By incorporating general anomaly patterns into the general event anomaly analysis results, the event anomaly analysis results can achieve a more complete coverage of interaction log anomalies, improving the systematicity and comprehensiveness of large-scale interaction log analysis conclusions.

[0155] Accordingly, based on the above embodiments, obtaining event anomaly analysis results also includes:

[0156] S1408, based on global basic information, performs interaction exception judgment on the instruction cluster of the active command action category, and generates an active command event exception record when the preset interaction exception judgment conditions are met.

[0157] S1409, Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the active command action category appears within the preset time window, and generate an active command count record;

[0158] S1410, Based on the active command event anomaly record and the active command count statistics record, obtain the active command event anomaly analysis results.

[0159] In this embodiment, the interaction anomaly determination verifies the interaction loop of the active command-related instruction cluster based on preset interaction anomaly determination conditions to identify possible anomalies during the triggering, acquisition, execution, and response of active commands. In one implementation of a machine-card interaction mechanism, the interaction related to active commands typically manifests as a continuous link between terminal capability declaration, card-side instruction acquisition, and terminal execution feedback. For example, a connection may arise after terminal feature configuration, followed by an acquisition command and a subsequent terminal response. The interaction anomaly determination can verify the integrity of the link and the rationality of the result based on this connection. When the preset interaction anomaly determination conditions are met, an active command event anomaly record is generated. The preset interaction anomaly determination conditions can be manifested as compliance constraints on the terminal response result code and integrity constraints on the interaction loop. For example, a result anomaly record is triggered when the execution result represented by the terminal response does not belong to the expected acceptable result such as success, termination, or rollback, or a no-response anomaly record is triggered when no corresponding terminal response is formed after the active command is triggered.

[0160] Furthermore, the interaction anomaly determination criteria can also be combined with the event reporting data carried by the proactive command for reasonableness verification. For example, when the event reporting data related to location status shows a status value inconsistent with the interaction stage, a location status anomaly record is triggered, and both execution anomalies and business semantic anomalies in the proactive command chain are included in the proactive command event anomaly record. By performing interaction anomaly determination on the proactive command action category instruction cluster, structured identification of proactive command-related anomalies is achieved.

[0161] To identify abnormal triggering characteristics of proactive commands on the timeline, the action category instruction clusters of proactive commands are counted within a preset time window of fixed duration. This allows the triggering density of proactive commands to be quantified and cross-referenced with the proactive command event anomaly records. Subsequently, the proactive command event anomaly records and proactive command frequency statistics are summarized to obtain the proactive command event anomaly analysis results. These results simultaneously reflect the correctness conclusions of proactive command interactions and the triggering intensity characteristics, providing a more stable definition in the report to express the severity and occurrence trend of proactive command-related issues.

[0162] S1411, based on global basic information, performs general exception determination on instruction clusters of general exception action categories, and generates general event exception records when the preset general exception determination conditions are met;

[0163] S1412, Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the general abnormal action category appears within the preset time window, and generate a general abnormal number statistics record;

[0164] S1413. Obtain the general event anomaly analysis results based on the general event anomaly record and the general anomaly count record.

[0165] In this embodiment, the preset general anomaly judgment conditions can cover situations such as command APDU format errors, missing response APDUs, mismatch between response APDUs and command APDUs, and abnormal transitions in the interaction phase caused by abnormal response status words. Furthermore, interaction interruptions, repeated retries, or state management anomalies caused by abnormal status words can be used as trigger conditions for general event anomaly recording. Further, for important system behaviors affecting interaction stability, the general anomaly judgment conditions can also cover frequent anomalies related to user identification card reset interactions. A general event anomaly record is generated when the preset general anomaly judgment conditions are met.

[0166] To quantify the clustering of common anomalies along the timeline, the frequency of occurrence of instruction clusters of common anomaly action categories within a preset time window is recorded based on the timestamps carried by the instruction clusters, generating a statistical record of common anomaly occurrences. Finally, the common event anomaly records and the statistical record of common anomaly occurrences are summarized to obtain the common event anomaly analysis results, providing directly referable common anomaly and trend evidence for subsequent analysis report generation.

[0167] In one embodiment, step S15 is further described below. Based on the above embodiment, an analysis report of the interaction log to be analyzed is generated and output, including:

[0168] S151, Obtain the set of data anomaly records from the data anomaly analysis results and the set of event anomaly records from the event anomaly analysis results;

[0169] S152, Merge the data anomaly record set and the event anomaly record set according to the preset classification rules to generate a classification question set;

[0170] S153, Extract key data information corresponding to the interaction log to be analyzed from the key data object pool, and generate the key data area of ​​the report;

[0171] S154, add location information to each record in the classification question set. The location information includes at least one of the following: the timestamp corresponding to the record, the log line number, and the cluster sequence number or the previous cluster sequence number.

