A network security analysis method and system based on system log audit analysis

Abstract

The application discloses a network security analysis method and system based on system log audit analysis, and relates to the technical field of log audit analysis. The method comprises the following steps: obtaining original log data of each device and business system in a network through a multi-source heterogeneous log collection engine, obtaining an original data set, adaptively normalizing the original data set, generating a standardized audit event item, and obtaining a processing data set. The application automatically identifies the log source type and matches the optimal analysis template through log type feature fingerprint identification, message header fixed field set, keyword co-occurrence vector and regular expression structure feature triplets, and weighted cosine similarity matching. When the matching fails, the initial analysis template is automatically clustered and generated through density clustering or variational autoencoder, and is included in the rule library after being confirmed by an artificial person, so that the new device log is plug-and-play, and the artificial maintenance cost and response delay are greatly reduced.

Description

Technical Field

[0001] This invention relates to the field of log auditing and analysis technology, specifically to a network security analysis method and system based on system log auditing and analysis. Background Technology

[0002] Cybersecurity analysis refers to the systematic inspection and evaluation of network systems, information systems, and their data to identify security risks, discover potential threats, analyze attack behaviors, and formulate corresponding protection strategies. This includes: threat identification (detecting potential malware, vulnerabilities, and cyberattacks); risk assessment (assessing the severity of security threats to the system and the potential losses); log analysis (tracking abnormal behavior by analyzing logs from network devices, servers, and applications); incident response (analyzing security incidents to determine the source and scope of attacks and proposing remediation measures); penetration testing (simulating attacker methods to test the system and discover potential weaknesses); and compliance checks (ensuring the system complies with relevant security standards and regulations, and safeguarding system and data security).

[0003] A log auditing analysis method and system, disclosed in patent publication number CN118939701A, utilizes a data mapping and transformation model constructed with reinforcement learning algorithms. This model enables automated data mapping and transformation of log data from different data sources, converting heterogeneous data into homogeneous data and improving the efficiency of log auditing analysis. Furthermore, a log characteristic initial classification model and a log attribute secondary classification model constructed with machine learning algorithms perform initial classification of large volumes of real-time log data based on log characteristics and secondary classification based on log attributes. This allows for unified processing and analysis of log data with similar characteristics and attributes, further enhancing the efficiency of log auditing analysis. This approach is more suitable for large-scale data scenarios, improving practicality and reducing costs. Finally, a log auditing analysis model constructed with deep learning algorithms can uncover deeper data features in log data, enabling accurate and efficient log auditing analysis and reducing the error rate.

[0004] Traditional log auditing and analysis methods in network security management generally rely on static rule bases and fixed thresholds for anomaly detection. However, log formats generated by different network devices, operating systems, and business applications vary greatly. Existing systems require manual configuration of parsing rules for each log source. When new device types are added to the network environment or business systems are upgraded, parsing strategies need to be redeveloped, resulting in huge maintenance costs and time delays. At the same time, for increasingly complex advanced persistent threats and multi-stage coordinated attacks, simple rule matching is difficult to find the real attack chains hidden in a large number of normal events. Security operations teams often face massive amounts of alarm information, with a large number of false alarms and invalid alarms drowning out real security threats and seriously affecting emergency response efficiency. Summary of the Invention

[0005] The purpose of this invention is to provide a network security analysis method and system based on system log audit analysis to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, this invention provides the following technical solution: a network security analysis method based on system log audit analysis, comprising: acquiring raw log data from various devices and business systems in the network through a multi-source heterogeneous log collection engine to obtain a raw dataset; performing adaptive normalization processing on the raw dataset to generate standardized audit event items to obtain a processed dataset; based on the processed dataset, constructing a dynamic correlation analysis model using a graph neural network to output correlated threat events to obtain an output threat event set; introducing a dynamic confidence assessment mechanism based on reinforcement learning to construct a Markov decision process; and learning the optimal confidence scoring strategy and alarm threshold adjustment strategy through a deep Q-network to obtain a strategy adjustment... The confidence score is used to characterize the probability estimate that an associated threat event belongs to a real attack behavior. A first threshold and a second threshold are set. Alarms with a confidence score below the first threshold are automatically downgraded to observation events, alarms with a confidence score above the second threshold are upgraded to emergency events, and alarms with a confidence score between the first and second thresholds are marked as events to be analyzed. This dynamically balances the false alarm rate and false negative rate of security analysis to obtain a set of security warning events. Handling strategies are issued to the set of security warning events, including automatic blocking strategies and manual analysis strategies, resulting in strategy issuance items. Feedback is collected on the handling results, and the positive and negative samples are fed back to the graph neural network and reinforcement learning model for incremental training and parameter updates.

