Methods, devices, equipment, and storage media for dynamic security management of server logs

Abstract

A method, apparatus, device, and storage medium for dynamic security management of server logs are disclosed, applied in the field of network security technology. The method includes: collecting and formatting log data; obtaining log behavior sequences through serialization processing; performing streaming analysis based on SAQL rules to obtain instruction recognition results from an instruction recognition model and inference results from an AI behavior model, where the AI ​​behavior model is a pre-trained Transformer model; conducting risk assessment according to a preset risk assessment model to obtain assessment results; if an alarm event is triggered, executing corresponding dynamic security policies based on the risk level of the alarm event, and performing multi-channel alarms and traceable auditing; and iteratively optimizing the model when model optimization is triggered, determining to trigger model optimization if the received alarm feedback is an alarm error or a preset optimization cycle is reached. This achieves real-time detection, early warning, and response to large-scale logs, forming a dynamic security management closed loop.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method, apparatus, device, and storage medium for dynamic security management of server logs. Background Technology

[0002] As server scale continues to expand, massive amounts of log data are generated during operation and maintenance. To improve log collection and management efficiency, the industry commonly adopts the Syslog standard protocol as the unified access protocol for system logs, combined with lightweight log collection tools such as Filebeat Log Collector, to collect server-side logs and aggregate them to the backend storage system. Common log storage and query methods include using relational databases or distributed column-oriented databases (Doris) (such as Apache Doris) to support efficient storage and fast querying of large-scale logs.

[0003] In log analysis, existing technologies widely employ rule-based detection methods, such as using regular expressions, keyword matching, and whitelist / blacklist comparisons to detect abnormal logs and perform security auditing. While these methods are simple to implement, they rely on predefined rules and are difficult to adapt to complex and dynamic server environments.

[0004] In addition, existing solutions have attempted to use machine learning models for log anomaly detection. For example, statistical modeling methods can identify anomalous events by calculating the feature distribution of log sequences; more advanced solutions introduce deep learning models, such as recurrent neural networks (RNNs) and long short-term memory networks (LSTMs), to model the temporal characteristics of logs, thereby detecting log events that do not conform to normal behavior patterns.

[0005] However, these solutions are inefficient in training when dealing with large-scale log data, have difficulty capturing complex contextual semantics, are prone to insufficient detection accuracy, and cannot effectively identify malicious operations disguised by attackers through legitimate commands. They often have high false positive and false negative rates and are difficult to balance with real-time performance. Summary of the Invention

[0006] At least one embodiment of this application provides a method, apparatus, device, and storage medium for dynamic security management of server logs, which addresses the problems of high false alarm and false negative rates and poor real-time performance in the prior art when processing large-scale log data.

[0007] To solve the above-mentioned technical problems, this application is implemented as follows:

[0008] Firstly, this application provides a method for dynamic security management of server logs, including:

[0009] Log data is collected and formatted based on a pre-deployed system log collection component;

[0010] The log data is serialized to obtain a log behavior sequence;

[0011] The log behavior sequence is processed by streaming analysis based on the rules of Streaming Anomaly Query Language (SAQL) to obtain the instruction recognition results and the inference results of the artificial intelligence (AI) behavior model. The AI ​​behavior model is a Transformer model obtained through pre-training.

[0012] Risk assessment is performed based on a preset risk assessment model, the instruction recognition result, and the reasoning result to obtain the assessment result;

[0013] If an alarm event is determined to be triggered based on the assessment results, then a dynamic security policy corresponding to the risk level of the alarm event is executed, and multi-channel alarms and traceable audits are performed based on the alarm event.

[0014] When model optimization is triggered, the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are iteratively optimized. If the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

[0015] Specifically, in the server log dynamic security management method described above, the step of collecting and formatting log data based on the pre-deployed system log collection component includes:

[0016] It receives operating system, application, and security event logs in real time and writes them to a preset local buffer.

[0017] The log data in the local buffer is scanned periodically or in an event-driven manner, and new log entries are formatted and labeled with adaptive tags. The formatting process includes: field splitting, timestamp normalization, log level classification, and character encoding unification.

[0018] Specifically, the server log dynamic security management method described above further includes, before serializing the log data:

[0019] According to the preset transmission strategy, the formatted log data is transmitted through an encrypted transmission channel and written to a distributed columnar database. During the transmission process, preset key field information in the log data is retained and marked.

[0020] The log data written to the columnar database is preprocessed and cleaned to obtain structured or semi-structured log data. The preprocessing and cleaning include: timestamp formatting, data deduplication, missing value supplementation, outlier correction, preset field calibration, and key information extraction and expansion.

[0021] Preferably, in the server log dynamic security management method described above, the step of serializing the log data to obtain a log behavior sequence includes:

[0022] The log data is grouped into entities and formed into an ordered event sequence based on timestamps;

[0023] The log text of each log data in the ordered event sequence is word-embedded and structured fields are concatenated to obtain a log event vector;

[0024] Construct an event dependency graph based on the log event vectors in each ordered event sequence;

[0025] The log behavior sequence is determined based on the ordered event sequence and the event dependency graph.

[0026] Specifically, in the server log dynamic security management method described above, the step of performing streaming analysis on the log behavior sequence based on SAQL rules to obtain the instruction recognition results of the instruction recognition model and the inference results of the AI ​​behavior model includes:

[0027] The log behavior sequence is consumed one by one or in a windowed manner based on a streaming message queue;

[0028] The AI ​​behavior model is invoked to infer the log behavior sequence, and the inference result is obtained.

[0029] The instruction recognition model is invoked to perform instruction recognition on the log behavior sequence, and the instruction recognition result is obtained.

[0030] Furthermore, the dynamic security management method for server logs described above also includes:

[0031] The original AI behavior model is trained based on mask prediction, next event prediction, and the log behavior sequence to obtain the trained AI behavior model.

[0032] Specifically, in the server log dynamic security management method described above, the step of calling the instruction recognition model to perform instruction recognition on the log behavior sequence and obtaining the instruction recognition result includes:

[0033] Based on a preset multi-level transformation strategy, the command text in the log behavior sequence is transformed into a standardized instruction representation;

[0034] The instruction representation is matched based on a preset rule base to obtain a matching Boolean value;

[0035] Based on the high-risk instruction library, the semantic embedding vectors corresponding to the instruction representations are similar to calculate the risk semantic similarity.

[0036] The instruction recognition result is obtained by weighting the matching Boolean value, the risk semantic similarity, and the reasoning result corresponding to the command text.