[0172] S155 generates and outputs an analysis report based on the report's key data areas, classification question sets, and location information.

[0173] In this embodiment, a set of data anomaly records is extracted from the data anomaly analysis results, and a set of event anomaly records is extracted from the event anomaly analysis results. Then, the two types of records are merged according to preset classification rules, allowing similar issues to be aggregated and dissimilar issues to be clearly distinguished, improving the readability and locatability of the report. For example, the preset classification rules can categorize records based on the action category, data identifier, and anomaly determination type associated with the anomaly record, enabling the merged set of categorized issues to form a grouping structure oriented towards key business links. For instance, event anomaly records related to network access authentication can be aggregated into a network access authentication issue set, event anomaly records related to file access and updates can be aggregated into a file operation issue set, event anomaly records related to proactive commands can be aggregated into a proactive command issue set, and event anomaly records related to general anomaly action categories and anomaly records that cannot be categorized into the above sets can be aggregated into a general issue set. Simultaneously, data anomaly records can be merged into an issue set related to their semantics based on their data identifier and anomaly type, allowing data-level anomalies and event-level anomalies to corroborate each other under the same classification dimension.

[0174] While generating the classification question set, key data information corresponding to the interaction logs to be analyzed is extracted from the key data object pool to form the key data area of ​​the report. This key data area centrally presents key data information that provides fundamental support for subsequent troubleshooting and review, enabling the report to not only output problem conclusions but also directly output key background data. The extraction of key data information can be based on the structured key data information records already stored in the key data object pool, maintaining the correspondence between data identifiers and data content, so as to form searchable and referential key data entries in the report. For example, the key data area of ​​the report may include key data objects that can characterize the status of the card and application, such as Integrated Circuit Card Identifier (ICCID), International Mobile Subscriber Identity (IMSI), Short Message Service Parameters (SMSP), Location Area Information (LOCI), Packet Switched Location Area Information (PSLOCI), Preferred Public Land Mobile Networks List (PLMNsel), Prohibited Public Land Mobile Networks List (FPLMN), Equivalent Home Public Land Mobile Networks List (EHPLMN), Personal Identification Number (PIN) status, and Terminal Profile, etc., which realizes the centralized output of key data information and improves the report's support for subsequent manual analysis and problem reproduction.

[0175] To enhance the location and traceability of the report, location information is added to each record in the classification question set, enabling each anomaly record to be mapped to a specific location in the original interaction log. The location information includes at least one of the following: the record's timestamp, log line number, and either a cluster sequence number or a previous cluster sequence number. The log line number is recorded synchronously when parsing the interaction log to be analyzed and forming the original communication command stream, and maintains its association with the corresponding command entry or command cluster during command cluster generation and pooling, ensuring that the line number information can be directly referenced during the report generation stage. By adding location information to anomaly records, a traceable mapping between the report content and the original log content is achieved, improving the verifiability of anomaly conclusions.

[0176] After constructing the key data area, categorized question set, and location information for the report, an analysis report is generated and output based on the above content. The analysis report can use the key data area as the basic information part of the report, the categorized question set as the main body of the report, and use location information to support the evidence chain citation relationship of each question record in the main body of the report, so that the report output has the completeness of key background data.

[0177] Figure 2 This is a schematic flowchart illustrating the method for outputting an analysis report as provided in an embodiment of this application. Based on the above embodiments, as follows... Figure 2 As shown, it includes:

[0178] S21. Based on multiple event anomaly records in the event anomaly analysis results, obtain the cluster sequence number, previous cluster sequence number, and timestamp carried by the anomaly instruction cluster corresponding to each event anomaly record.

[0179] Specifically, event exception logs typically indicate the exception command cluster corresponding to the exception occurrence. To ensure a stable index foundation for subsequent backtracking, the cluster sequence number, previous cluster sequence number, and timestamp carried by the exception command cluster are read and obtained from the event exception logs, giving the exception command cluster a traceable mark on both the logical link and the timeline. By extracting the serialization and time information of the exception command cluster, the interaction context range before the exception can be quickly reconstructed based on the sequence number link.