[0007] Furthermore, the method for obtaining the original dataset includes: The multi-source heterogeneous log collection engine simultaneously enables Syslog protocol reception, Kafka message queue subscription, WebAPI interface call, and file disk read methods to aggregate the collected raw log data into a distributed message queue. Each raw log data is then labeled with a source tag according to the collection channel, resulting in the raw dataset.

[0008] Furthermore, the method for obtaining the processed dataset includes: For each original log data in the original dataset, log type feature fingerprint identification is performed. The feature fingerprint consists of a fixed set of fields in the log message header, a keyword co-occurrence vector in the log message body, and a regular expression structure feature triplet of the overall format of the log line. The extracted feature fingerprint is matched with the fingerprint features of each rule template in the pre-set rule template library. The rule template with the highest similarity is selected as the matching result to generate standardized audit event items. All standardized audit event items constitute the processing dataset.

[0009] Furthermore, the method for obtaining the output threat event set includes: Using a sliding time window of preset length as the processing unit, a standardized audit event item set within the current time window is extracted from the processing dataset. Using events in the standardized audit event item set as edges and IP addresses, user accounts, and device resources appearing in the events as nodes, a heterogeneous graph structure is constructed. Feature vectors are initialized for each user account node and each device resource node in the heterogeneous graph structure. The heterogeneous graph structure is then input into a relational graph attention network for node embedding updates. After obtaining the updated embedding representations of all nodes, each connected subgraph in the heterogeneous graph structure is extracted. Each connected subgraph is compared with a pre-constructed baseline graph of normal business behavior, and anomaly scores are calculated for each connected subgraph. Connected subgraphs with anomaly scores exceeding a preset anomaly score threshold are marked as associated threat events. The event edge sequences contained in the associated threat events are extracted and arranged in chronological order to form a multi-stage attack behavior chain. All associated threat events constitute the output threat event set.

[0010] Furthermore, the method for obtaining the strategy adjustment item includes: Each associated threat event in the output threat event set is taken as the object to be evaluated, and a Markov decision process quadruple (S, A, P, R) is constructed, where S represents the state space, A represents the action space, P represents the state transition probability function, and R represents the reward function. Each state in the state space S is composed of three parts: the feature vector of the associated threat event, the feature vector of the current network environment context, and the feature vector of the external threat intelligence. The action space A includes threshold adjustment actions with continuous values ​​and level determination actions with discrete values. The optimal state-action value function Q(s, a) is learned through a deep Q-network. The deep Q-network takes state s as input and outputs the Q-value estimate corresponding to each action in the action space A. The action with the largest Q-value is selected as the optimal action to be executed in the current state. The training of the deep Q-network adopts an experience replay mechanism and a target network mechanism.

[0011] Furthermore, the deep Q-network has a three-layer fully connected neural network structure, including: The system consists of an input layer, hidden layers, and an output layer. The number of neurons in the input layer is equal to the dimension of the state space S. The hidden layer contains two sub-layers: the first sub-layer contains 256 neurons and uses the ReLU activation function, and the second sub-layer contains 128 neurons and uses the ReLU activation function. The number of neurons in the output layer is equal to the number of discrete actions in the action space A. The output layer does not use an activation function and directly outputs the Q-value estimate corresponding to each action.

[0012] Furthermore, the method for obtaining the security warning event set includes: When the confidence score is greater than or equal to 0 and less than or equal to the first threshold, the corresponding alarm is marked as an observation event. When the confidence score is greater than the first threshold and less than the second threshold, the corresponding alarm is marked as an event to be analyzed. When the confidence score is greater than or equal to the second threshold and less than or equal to 1, the corresponding alarm is marked as an emergency event.

[0013] Furthermore, the method for obtaining the policy-issued items includes: For security alerts marked as emergency events, an automatic blocking policy is automatically issued through a unified handling strategy engine that links network security devices. For security alerts marked as events to be assessed, a manual assessment suggestion policy is pushed to the terminal devices of security operations personnel. This policy includes alert details, a topology diagram of the associated attack behavior chain, a confidence score, and suggested handling actions. Security operations personnel can then manually confirm whether to execute the blocking, allowing, or ignoring operation through a visual interface. The execution results of the handling policy are collected, including the success or failure status of the blocking command, the number of reconnection attempts of the threat source IP address within a preset time period after blocking, and the difference in abnormal traffic changes of the target IP address before and after blocking.