[0037] Specifically, in the server log dynamic security management method described above, the step of performing a risk assessment based on a preset risk assessment model, the instruction identification result, and the inference result to obtain a risk assessment result includes:

[0038] If the instruction recognition result or the reasoning result exceeds the corresponding threshold, then the risk assessment result is determined to trigger the alarm event.

[0039] Specifically, in the server log dynamic security management method described above, the step of executing a dynamic security policy corresponding to the risk level of the alarm event includes:

[0040] The risk level is obtained by weighting the instruction identification result, the inference result, and the context association strength corresponding to the alarm event. The context association strength is determined based on the event dependency graph in the log behavior sequence.

[0041] The corresponding dynamic security policy is matched and executed according to the risk level.

[0042] Specifically, the dynamic security management method for server logs described above, wherein the multi-channel alerting and traceable auditing based on the alert events includes:

[0043] Structured alarm messages are generated based on the risk level, and the alarm messages are sent through multiple channels.

[0044] The relevant process information of the alarm event will be recorded in the audit log library.

[0045] Specifically, in the server log dynamic security management method described above, the iterative optimization of the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model when model optimization is triggered includes:

[0046] The newly collected log data, alarm events, and / or alarm feedback are stored in the training database and classified and labeled.

[0047] Incremental learning and retraining are performed on the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model based on the training database.

[0048] Preferably, the server log dynamic security management method described above further includes:

[0049] The AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are optimized based on active learning, preset hyperparameter optimization strategies, and / or federated learning.

[0050] Secondly, this application provides a control device for dynamic security management of server logs, including:

[0051] The data acquisition module is used to collect and format log data based on a pre-deployed system log acquisition component;

[0052] The serialization module is used to serialize the log data to obtain a log behavior sequence;

[0053] The streaming processing module is used to perform streaming analysis on the log behavior sequence based on SAQL rules, and to obtain the instruction recognition results of the instruction recognition model and the inference results of the AI ​​behavior model. The AI ​​behavior model is a Transformer model obtained through pre-training.

[0054] The risk assessment module is used to perform risk assessment based on a preset risk assessment model, the instruction recognition result, and the reasoning result, and obtain the assessment result.

[0055] The alarm processing module is used to, if an alarm event is determined to be triggered based on the assessment results, execute a dynamic security policy corresponding to the risk level of the alarm event, and perform multi-channel alarms and traceable audits based on the alarm event.

[0056] The model optimization module is used to iteratively optimize the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model when model optimization is triggered. Specifically, if the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

[0057] Thirdly, this application provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the server log dynamic security management method as described above.

[0058] Fourthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the server log dynamic security management method described above.

[0059] Fifthly, this application provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the server log dynamic security management method described above.

[0060] Sixthly, this application provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the server log dynamic security management method described above.

[0061] Compared with existing technologies, the server log dynamic security management method, apparatus, device, and storage medium provided in this application adopt the Transformer model for deep semantic modeling of logs, which can capture long-distance dependencies and improve the accuracy of anomaly detection. Through the combination of streaming analysis and the Transformer model, real-time detection, early warning, and response to large-scale logs are achieved. By setting up an instruction recognition model for specialized identification and control of high-risk instructions, a security protection upgrade from the log level to the instruction level is achieved. Furthermore, a closed-loop security management system is formed, encompassing log collection, streaming analysis, Transformer model processing, application-layer control, and model optimization. This allows the entire system to dynamically adjust according to changes in the log environment and new attack patterns, improving the reliability of detection results. Attached Figure Description

[0062] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0063] Figure 1 This is one of the flowcharts illustrating the dynamic security management method for server logs in this application;

[0064] Figure 2 This is the second flowchart illustrating the dynamic security management method for server logs in this application.

[0065] Figure 3This is the third flowchart illustrating the dynamic security management method for server logs in this application;

[0066] Figure 4 This is the fourth flowchart illustrating the dynamic security management method for server logs in this application;

[0067] Figure 5 This is the fifth flowchart illustrating the dynamic security management method for server logs in this application;

[0068] Figure 6 This is the sixth flowchart illustrating the dynamic security management method for server logs in this application;

[0069] Figure 7 This is the seventh flowchart illustrating the dynamic security management method for server logs in this application;

[0070] Figure 8 This is the eighth flowchart illustrating the dynamic security management method for server logs in this application;

[0071] Figure 9 This is the ninth flowchart illustrating the dynamic security management method for server logs in this application;

[0072] Figure 10 This is a schematic diagram of the control device for dynamic security management of server logs in this application.

[0073] Figure 11 This is a schematic diagram of the structure of the electronic device of this application. Detailed Implementation

[0074] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0075] The terms “first,” “second,” etc., used in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus. The terms “and / or” in the specification and claims indicate at least one of the connected objects.

[0076] See Figure 1 This application provides a method for dynamic security management of server logs, including:

[0077] Step S101: Collect and format log data based on the pre-deployed system log collection component;

[0078] Step S102: Serialize the log data to obtain a log behavior sequence;

[0079] Step S103: Perform streaming analysis on the log behavior sequence based on SAQL rules to obtain the instruction recognition result of the instruction recognition model and the inference result of the AI ​​behavior model. The AI ​​behavior model is a Transformer model obtained through pre-training.

[0080] Step S104: Perform a risk assessment based on the preset risk assessment model, the instruction recognition result, and the reasoning result to obtain the assessment result;

[0081] Step S105: If an alarm event is determined to be triggered based on the assessment result, then a dynamic security policy corresponding to the risk level of the alarm event is executed, and multi-channel alarms and traceable audits are performed based on the alarm event.

[0082] Step S106: When model optimization is triggered, the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are iteratively optimized. If the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

[0083] This embodiment discloses a dynamic security management method for server logs. Specifically, it discloses that log data is collected and formatted based on a pre-deployed system log collection component to ensure the real-time acquisition and unified formatting of massive logs. It also provides a reliable data foundation for the entire dynamic security management of server logs, enabling subsequent streaming analysis, AI behavior model inference, and high-risk command identification to run efficiently and accurately.

[0084] After obtaining the log data, the log data will be serialized to obtain a structured or semi-structured log behavior sequence, which can accurately reflect the complete behavior trajectory of a user, process or operation, thereby improving query or retrieval efficiency and facilitating subsequent processing by AI behavior models, etc.