[0180] S22, based on the previous cluster sequence number, according to the preset previous cluster quantity threshold, the previous instruction cluster set corresponding to the abnormal instruction cluster is obtained by iterative positioning.

[0181] Specifically, a preset threshold for the number of preceding clusters is used to limit the upper limit of the number of preceding instruction clusters to be extracted in this backtracking, establishing a controllable balance between context coverage and computational overhead. This threshold can be configured according to log size, anomaly type complexity, and analysis timeliness requirements, ensuring that the backtracking scope covers the key context required for anomaly triggering while reducing redundant processing caused by unbounded backtracking. During iterative localization, starting from the preceding cluster sequence number of the anomaly instruction cluster, its corresponding preceding instruction clusters are located sequentially, and further tracing forward based on the preceding cluster sequence number of the located preceding instruction clusters continues until the preset threshold for the number of preceding clusters is reached or the backtracking link reaches the traceable starting boundary, forming a set of preceding instruction clusters associated with the anomaly instruction cluster. Through the iterative localization mechanism driven by the preceding cluster sequence number, the candidate context set before the anomaly occurs can be quickly determined without rescanning the original communication instruction stream, providing controllable context samples for subsequent dependency and correlation analysis.

[0182] S23, in the key action sequence pool and / or key data object pool, respectively obtain the instruction entry set of each preceding instruction cluster in the preceding instruction cluster set and the timestamp carried by the preceding instruction cluster.

[0183] Specifically, the instruction entry set is used to reconstruct the interaction content contained within the instruction cluster. It typically consists of multiple instruction entries, each including fields such as timestamp, command marker information, command application protocol data unit, and response APDU. This is used to analyze the integrity, response consistency, and state evolution characteristics of the interaction chain within the instruction cluster. For preceding instruction clusters stored in the key action sequence pool, the corresponding instruction entry set can be directly read from the action sequence it carries. For preceding instruction clusters that need to be obtained from the key data object pool, the corresponding instruction entry set can be obtained through the storage records associated with that preceding instruction cluster in the key data object pool. By uniformly obtaining the instruction entry set from both monitoring pools, the content of the anomaly context candidate cluster is completed, establishing a consistent data foundation for subsequent feature extraction and correlation analysis.

[0184] S24. Based on the timestamp carried by the abnormal instruction cluster and the timestamp carried by each preceding instruction cluster in the preceding instruction cluster set, perform time sequence verification on the preceding instruction cluster set to obtain the preceding instruction cluster sequence.

[0185] Specifically, since the acquisition of the preceding instruction cluster set is primarily based on sequence number links, to ensure that the context order obtained through backtracking is consistent with the actual interaction order, a time sequence verification is further performed on the preceding instruction cluster set based on the timestamps carried by the abnormal instruction clusters and the timestamps carried by each preceding instruction cluster in the preceding instruction cluster set, thus forming a preceding instruction cluster sequence. Time sequence verification is used to exclude abnormal timestamp ordering caused by log discrepancies or cross-stage interactions, ensuring that the preceding instruction clusters entering subsequent analysis have a clear chronological relationship with the abnormal instruction clusters on the timeline. After the time verification passes, the preceding instruction clusters are sorted according to their chronological relationship to obtain a preceding instruction cluster sequence usable for context analysis. Time sequence verification achieves temporal consistency constraints on the preceding context, preventing instruction clusters without a true causal relationship from being mistakenly included in the anomaly cause analysis, and improving the reliability of dependency analysis and / or correlation analysis.

[0186] S25, extract the pre-preceding cluster feature information of each pre-preceding instruction cluster based on the set of instruction entries of each pre-preceding instruction cluster in the pre-preceding instruction cluster sequence.

[0187] Specifically, the preceding instruction cluster feature information extraction process is based on the semantics of command APDUs, response APDUs, response status words, and the instruction combination forms within the instruction cluster, all contained in the instruction entry set. It summarizes the key interactive attributes of the preceding instruction cluster into structured features. These features represent the key instruction types, operation objects, response result categories, interaction loop integrity, and possible abnormal state manifestations contained in the preceding instruction cluster. This allows different preceding instruction clusters to be aligned and compared with abnormal instruction clusters in subsequent analyses using a unified feature space. By transforming the preceding instruction cluster from the original instruction entry set into preceding cluster feature information, the abstract compression and computable expression of contextual information are achieved, reducing the complexity of subsequent correlation analysis and enhancing the interpretability of the analysis results.