[0014] A network security analysis system based on system log audit analysis, using the aforementioned network security analysis method based on system log audit analysis, includes: The multi-source heterogeneous log collection module acquires raw log data from various devices and business systems in the network through the multi-source heterogeneous log collection engine and aggregates it into a raw dataset. The adaptive normalization processing module is equipped with a log type fingerprinting engine, a rule template matching engine, and a rule self-generation engine. It performs adaptive normalization processing on the original dataset to generate standardized audit event items and obtain the processed dataset. The graph neural network dynamic association analysis module is equipped with a heterogeneous graph construction unit, a relational graph attention network computing unit, a baseline graph storage unit, and an abnormal connected subgraph detection unit. It constructs a heterogeneous graph from the processed dataset in a sliding time window and updates the node embedding through the relational graph attention network, outputting a set of associated threat events. The reinforcement learning dynamic confidence assessment module is equipped with a deep Q-network inference unit, a state feature encoding unit, and a threshold adaptive adjustment unit. It calculates confidence scores for the set of associated threat events and adaptively adjusts the alarm threshold to generate a set of security alarm events. The linkage response and closed-loop feedback module is equipped with a strategy execution engine unit, an alarm hierarchical push unit, and a feedback sample collection unit. It issues response strategies to the security alarm event set and collects the response results to the graph neural network dynamic correlation analysis module and the reinforcement learning dynamic confidence evaluation module for incremental training and parameter updates.

[0015] Compared with the prior art, the beneficial effects of the present invention are: This network security analysis method and system based on system log audit analysis uses log type feature fingerprint recognition, which is composed of a fixed set of message header fields, keyword co-occurrence vectors, and regular expression structural feature triples, and is matched with weighted cosine similarity. It automatically identifies the log source type and matches the optimal parsing template. When a match cannot be found, it automatically clusters the logs using density clustering or variational autoencoder and generates an initial parsing template. After manual confirmation, the template is incorporated into the rule base. This enables plug-and-play use of logs from new devices, significantly reducing manual maintenance costs and response latency.

[0016] Meanwhile, to address the shortcomings of complex threats such as APT attacks being difficult to detect using static rules, standardized log events are constructed into a heterogeneous graph containing three types of nodes: IP, user account, and device resources. By using a relational graph attention network combined with a time decay factor to learn the temporal and causal relationships between events, multi-stage attack behavior chains are automatically extracted, enabling the effective detection of attack patterns with long incubation periods and complex paths. Attached Figure Description

[0017] Figure 1 This is a schematic diagram showing the overall process of the present invention; Figure 2 This is a schematic diagram illustrating the graph neural network association analysis of the present invention; Figure 3 This is a schematic diagram of the alarm classification and closed-loop feedback of the present invention; Figure 4 This is a schematic diagram of the algorithm model hierarchy and training mechanism of the present invention; Figure 5 This is a schematic diagram of the alarm confidence distribution and threshold division of the present invention; Figure 6 This is a schematic diagram illustrating the evolution of event sequence anomaly scores in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Traditional log auditing and analysis methods in network security management generally rely on static rule bases and fixed thresholds for anomaly detection. However, the log formats generated by different network devices, operating systems, and business applications vary greatly, posing a significant challenge to existing log analysis systems. Existing systems require manual configuration of parsing rules for each log source. This means that when new device types are added to the network environment or business systems are upgraded, parsing strategies need to be redeveloped, resulting in significant maintenance costs and time delays, severely impacting the timeliness of security protection. Furthermore, against increasingly complex Advanced Persistent Threats (APTs) and multi-stage coordinated attacks, simple rule matching methods struggle to uncover the true attack chains hidden within a large number of seemingly normal events. APT attacks are often characterized by long incubation periods, complex attack paths, and the use of multiple technical means, making traditional signature-based detection methods ineffective. Attackers may utilize legitimate system tools or business processes to make their behavior appear normal, thus bypassing static rule detection. In this context, security operations teams often face massive amounts of alert information. Due to the limitations of rules and the complexity of log data, the system generates… The generation of numerous false alarms and invalid alerts not only obscures genuine security threats but also significantly increases the workload of security analysts, requiring them to spend considerable time and effort to sift through these alerts. This severely reduces incident response efficiency and may even cause them to miss actual attack events, resulting in substantial losses. The technical solution provided in this application, however, utilizes log type feature fingerprinting. This fingerprinting, composed of a fixed set of message header fields, keyword co-occurrence vectors, and regular expression structural feature triples, is matched with weighted cosine similarity to automatically identify the log source type and match the optimal parsing template. When a match cannot be found... By automatically clustering logs using density clustering or variational autoencoders and generating initial parsing templates, which are then manually verified and incorporated into the rule base, new device logs are made plug-and-play, significantly reducing manual maintenance costs and response latency. Addressing the weakness of static rules in detecting complex threats such as APT attacks, standardized log events are constructed into a heterogeneous graph containing three types of nodes: IP, user accounts, and device resources. A relational graph attention network combined with a time decay factor is used to learn the temporal and causal relationships between events, automatically extracting multi-stage attack behavior chains. This enables the effective detection of attack patterns with long latency periods and complex paths. Figure 1 As shown, it includes steps 100-600.