[0085] Subsequently, the log behavior sequence can be stream-analyzed based on SAQL rules. This involves consuming the log stream through streaming processing and invoking an AI behavior model and an instruction recognition model for behavior inference and instruction recognition, respectively, to obtain the corresponding inference and instruction recognition results. The AI ​​behavior model is a pre-trained Transformer model. By combining the Transformer model's context-dependent inference capabilities with SAQL's streaming query mechanism, millisecond-level real-time log detection is achieved, transforming static anomaly analysis into dynamic security control and providing real-time security protection for intelligent log management. Simultaneously, it innovatively introduces an instruction recognition model into log management, overcoming the current inability to effectively identify malicious operations disguised as legitimate commands by attackers, and facilitating finer-grained risk identification and security control. Furthermore, the streaming architecture ensures that the system maintains linear scalability and high availability even when facing log surges.

[0086] Furthermore, by using a risk assessment model to conduct risk assessment based on the instruction recognition and reasoning results, a multi-dimensional risk assessment can be achieved by integrating the instruction recognition and reasoning results. This approach combines the advantages of AI behavior models and instruction recognition models, ensuring that the risk assessment is both real-time and accurate. This effectively improves the log security management level in enterprise environments and facilitates more accurate, secure, efficient, and intelligent system protection.

[0087] If an alarm event is determined to be triggered based on the assessment results, the risk level corresponding to the alarm event can be obtained based on the identification and reasoning results of the instruction. A dynamic security policy corresponding to the risk level will then be executed. This allows for automatic implementation of corresponding defensive measures based on the risk level after an alarm event is detected, ensuring the real-time nature and accuracy of dynamic security control and avoiding situations where insufficient control leads to unavoidable risks or excessive control results in wasted resources. Furthermore, multi-channel alerts and traceable audits will be conducted based on the alarm event to achieve rapid alarm transmission and joint prevention and control through collaboration with third parties. Simultaneously, traceable audits ensure the reliability of subsequent compliance reviews, incident debriefing, and legal evidence collection.

[0088] Subsequently, if model optimization is triggered, the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are iteratively optimized. This ensures dynamic updates of detection capabilities in the face of rapidly evolving attack methods, overcoming the technical shortcomings of existing log analysis and security detection systems, such as lack of adaptability and decreased detection capabilities due to model aging. The methods by which model optimization is triggered include, but are not limited to, periodic triggering and time-based triggering. Specifically, if the alarm feedback received after manual review is deemed an error or a preset optimization cycle has been reached, model optimization is triggered, thus achieving a closed-loop alarm feedback system and driving continuous system evolution.

[0089] In one embodiment, alarm errors can be further divided into false alarms and false negatives, and corresponding model optimizations are performed based on false alarms and false negatives. In one embodiment, when an alarm is a "false alarm", model optimization is achieved by automatically adjusting the threshold or feature weights; when an alarm is a "false negative", model optimization is achieved by supplementing new rules or updating model parameters, thereby improving the accuracy of detection and control.

[0090] In summary, the technical solution of this application employs the Transformer model for deep semantic modeling of logs during dynamic server log management, enabling the capture of long-distance dependencies and improving the accuracy of anomaly detection. By combining streaming analysis with the Transformer model, real-time detection, early warning, and response to large-scale logs are achieved. Specialized identification and control of high-risk commands through a command recognition model achieves a security upgrade from the log level to the command level. Furthermore, a closed-loop security management system is formed, encompassing log collection, streaming analysis, Transformer model processing, application-layer control, and model optimization. This allows the entire system to dynamically adjust according to changes in the log environment and new attack patterns, enhancing the reliability of detection results.

[0091] See Figure 2Specifically, in the server log dynamic security management method described above, the collection and formatting of log data based on the pre-deployed system log collection component includes:

[0092] Step S201: Receive operating system, application, and security event logs in real time and write them to a preset local buffer;

[0093] Step S202: Periodically or event-driven scan the log data in the local buffer, and format the newly added log entries and attach adaptive tags. The formatting process includes: field splitting, timestamp normalization, log level classification, and character encoding unification.

[0094] In this implementation, the steps for collecting and formatting the log data are illustrated. The system log collection component in this application includes a Syslog service and a lightweight log collection agent, Filebeat. During actual operation, by starting the Syslog service in the operating system kernel or user space, the Syslog service can receive operating system, application, and security event logs in real time and write them to a unified local buffer, ensuring that log data is captured the moment it is generated. Filebeat, as the log collection agent, is deployed on the same server or edge node. It specifies the collection path and log type (e.g., system directory var, subdirectory log, log messages, application log directory, etc.) through a YAML file (where YAML is a highly human-readable data serialization language specifically used for configuration files and data exchange). It periodically or in an event-driven manner scans the log files, reads new log entries, and performs preliminary formatting, including field splitting, timestamp normalization, log level classification, and necessary character encoding unification, ensuring consistency and availability for subsequent analysis and processing.

[0095] Specifically, during the log data formatting process, Filebeat parses each log entry into a structured JSON object. Key fields include timestamp, host (log source host), process (process name), log level, and message (log body or content). Custom tags (such as business type and service name) can also be attached, forming a unified data structure for subsequent storage and analysis. By standardizing and tagging log fields, and initially labeling them at the collection layer using event type and risk tags, high-quality input data is provided for AI behavior models and command recognition models.

[0096] See Figure 3 Specifically, the server log dynamic security management method described above further includes, before serializing the log data, the following steps:

[0097] Step S301: According to the preset transmission strategy, the formatted log data is transmitted through an encrypted transmission channel and written to a distributed columnar database. During the transmission process, preset key field information in the log data is retained and marked.

[0098] Step S302: Preprocess and clean the log data written to the columnar database to obtain structured or semi-structured log data. The preprocessing and cleaning includes: timestamp formatting, data deduplication, missing value supplementation, outlier correction, preset field calibration, and key information extraction and expansion.

[0099] In this embodiment, before serializing the log data, to avoid the impact of invalid or disorganized data on serialization efficiency and accuracy, the log data is stored in a distributed columnar database for preprocessing and cleaning. Specifically, firstly, according to a preset transmission strategy (e.g., real-time streaming or batch-size triggering), the formatted log data is transmitted to the log receiving gateway via an encrypted transmission channel (e.g., a Transmission Control Protocol (TCP) connection using Transport Layer Security (TLS) / Secure Sockets Layer (SSL)) to ensure data integrity and security across network environments. During transmission, key fields are retained and marked in the log data packets, including the log timestamp, source host_id, process identifier_id, user ID, log severity, log message, and AI preliminary risk_tag. The risk_tag field is initially generated by additional custom tags in the formatting step during the data acquisition phase, indicating the risk category that the log may involve, such as "command execution," "authentication failure," or "file writing." After receiving data, the log receiving gateway decompresses the data, verifies field integrity, and detects packet loss. Valid data is then written to a distributed table in the distributed columnar database (Doris). As a columnar database, Doris supports efficient writing and querying of large-scale logs. Data is organized according to partition keys (e.g., date, source host) and sort keys (e.g., timestamps) to ensure query performance. During this process, the system can also provide data smoothing and replay mechanisms through streaming buffer queues (e.g., Kafka / Flink as optional intermediate layers) to avoid data loss or database write blocking during log surge scenarios.