[0188] S26, obtain cluster feature information of abnormal instruction clusters, perform dependency analysis and / or correlation analysis on multiple preceding cluster feature information and abnormal instruction cluster cluster feature information, and obtain dependency and correlation information between abnormal instruction clusters and the set of preceding instruction clusters.

[0189] Specifically, dependency analysis is used to identify whether there are stable triggering patterns in preceding clusters before the occurrence of abnormal instruction clusters. During the analysis, based on the co-occurrence patterns of preceding cluster features and abnormal cluster features within the same sequence position, the preconditions that the anomaly depends on or the high-probability interaction fragments that occur before the anomaly occur can be extracted to form dependency information. Correlation analysis is used to identify the co-occurrence and correlation patterns between abnormal instruction clusters and preceding instruction clusters within a certain preceding range. During the analysis, within a context limited by a preset threshold for the number of preceding clusters, the co-occurrence frequency, relative position distribution, and feature consistency between preceding cluster features and abnormal cluster features can be statistically analyzed and summarized to form correlation information. This processing method matches the contextual dependency characteristics of interaction logs, enabling anomaly analysis to go beyond the abnormal instruction cluster itself and combine the interaction link characteristics before the anomaly occurs to form systematic explanatory clues. Through dependency analysis and / or correlation analysis, structured extraction of anomaly cause links and anomaly correlation links is achieved, improving the localization efficiency and the reliability of conclusions in unknown or complex anomaly scenarios.

[0190] S27, add dependency and correlation information to the analysis report and output it.

[0191] Specifically, in addition to providing data anomaly analysis results and event anomaly analysis results, the analysis report further provides evidence of dependencies and correlations between the anomaly command cluster and its preceding context. Dependency and correlation information can be linked to the cluster sequence number, preceding cluster sequence number, and timestamp of the anomaly command cluster in the report, enabling report recipients to directly trace back to the corresponding interaction segment and verify the analysis conclusions based on the sequence number link and time location information. By reporting the dependency and correlation analysis results of the anomaly context, the explanation of anomaly location is enhanced, and troubleshooting path prompts are provided, reducing the reliance on purely experience-based, segment-by-segment log reading by technical personnel and improving the stability of large-scale interaction log analysis.

[0192] Figure 3 This is a schematic diagram of the data flow for SIM card log analysis provided in an embodiment of this application. For example... Figure 3As shown, the SIM card log analysis uses the management console as the entry point. After importing the SIM card log file from the management console, the preprocessing unit parses and preprocesses the raw log, splitting the linear raw communication command stream into logical command cluster sequences and organizing them into command cluster queues. Simultaneously, based on the command characteristics and cluster feature information of the command clusters, they are classified and categorized: command clusters reflecting key data information are extracted as key data objects and placed into a key data object pool; command clusters reflecting key interactive behaviors are placed into a key action sequence pool as key action objects, and further refined into action types according to action characteristics when entering the pool, categorizing them into network authentication sequences, file operation sequences, proactive command sequences, and other action sequences; one-time command clusters are filtered according to a preset storage method to reduce the burden of subsequent analysis.

[0193] The deep analysis engine reads data from the key data object pool and the key action sequence pool, performs key data extraction, classification problem analysis, and correlation log learning, and generates key data and problem judgment records. The report generator generates formal machine card log analysis reports based on the key data and problem judgment records and outputs them to the management console, forming a business process flow from log import, analysis and processing to report feedback. Moreover, each of the above processing links is supported by the decision support library with standard foundations, standard documents, and strategies to ensure consistency in parsing and judgment.

[0194] In one specific embodiment, the preset reference information and preset analysis strategies are uniformly provided and maintained by the decision support library. The decision support library is configured as a knowledge and rule carrier for mobile terminal and user identification card interaction log analysis tasks. It is used to provide comparable reference for data anomaly analysis of key data information and to provide executable analysis strategies for event anomaly analysis based on action categories. This ensures that the analysis process under different log samples, different card types, or different configuration backgrounds has consistent judgment criteria and traceable sources of evidence.

[0195] Figure 4 This is a schematic diagram of the structure of the decision support library provided in an embodiment of this application. Figure 4As shown, the decision support library is structurally comprised of three levels: a standard base library, a standard document library, and a strategy analysis library. The standard base library stores fundamental standard constraints, the standard document library stores reference data at the card / document level, and the strategy analysis library stores preset analysis strategies corresponding to action categories. The standard base library stores basic specification information and general constraint information (such as industry standards) related to card-machine interaction. The standard document library stores reference data values ​​and file attribute constraints (such as standard card documents) related to the user identification card file system. The strategy analysis library stores preset analysis strategies (such as network access authentication strategies, document analysis strategies, proactive command strategies, or other strategies) corresponding to action categories. The standard base library can be constructed by importing basic constraint items from industry standards and operator enterprise standards. The standard document library can be constructed by importing operator card documents or card configuration benchmarks. The strategy analysis library can be constructed by defining a set of analysis rules corresponding to action categories.