[0100] The above transmission steps standardize and embed risk tags in key fields during log transmission, ensuring that subsequent AI behavior models can directly use log data as input for training and inference, reducing additional cleaning overhead. Furthermore, by introducing a high-performance storage structure based on distributed columnar storage at the database level, the performance of querying and streaming analysis of massive log data is significantly improved, enabling millisecond-level real-time detection and risk warning when combined with the Transformer model and SAQL streaming analysis engine.

[0101] After log data is securely written to a distributed columnar database, preprocessing and cleaning operations are performed before the log data enters the analysis stage (generally triggered after data writing or before real-time streaming queries, and usually implemented by a data pipeline service or cleaning module). Its main task is to standardize, denoise, and enhance the structure of the raw logs to ensure data quality and consistency.

[0102] In terms of specific implementation, firstly, the timestamp field in the logs is standardized, unifying the various time formats used by different source systems (such as International Organization for Standardization 8601 (ISO 8601), Unix timestamps, date strings with time zones, etc.) into a unified Coordinated Universal Time (UTC) for subsequent time series analysis. Secondly, duplicate log entries are deduplicated, for example, by using hash verification or primary key combinations (such as host_id+process_id+timestamp+message) to generate unique identifiers, preventing duplicate data from polluting the analysis results due to multi-path log collection or retry mechanisms. Thirdly, missing or outlier fields are filled or corrected. For example, a missing user ID field can be marked as "unknown_user", and default values ​​can be set and anomaly labels recorded for abnormal process IDs or host IDs, so that the model can learn the distribution of missing features. Next, the log severity level and risk tag are recalibrated: for example, synonyms such as "warn," "warning," and "caution" in syslog are unified to "WARNING," and a shallow scan of the log text is performed based on keyword matching and a rule engine to provide additional initial annotation assistance for the AI ​​behavior model. Furthermore, regular expression parsing and natural language segmentation are performed on the log message to extract key information fragments (such as user operation commands, target file paths, IP addresses, and port numbers), and this information is written into extended fields (such as command, file_path, ip_address, and port), thereby transforming unstructured logs into semi-structured or structured data that can be used for deep learning modeling. Finally, the cleaned data is written back to the preprocessing table of the distributed columnar database or directly input into the subsequent AI behavior model via a streaming pipeline.

[0103] In this data preprocessing and cleaning process, by introducing multi-level field standardization and key semantic extraction mechanisms, the traditional log cleaning method, which was limited to format uniformity, is upgraded to a preprocessing workflow that supports deep semantic modeling. This provides higher-quality data input with richer semantic information for the subsequent training and inference of Transformer models (such as LogBERT). At the same time, through the gradual enhancement of risk labels, the system has the ability to learn adaptively, which can improve the model's discrimination accuracy in the early stages. This ensures that even with diverse log data sources and complex formats, a unified and reliable data foundation can still be provided for AI behavior reasoning and command recognition.

[0104] See Figure 4 Preferably, in the server log dynamic security management method described above, the step of serializing the log data to obtain a log behavior sequence includes:

[0105] Step S401: Group the log data into entities and form an ordered event sequence based on timestamps;

[0106] Step S402: The log text of each log data in the ordered event sequence is word-embedded and structured fields are concatenated to obtain a log event vector;

[0107] Step S403: Construct an event dependency graph based on the log event vectors in each ordered event sequence;

[0108] Step S404: Determine the log behavior sequence based on the ordered event sequence and the event dependency graph.

[0109] This embodiment illustrates the serialization process described above. After obtaining log data, especially log data that has been preprocessed and cleaned, the discretized and structured log events are organized into time series and / or behavioral graph structures that can be used for deep learning modeling. This is specifically performed before entering the AI ​​behavioral model, for example, through a centralized log processing platform or a distributed streaming computing engine.

[0110] The specific steps of serialization processing include: First, based on a preset entity such as "user ID, session ID, process ID, or host ID" as a grouping key, the log data is grouped into entity groups, and an ordered event sequence is formed according to the timestamp, so as to ensure that each ordered event sequence can reflect the complete behavioral trajectory of a certain user, a certain process, or a certain operation session; specifically, it can be represented as follows: ,in, For timestamps, This represents the event feature vector, composed of cleaned key fields, including log severity, host ID, process name, user ID, and the segmented log message embedding. Indicates the number of logs.

[0111] Furthermore, to support the AI ​​behavior model's learning of semantics and context, word embedding encoding is performed on the log text (message field). This can be achieved using a word vector model (Word to Vector, Word2Vec) or Bidirectional Encoder Representations from Transformers (BERT), converting the text into a vectorized representation and concatenating it with structured fields to obtain the log event vector. The log sequence at this point can be represented as follows: ,in, This represents the semantic embedding of log messages. This represents the event feature vector, and `Embed()` is the embedding function. Based on this, the system can construct sequences of different granularities according to business scenarios. For example, short sequences can be constructed from command execution logs of a single user and single session to detect abnormal operations; long sequences can be constructed from long-term logs at the host level to discover persistent attack patterns or latent behaviors.

[0112] Then, this embodiment also introduces an Event Dependency Graph (EDG), which is constructed using the log event vectors in the ordered event sequence. In the EDG, nodes are log events, and edges represent temporal or causal relationships between events, using an adjacency matrix. Indicates an event and The dependency ratio, this mechanism can help capture potential anomalous patterns across time spans in subsequent models.

[0113] Through the aforementioned serialization process, not only was the log data simply serialized over time, but a joint representation of multi-level sequences and event dependency graphs was also introduced. This ensures that subsequent AI behavior models can learn both linear temporal features and capture cross-sequence contextual dependencies. Simultaneously, semantic embedding and structured field concatenation significantly enhance the input data's ability to express anomalous behavioral features. This guarantees the effective functioning of subsequent Transformer-based AI behavior models, overcoming the difficulty of expressing complex attack behaviors using traditional rule-based or statistical log sequence construction methods.

[0114] See Figure 5 Specifically, in the server log dynamic security management method described above, the step of performing streaming analysis on the log behavior sequence based on SAQL rules to obtain the instruction recognition results of the instruction recognition model and the inference results of the AI ​​behavior model includes:

[0115] Step S501: Consume the log behavior sequence one by one or in a windowed manner based on the streaming message queue;

[0116] Step S502: Invoke the AI ​​behavior model to infer the log behavior sequence and obtain the inference result;

[0117] Step S503: Call the instruction recognition model to perform instruction recognition on the log behavior sequence to obtain the instruction recognition result.

[0118] This embodiment illustrates the above-described streaming analysis and processing steps. Preferably, these steps consist of a distributed stream computing engine and a real-time detection service (e.g., a SAQL-based query engine and data processing frameworks like Flink or Kafka). This engine is responsible for real-time processing and anomaly detection of the continuously flowing log stream. This step is executed immediately after the log data is stored in the database, and the runtime environment is the real-time computing layer of the log big data platform. In specific implementation, the obtained log behavior sequence is pushed as a log stream to a streaming message queue (such as KafkaTopic), where the streaming analysis unit consumes the log behavior sequence in real time. Subsequently, based on the detection rules and model call interfaces defined by the streaming query language SAQL, the log stream is processed either line by line or in a windowed manner. The windowing mechanism uses a sliding window or rolling window algorithm to divide log events into time intervals, such as a 5-second sliding window, ensuring that abnormal behavior can be captured in near real-time.

[0119] In the actual detection process, both the AI ​​behavior model and the instruction recognition model are invoked simultaneously. The AI ​​behavior model infers the result based on the input log behavior sequence, which is represented by an anomaly score in this embodiment. The instruction recognition model is invoked to identify the instruction, which is represented by a risk score in this embodiment.

[0120] Furthermore, contextual analysis can be performed. When multiple log events originate from the same user or host within a short time window, and the cumulative anomaly score exceeds a threshold, it is identified as potential intrusion behavior, triggering a higher-level alert. This mechanism effectively avoids false alarms caused by single points of failure, improving the accuracy and robustness of detection.

[0121] By combining the inference capabilities of the Transformer model with the streaming query mechanism of SAQL, millisecond-level real-time detection of logs is achieved. At the same time, it supports three detection methods based on rules, models, and context, enabling the system to detect known attacks, unknown attacks, and combined attacks.

[0122] Furthermore, the dynamic security management method for server logs described above also includes:

[0123] The original AI behavior model is trained based on mask prediction, next event prediction, and the log behavior sequence to obtain the trained AI behavior model.

[0124] In this embodiment, the training process of the AI ​​behavior model is briefly illustrated. Preferably, the AI ​​behavior model is obtained by performing model training and modeling on the log behavior sequence data obtained above through a deep learning platform or dedicated training module (offline training is performed during initial model deployment, and incremental training can be performed periodically or in real-time during operation). It utilizes deep learning methods to model the behavioral patterns of users, processes, and the system in server logs, thereby identifying the differences between normal and abnormal behaviors. The AI ​​behavior model uses a pre-trained model based on the Transformer architecture (such as LogBERT) to train the training data (log behavior sequence). Its training process can be divided into two parts: first, the log fields and semantic information are transformed into high-dimensional vector representations through a log event embedding layer, and the message field is encoded using Word2Vec or BERT word embedding methods; second, long-term dependencies in the sequence are modeled through a multi-head self-attention (MHSA) mechanism, the core calculation formula of which can be expressed as:

[0125]

[0126] Among them, These represent the query, key, and value matrices, respectively. This is the dimensional scaling factor. This mechanism can capture the contextual dependencies and semantic patterns between log events, thereby identifying potential anomalous behavior patterns.

[0127] During the training phase, masked event prediction and next event prediction tasks are employed. By randomly hiding some log events and requiring the model to predict the missing content or the next possible log event, the normal distribution characteristics of log behavior sequences are learned. After training, a deep model capable of characterizing normal log behavior patterns—the AI ​​behavior model—is obtained. By introducing Transformer models such as LogBERT, compared to traditional rule-based or RNN-based methods, it is possible to better capture the complex dependencies and contextual information in long-sequence logs.

[0128] During the inference phase, when a new log sequence is input into the model, the model calculates its difference from the learned normal patterns and outputs the inference result (AnomalyScore), which can be calculated using the following formula:

[0129]

[0130] in This represents the probability that the model predicts for the next event. If the probability is lower than a threshold, it is judged as abnormal behavior or potentially high-risk operation.

[0131] This step ensures that the AI ​​behavior model can not only "understand" logs, but also "understand" the potential risks behind the behavior, enabling the system to have efficient and intelligent anomaly detection and behavior modeling capabilities.

[0132] See Figure 6 Specifically, in the server log dynamic security management method described above, the step of calling the instruction recognition model to perform instruction recognition on the log behavior sequence and obtaining the instruction recognition result includes:

[0133] Step S601: Based on a preset multi-level conversion strategy, the command text in the log behavior sequence is converted into a standardized instruction representation.

[0134] Step S602: Match the instruction representation based on a preset rule base to obtain a matching Boolean value;

[0135] Step S603: Calculate the similarity of the semantic embedding vectors corresponding to the instruction representations based on the high-risk instruction library to obtain the risk semantic similarity.

[0136] Step S604: Perform a weighted calculation based on the matching Boolean value, the risk semantic similarity, and the reasoning result corresponding to the command text to obtain the instruction recognition result.

[0137] In this implementation, the steps for command recognition model to perform command recognition are illustrated. First, the command recognition model (preferably composed of a command parser and a risk recognition module) is responsible for identifying and classifying the specific commands and operations in the log sequence. This step is executed synchronously during the AI ​​model inference stage and is used to further map the detected abnormal behavior into interpretable high-risk command events. The deployment location is usually in the security detection layer of the log analysis platform.

[0138] The specific steps are as follows: First, the log text and / or structured command field "command" in the log behavior sequence are input into the command recognition model. The command recognition model adopts a multi-level transformation strategy of regular expression matching, command syntax tree parsing and semantic embedding to transform the command text in the original log into a standardized command representation. For example, `rm-rf / ` and `sudochmod777` are parsed into operation type (file deletion / permission modification) and target object (root directory / system configuration file).