[0196] Figure 5 This is a schematic diagram of the structure of the interaction log analysis device provided in the embodiments of this application, as shown below. Figure 5 As shown, the analysis device 50 provided in this embodiment includes:

[0197] The log parsing module 501 is used to acquire and parse the interaction logs between the mobile terminal and the user identification card to be analyzed, obtain the original communication command stream, and divide the original communication command stream into multiple command clusters according to the preset logical association rules.

[0198] The classification processing module 502 is used to classify and store multiple instruction clusters into a key data object pool and a key action sequence pool according to a preset storage method based on the cluster feature information of the instruction clusters.

[0199] The anomaly analysis module 503 is used to extract global basic information based on the key data information corresponding to each instruction cluster in the key data object pool, and to perform data anomaly analysis on the key data information according to the preset reference information to obtain the data anomaly analysis results.

[0200] The anomaly analysis module 503 is also used to obtain the action category corresponding to each instruction cluster in the key action sequence pool, and based on the global basic information, perform event anomaly analysis on each instruction cluster according to the preset analysis strategy corresponding to the action category, and obtain the event anomaly analysis results.

[0201] The report output module 504 is used to generate and output an analysis report of the interaction logs to be analyzed based on the data anomaly analysis results and the event anomaly analysis results.

[0202] The analysis device 50 provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0203] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus 604.

[0204] In a specific implementation, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to perform the above-described method.

[0205] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0206] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0207] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0208] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0209] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0210] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0211] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for analyzing interactive logs, characterized in that, include: The interaction logs between the mobile terminal and the user identification card are acquired and parsed to obtain the original communication command stream. According to the preset logical association rules, the original communication command stream is divided into multiple command clusters. Based on the cluster feature information of the instruction clusters, multiple instruction clusters are classified and stored in the key data object pool and the key action sequence pool according to a preset storage method. Based on the key data information corresponding to each instruction cluster in the key data object pool, global basic information is extracted, and data anomaly analysis is performed on the key data information according to preset reference information to obtain the data anomaly analysis results. Obtain the action category corresponding to each instruction cluster in the key action sequence pool; based on the global basic information, perform event anomaly analysis on each instruction cluster according to the preset analysis strategy corresponding to the action category, and obtain the event anomaly analysis results. Based on the data anomaly analysis results and the event anomaly analysis results, an analysis report of the interaction log to be analyzed is generated and output.

2. The method according to claim 1, characterized in that, The process of dividing the original communication command stream into multiple command clusters according to preset logical association rules includes: In the original communication command stream, the sequential dependency relationship between adjacent command entries is determined based on the command feature information of each command entry; Based on the aforementioned dependencies, the instruction entries in the original communication instruction stream are grouped to obtain multiple instruction clusters, and a cluster sequence number corresponding to each instruction cluster is generated. The instruction set includes at least one single-type instruction set and / or at least one composite instruction set.

3. The method according to claim 1, characterized in that, The step of classifying and storing multiple instruction clusters into a key data object pool and a key action sequence pool according to a preset storage method based on the cluster feature information of the instruction clusters includes: Extract the cluster feature information of each instruction cluster, and determine the type of each instruction cluster based on the cluster feature information; When the instruction cluster is determined to be a key data object class based on the cluster feature information, the key data information corresponding to the instruction cluster is extracted and stored in the key data object pool. When the instruction cluster is determined to be a key action object class based on the cluster feature information, the action category of each instruction cluster is determined, and the instruction cluster is stored in the key action sequence pool in the action sequence corresponding to the action category.

4. The method according to claim 3, characterized in that, The step of storing the instruction cluster into the key action sequence pool and corresponding to the action category includes: Obtain the cluster sequence number of the instruction cluster, and based on the preceding instruction cluster adjacent to the instruction cluster, obtain the cluster sequence number of the preceding instruction cluster as the preceding cluster sequence number of the instruction cluster; The logical channel identifier of each instruction entry within the instruction cluster is parsed, and the logical channel sub-queue corresponding to the instruction cluster is determined from the key action sequence pool based on the logical channel identifier. The instruction cluster, the cluster sequence number, and the previous cluster sequence number are written into the logical channel sub-queue to complete the storage of the instruction cluster into the critical action sequence pool.