[0139] After parsing, the instruction representation is judged. The judgment logic includes two categories: First, based on a preset rule base for rapid detection, the standardized instruction representation is matched against known high-risk command patterns (such as `wgethttp: / / malicious address`, `nc-lp`, `useraddroot`) in the preset rule base to obtain a matching Boolean value. If the instruction representation matches a high-risk pattern, it is directly marked as a high-risk event, and the matching Boolean value is 1. Second, based on a high-risk instruction database, the semantic embedding vector corresponding to the instruction representation is used to calculate the similarity (preferably cosine similarity) to obtain the risk semantic similarity. The calculation formula can be expressed as:

[0140]

[0141] in, Indicates semantic similarity of risk. Let R represent the embedding vector of the command to be detected, and let R represent the vector set in the high-risk command library. This indicates that the instruction vector tells me if If the threshold is exceeded, the command is determined to be semantically similar to a high-risk instruction;

[0142] Then, the instruction recognition result can be obtained by weighting the matching Boolean value, risk semantic similarity, and the reasoning result corresponding to the command text. The specific calculation formula can be expressed as follows:

[0143]

[0144] in, Indicates the instruction recognition result (risk score); Indicates the result of reasoning; Indicates matching Boolean values; Indicates semantic similarity of risks; , , These represent the corresponding weights; among them, context detection based on AI behavior models can determine whether a command belongs to a potential new type of risk operation by calculating the anomaly score of the command in the behavior sequence and the semantic similarity of the risk.

[0145] Traditional systems often rely solely on static rule matching, making it difficult to identify novel variant attack commands. This application, however, employs a triple mechanism of rule base, AI behavioral model, and risk semantic similarity to not only detect known high-risk commands but also identify novel high-risk operations with similar semantics or abnormal context. Furthermore, it introduces a quantitative scoring mechanism for command recognition results, making the results interpretable and scalable, facilitating the execution of refined response strategies in subsequent dynamic management stages. This step enables the system to transform abstract abnormal behavior analysis into concrete high-risk command identification, constructing a crucial bridge from log behavior modeling to actual risk protection.

[0146] Specifically, in the server log dynamic security management method described above, the step of performing a risk assessment based on a preset risk assessment model, the instruction identification result, and the inference result to obtain a risk assessment result includes:

[0147] If the instruction recognition result or the reasoning result exceeds the corresponding threshold, then the risk assessment result is determined to trigger the alarm event.

[0148] In this embodiment, the specific content of the risk assessment described above is illustrated. The obtained instruction recognition results and inference results are merged and judged in real time. If either of them exceeds the corresponding threshold, an anomaly is determined, and an alarm event is triggered. Only when neither exceeds the corresponding threshold is no anomaly determined, and no alarm event is triggered. This step can be specifically represented as follows:

[0149]

[0150] in, This indicates the risk assessment result, where 1 indicates that an alarm event has been triggered, and 0 indicates that no alarm event has been triggered. and These represent the thresholds corresponding to the reasoning result and the instruction recognition result, respectively.

[0151] See Figure 7 Specifically, in the server log dynamic security management method described above, the step of executing a dynamic security policy corresponding to the risk level of the alarm event includes:

[0152] Step S701: The risk level is obtained by weighted calculation based on the instruction identification result, the inference result and the context association strength corresponding to the alarm event. The context association strength is determined based on the event dependency graph in the log behavior sequence.

[0153] Step S702: Match the corresponding dynamic security policy according to the risk level and execute it.

[0154] In this embodiment, after determining that an alarm event has been triggered, a weighted calculation is performed based on multiple dimensions, including the instruction identification result, reasoning result, and contextual association strength corresponding to the alarm event, to obtain the comprehensive risk level. The calculation formula can be expressed as follows:

[0155]

[0156] in, The comprehensive risk value is represented and mapped to a predefined risk level range (such as low, medium, high, and severe levels) to obtain the corresponding risk level, which can be used to internally mark the threat level of the event. Indicates the strength of contextual association; , and These represent the corresponding weight parameters, which are preferably determined through optimization using a training set and expert experience. The methods for obtaining instruction recognition and inference results have been disclosed above. For the context association strength, it is preferably determined based on the event dependency graph in the log behavior sequence, specifically represented as the weights of the edges in the event dependency graph. The calculation methods include, but are not limited to, graph embedding or PageRank algorithms. In another embodiment, the context connection strength can also be calculated based on semantic similarity, the probability of transition states, or attention mechanisms.

[0157] Once the risk level is obtained, a corresponding dynamic security policy can be matched and executed based on the risk level. In one specific embodiment, when an event is assessed as low risk, only logs and alarm records are generated for security personnel to analyze afterward. When an event is of medium risk, the system will trigger lightweight intervention measures, such as temporarily freezing account sessions or requiring users to re-authenticate. When an event is of high risk or severe risk, the system will automatically issue blocking instructions, such as calling firewalls, host agents, or container management tools through the Application Programming Interface (API), to immediately terminate high-risk processes, isolate hosts, or cut off network connections, thereby achieving an immediate defense closed loop.

[0158] By introducing a dynamic security management and risk adaptive assessment mechanism, the system can automatically take defensive measures after detecting potential threats. Furthermore, the multi-dimensional risk scoring mechanism can integrate the advantages of AI behavior modeling and rule detection, ensuring that risk assessment is both real-time and accurate, effectively improving the level of security management in enterprise environments.

[0159] See Figure 8 Specifically, in the server log dynamic security management method described above, the step of performing multi-channel alerts and traceable audits based on the alarm events includes:

[0160] Step S801: Generate a structured alarm message based on the risk level and send the alarm message through multiple channels;

[0161] Step S802: Record the alarm event-related process information in the audit log database.

[0162] In this embodiment, the steps of multi-channel alerting and traceable auditing based on the alarm event are illustrated. First, after determining the triggering alarm event and obtaining the corresponding risk level, a structured alarm message is generated based on the risk level. The content of the alarm message includes: event time, source host, user identity, triggering command, risk score, control measures, etc. The alarm message can be pushed to different channels according to the risk level, such as email, SMS, instant messaging tools (such as DingTalk, Slack (a team collaboration and communication platform)), Security Information and Event Management (SIEM) system, or Security Operations Center (SOC) console. It also supports linkage with third-party operation and maintenance or security platforms through network callbacks or webhooks (a "publish-subscribe" mechanism) to achieve rapid alarm transmission and joint prevention and control.

[0163] Then, all relevant process information regarding the alarm event, such as the alarm event and control operations, will be fully recorded in the audit log database. Further optimization will employ a blockchain-based tamper-proof mechanism or a log hash chain based on a Merkle Tree to ensure the logs' immutability and verifiability. Each event record includes a unique event ID, the original log sequence, the inference result of the AI ​​behavior model, the risk level calculation process, dynamic control actions, and records of manual intervention, ensuring the reliability of subsequent compliance reviews, incident debriefings, and legal evidence collection. Simultaneously, timeline tracing is supported, enabling the display of the entire attack chain from initial abnormal behavior to high-risk command execution and control measures, achieving a clear reconstruction of the attack path.

[0164] See Figure 9 Specifically, in the server log dynamic security management method described above, the iterative optimization of the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model when model optimization is triggered includes:

[0165] Step S901: Store the newly collected log data, alarm events and / or alarm feedback into the training database, and classify and label them;

[0166] Step S902: Incremental learning and retraining are performed on the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model based on the training database.

[0167] This embodiment also provides an example of the steps for iteratively optimizing the AI ​​behavior model and the risk assessment model. When model optimization is triggered, newly collected log data, alarm events, and / or alarm feedback are stored in the training database and categorized and labeled. Specifically, log samples can be divided into three categories—normal behavior, known anomalies, and high-risk instructions—using data labeling tools. Unlabeled samples are retained for unsupervised training. Then, based on the training database, incremental learning and retraining are performed on the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model. A method combining Transformer models (such as LogBERT) and graph neural networks is used to optimize sequence feature and context dependency modeling capabilities.

[0168] Preferably, the server log dynamic security management method described above further includes:

[0169] The AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are optimized based on active learning, preset hyperparameter optimization strategies, and / or federated learning.

[0170] In another embodiment of this application, AI behavior models, instruction recognition models, and / or risk assessment models are optimized by introducing active learning, preset hyperparameter optimization strategies, and / or federated learning. Specifically, model optimization is based on active learning. Specifically, when the prediction uncertainty of the target model for certain log samples is higher than a threshold, it will be actively pushed to security personnel for labeling, so as to maximize the improvement of model performance with limited human input.

[0171] Model optimization based on federated learning specifically involves using a transfer learning and federated learning framework to share model weights and anomaly patterns across different data centers or customer environments without directly exchanging raw log data, thereby improving the model's generalization ability and privacy protection level.

[0172] Model optimization is based on hyperparameter optimization strategies. Specifically, this can involve introducing an automated hyperparameter tuning engine (AutoML) to automatically adjust parameters such as the number of layers, attention heads, and learning rate of the Transformer model through Bayesian optimization, genetic algorithms, or reinforcement learning methods, ensuring optimal model performance in real-world deployment environments. After training, the new model will gradually replace the old model through a phased rollout, ensuring consistency and stability of the detection results.

[0173] The various methods of the embodiments of this application have been described above. Apparatus for implementing the above methods will now be provided.

[0174] Please refer to Figure 10 Another embodiment of this application provides a control device for dynamic security management of server logs, including:

[0175] Data acquisition module 1001 is used to collect and format log data based on a pre-deployed system log acquisition component;

[0176] Serialization module 1002 is used to serialize the log data to obtain a log behavior sequence;

[0177] The streaming processing module 1003 is used to perform streaming analysis processing on the log behavior sequence based on SAQL rules, and to obtain the instruction recognition result of the instruction recognition model and the inference result of the AI ​​behavior model. The AI ​​behavior model is a Transformer model obtained through pre-training.

[0178] Risk assessment module 1004 is used to perform risk assessment based on a preset risk assessment model, the instruction recognition result, and the reasoning result, and obtain the assessment result;

[0179] The alarm processing module 1005 is used to, if an alarm event is determined to be triggered based on the assessment result, execute a dynamic security policy corresponding to the risk level of the alarm event, and perform multi-channel alarms and traceable audits based on the alarm event.

[0180] The model optimization module 1006 is used to iteratively optimize the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model when model optimization is triggered. If the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

[0181] Specifically, in the control device described above, the data acquisition module includes:

[0182] The first processing submodule is used to receive operating system, application and security event logs in real time and write them to a preset local buffer.

[0183] The second processing submodule is used to periodically or event-drivenly scan the log data in the local buffer, and to format the newly added log entries and attach adaptive tags. The formatting process includes: field splitting, timestamp normalization, log level classification, and character encoding unification.

[0184] Specifically, the control device described above also includes:

[0185] The data transmission module is used to transmit and write formatted log data into a distributed columnar database through an encrypted transmission channel according to a preset transmission strategy. During the transmission process, preset key field information in the log data is retained and marked.

[0186] The data preprocessing module is used to preprocess and clean the log data written to the columnar database to obtain structured or semi-structured log data. The preprocessing and cleaning include: timestamp formatting, data deduplication, missing value supplementation, outlier correction, preset field calibration, and key information extraction and expansion.

[0187] Preferably, in the control device described above, the serialization module includes:

[0188] The third processing submodule is used to group the log data into entities and form an ordered event sequence based on timestamps;

[0189] The fourth processing submodule is used to perform word embedding encoding and structured field concatenation on the log text of each log data in the ordered event sequence to obtain a log event vector;

[0190] The fifth processing submodule is used to construct an event dependency graph based on the log event vectors in each ordered event sequence;

[0191] The sixth processing submodule is used to determine the log behavior sequence based on the ordered event sequence and the event dependency graph.

[0192] Specifically, in the control device described above, the streaming processing module includes:

[0193] The seventh processing submodule is used to consume the log behavior sequence one by one or in a windowed manner based on a streaming message queue;

[0194] The eighth processing submodule is used to call the AI ​​behavior model to infer the log behavior sequence and obtain the inference result;

[0195] The ninth processing submodule is used to call the instruction recognition model to perform instruction recognition on the log behavior sequence and obtain the instruction recognition result.

[0196] Furthermore, the control device described above also includes:

[0197] The model training module is used to train the original AI behavior model based on mask prediction, next event prediction, and the log behavior sequence to obtain the trained AI behavior model.

[0198] Specifically, in the control device described above, the ninth processing submodule includes:

[0199] The first processing unit is used to convert the command text in the log behavior sequence into a standardized instruction representation based on a preset multi-level conversion strategy.

[0200] The second processing unit is used to match the instruction representation based on a preset rule base to obtain a matching Boolean value;

[0201] The third processing unit is used to calculate the similarity of the semantic embedding vector corresponding to the instruction representation based on the high-risk instruction library to obtain the risk semantic similarity.

[0202] The fourth processing unit is used to perform a weighted calculation based on the matching Boolean value, the risk semantic similarity, and the reasoning result corresponding to the command text to obtain the instruction recognition result.

[0203] Specifically, in the control device described above, the risk assessment module includes:

[0204] The tenth processing submodule is used to determine that the risk assessment result is the triggering event for the alarm if the instruction recognition result or the reasoning result exceeds the corresponding threshold.