5. The method according to claim 1, characterized in that, Based on preset reference information, perform data anomaly analysis on the key data information to obtain the data anomaly analysis results, including: Obtain preset reference information and read key data information from the key data object pool; The preset reference information includes preset reference data values ​​and / or preset data format constraint information; In the preset reference information, reference data values ​​and / or data format constraint information corresponding to the key data information are matched and obtained according to the data identifier of the key data information; Based on the reference data values ​​and / or data format constraints, the key data information is subjected to consistency verification and / or format verification. When the consistency check fails or the format check fails, a data anomaly record is generated, and the key data information is marked as abnormal data to obtain the data anomaly analysis results.

6. The method according to claim 1, characterized in that, The event anomaly analysis results include authentication event anomaly analysis results and / or file operation event anomaly analysis results; Accordingly, based on the global basic information, and according to a preset analysis strategy corresponding to the action category, event anomaly analysis is performed on each of the instruction clusters to obtain event anomaly analysis results, including: Read and obtain the action category corresponding to each instruction cluster from the key action sequence pool; The action categories include network access authentication action categories and / or file operation action categories; Based on the global basic information, the instruction cluster of the network access authentication action category is used to determine authentication anomalies, and when the preset authentication anomaly determination conditions are met, an authentication event anomaly record is generated. Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the network access authentication action category appears within a preset time window, and generate an authentication count record; Based on the summary of the authentication event anomaly records and the authentication frequency statistics records, the authentication event anomaly analysis results are obtained; And / or based on the global basic information, perform operation anomaly determination on the instruction cluster of the file operation action category, and generate a file operation event anomaly record when the preset operation anomaly determination conditions are met; Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the file operation action category appears within a preset time window, and generate an operation count record; Based on the file operation event anomaly records and the operation count statistics records, obtain the file operation event anomaly analysis results.

7. The method according to claim 6, characterized in that, The event anomaly analysis results also include proactive command event anomaly analysis results and / or general event anomaly analysis results; The action categories include proactive command action categories and / or general exception action categories; Accordingly, the step of performing event anomaly analysis on each instruction cluster based on the global basic information and according to a preset analysis strategy corresponding to the action category, and obtaining the event anomaly analysis results, further includes: Based on the global basic information, interaction anomaly determination is performed on the instruction cluster of the active command action category, and an active command event anomaly record is generated when the preset interaction anomaly determination conditions are met. Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the active command action category appears within a preset time window, and generate an active command count record; Based on the proactive command event anomaly record and the proactive command count record, obtain the proactive command event anomaly analysis results; And / or based on the global basic information, perform general anomaly determination on the instruction cluster of the general abnormal action category, and generate a general event anomaly record when the preset general anomaly determination conditions are met; Based on the timestamp carried by the instruction cluster, record the number of times the instruction cluster of the general abnormal action category appears within a preset time window, and generate a general abnormality count record; Based on the general event anomaly record and the general anomaly count record, obtain the general event anomaly analysis results.

8. The method according to claim 6 or 7, characterized in that, Also includes: Based on multiple event anomaly records in the event anomaly analysis results, obtain the cluster sequence number, the previous cluster sequence number, and the timestamp carried by the anomaly instruction cluster corresponding to each event anomaly record; Based on the preceding cluster sequence number, and according to a preset preceding cluster quantity threshold, the preceding instruction cluster set corresponding to the abnormal instruction cluster is obtained through iterative positioning. In the key action sequence pool and / or the key data object pool, respectively obtain the instruction entry set of each preceding instruction cluster in the preceding instruction cluster set and the timestamp carried by the preceding instruction cluster; Based on the timestamp carried by the abnormal instruction cluster and the timestamp carried by each preceding instruction cluster in the preceding instruction cluster set, the preceding instruction cluster set is checked for time sequence to obtain the preceding instruction cluster sequence. Based on the set of instruction entries for each preceding instruction cluster in the preceding instruction cluster sequence, extract the preceding cluster feature information for each preceding instruction cluster. Obtain cluster feature information of the abnormal instruction cluster, perform dependency analysis and / or correlation analysis on multiple preceding cluster feature information and the cluster feature information of the abnormal instruction cluster, and obtain dependency and correlation information between the abnormal instruction cluster and the preceding instruction cluster set. Add the dependency and correlation information to the analysis report and output it.

9. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.

Images