[0205] Specifically, in the control device described above, the alarm processing module includes:

[0206] The eleventh processing submodule is used to perform a weighted calculation based on the instruction identification result, the inference result, and the context association strength corresponding to the alarm event to obtain the risk level. The context association strength is determined based on the event dependency graph in the log behavior sequence.

[0207] The twelfth processing submodule is used to match and execute the corresponding dynamic security policy based on the risk level.

[0208] Specifically, in the control device described above, the alarm processing module further includes:

[0209] The thirteenth processing submodule is used to generate a structured alarm message based on the risk level and send the alarm message through multiple channels;

[0210] The fourteenth processing submodule is used to record the relevant process information of the alarm event in the audit log library.

[0211] Specifically, in the control device described above, the model optimization module includes:

[0212] The fifteenth processing submodule is used to store the newly collected log data, alarm events and / or alarm feedback into the training database, and perform classification and labeling.

[0213] The sixteenth processing submodule is used to perform incremental learning and retraining on the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model based on the training database.

[0214] Preferably, the control device described above further includes:

[0215] The seventeenth processing submodule is used to optimize the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model based on active learning, preset hyperparameter optimization strategies, and / or federated learning.

[0216] The apparatus embodiments of this application are apparatuses corresponding to the embodiments of the methods described above. All implementation means in the method embodiments described above are applicable to the apparatus embodiments and can achieve the same technical effects. The apparatus provided in this application embodiments can implement all the method steps implemented in the method embodiments described above and can achieve the same technical effects. Therefore, the parts and beneficial effects that are the same as those in the method embodiments in this embodiment will not be described in detail here.

[0217] See Figure 11 Another embodiment of this application provides an electronic device 11, including: a processor 1101, a memory 1102, and a program stored in the memory 1102 and executable on the processor 1101. When the program is executed by the processor 1101, it implements the steps of the server log dynamic security management method described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0218] Another embodiment of this application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the server log dynamic security management method described above and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0219] Another embodiment of this application provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the steps of the server log dynamic security management method described above and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0220] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0221] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0222] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for dynamic security management of server logs, characterized in that, include: Log data is collected and formatted based on a pre-deployed system log collection component; The log data is serialized to obtain a log behavior sequence; The log behavior sequence is stream-analyzed based on the rules of the Streaming Security Query Language (SAQL) to obtain the instruction recognition results of the instruction recognition model and the inference results of the artificial intelligence (AI) behavior model. The AI ​​behavior model is a Transformer model that has been pre-trained. Risk assessment is performed based on a preset risk assessment model, the instruction recognition result, and the reasoning result to obtain the assessment result; If an alarm event is determined to be triggered based on the assessment results, then a dynamic security policy corresponding to the risk level of the alarm event is executed, and multi-channel alarms and traceable audits are performed based on the alarm event. When model optimization is triggered, the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model are iteratively optimized. If the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

2. The server log dynamic security management method according to claim 1, characterized in that, The serialization process of the log data to obtain a log behavior sequence includes: The log data is grouped into entities and formed into an ordered event sequence based on timestamps; The log text of each log data in the ordered event sequence is word-embedded and structured fields are concatenated to obtain a log event vector; Construct an event dependency graph based on the log event vectors in each ordered event sequence; The log behavior sequence is determined based on the ordered event sequence and the event dependency graph.

3. The server log dynamic security management method according to claim 1, characterized in that, The streaming analysis of the log behavior sequence based on SAQL rules to obtain the instruction recognition results of the instruction recognition model and the inference results of the AI ​​behavior model includes: The log behavior sequence is consumed one by one or in a windowed manner based on a streaming message queue; The AI ​​behavior model is invoked to infer the log behavior sequence, and the inference result is obtained. The instruction recognition model is invoked to perform instruction recognition on the log behavior sequence, and the instruction recognition result is obtained.

4. The server log dynamic security management method according to claim 3, characterized in that, The step of calling the instruction recognition model to perform instruction recognition on the log behavior sequence and obtaining the instruction recognition result includes: Based on a preset multi-level transformation strategy, the command text in the log behavior sequence is transformed into a standardized instruction representation; The instruction representation is matched based on a preset rule base to obtain a matching Boolean value; Based on the high-risk instruction library, the semantic embedding vectors corresponding to the instruction representations are similar to calculate the risk semantic similarity. The instruction recognition result is obtained by weighting the matching Boolean value, the risk semantic similarity, and the reasoning result corresponding to the command text.

5. The server log dynamic security management method according to claim 1, characterized in that, The step of executing a dynamic security policy corresponding to the risk level of the alarm event includes: The risk level is obtained by weighting the instruction identification result, the inference result, and the context association strength corresponding to the alarm event. The context association strength is determined based on the event dependency graph in the log behavior sequence. The corresponding dynamic security policy is matched and executed according to the risk level.

6. The server log dynamic security management method according to claim 1 or 5, characterized in that, The multi-channel alerting and traceable auditing based on the alarm events includes: Structured alarm messages are generated based on the risk level, and the alarm messages are sent through multiple channels. The relevant process information of the alarm event will be recorded in the audit log library.

7. The server log dynamic security management method according to claim 6, characterized in that, The iterative optimization of the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model, triggered by model optimization, includes: The newly collected log data, alarm events, and / or alarm feedback are stored in the training database and classified and labeled. Incremental learning and retraining are performed on the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model based on the training database.

8. A control device for dynamic security management of server logs, characterized in that, include: The data acquisition module is used to collect and format log data based on a pre-deployed system log acquisition component; The serialization module is used to serialize the log data to obtain a log behavior sequence; The streaming processing module is used to perform streaming analysis on the log behavior sequence based on SAQL rules, and to obtain the instruction recognition results of the instruction recognition model and the inference results of the AI ​​behavior model. The AI ​​behavior model is a Transformer model obtained through pre-training. The risk assessment module is used to perform risk assessment based on a preset risk assessment model, the instruction recognition result, and the reasoning result, and obtain the assessment result. The alarm processing module is used to, if an alarm event is determined to be triggered based on the assessment results, execute a dynamic security policy corresponding to the risk level of the alarm event, and perform multi-channel alarms and traceable audits based on the alarm event. The model optimization module is used to iteratively optimize the AI ​​behavior model, the instruction recognition model, and / or the risk assessment model when model optimization is triggered. Specifically, if the received alarm feedback is an alarm error or a preset optimization period is reached, the model optimization is determined to be triggered.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the server log dynamic security management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the server log dynamic security management method as described in any one of claims 1 to 7.

Images