[0020] Step 100: Obtain the raw log data of various devices and business systems in the network through the multi-source heterogeneous log collection engine to obtain the raw dataset.

[0021] It is important to note that the methods for obtaining the raw dataset include: simultaneously enabling the Syslog protocol receiving method, Kafka message queue subscription method, WebAPI interface call method, and file disk read method among the multi-source heterogeneous log collection engines. The Syslog protocol receiving method is used to collect network device logs and security device logs that support the standard Syslog protocol. The Kafka message queue subscription method is used to collect distributed system logs and application logs pushed in the form of message queues. The WebAPI interface call method is used to collect cloud platform logs and SaaS service logs that support RESTful API interfaces. The file disk read method is used to collect operating system logs and database audit logs stored locally in the form of text files or binary files. The collected raw log data is aggregated into a distributed message queue, and a source tag is attached to each raw log data according to the source of the collection channel. The source tag includes the collector ID, device IP, device type, and collection timestamp to obtain the raw dataset.

[0022] Specifically, the Syslog protocol receiving method is as follows: The engine starts a standard Syslog daemon, such as rsyslog or syslog-ng, listening on UDP port 514 or TCP port 6514 for TLS encrypted transmission. This daemon conforms to the RFC 5424 or RFC 3164 protocol specifications and receives log messages actively pushed from network devices that support the Syslog protocol, such as Cisco routers, switches, and security devices, such as Palo Alto firewalls and Sangfor AF. Each Syslog message contains a PRI priority field, a HEADER timestamp + hostname field, and an MSG message body field. After receiving the message, the receiving module parses the PRI value to calculate the facility code and severity level, extracts the timestamp and hostname from the HEADER, and temporarily stores the MSG field as raw data to be processed. The Kafka message queue subscription method is as follows: The engine has a built-in Kafka consumer client, using the Java or Python Kafka Client library, and configures the connection parameters with the Kafka cluster, including the bootstrap.servers address, group.id consumer group ID, and auto.offset.The reset start offset strategy involves consumers subscribing to one or more predefined topics, such as system-logs, app-audit, and security-events, and pulling message batches from partitions using long polling. The poll operation has a default timeout of 5000ms. Each message's key and value are byte arrays, with the value carrying JSON or Avro serialized log data from the business system. After receiving a message, the consumer extracts the topic name, partition number, and offset from the message metadata for subsequent offset commits and fault recovery. The Web API interface is called via an embedded HTTP client based on the OkHttp or Requests library, following the RESTful API provided by the target cloud platform or SaaS service. The API specification constructs HTTPS requests with authentication tokens. Specifically, for log retrieval interfaces that support pagination, the engine retrieves log data page by page by sending GET requests with time range and pagination parameters in a loop. Upon receiving a page response, it parses the log record array, extracts the values ​​of each field, and updates the time range endpoint to the maximum log time retrieved so that it can be used for the next polling. Regarding file disk read / write methods: the engine's file monitoring module listens for file creation, modification, and rotation events in specified directories, such as / var / log / , / var / log / audit / , and database audit log directories, based on the operating system's file event notification mechanism. When new content is detected written to a target file, the engine opens the file in read-only mode and reads the new content line by line, starting from the last read offset. For text-format logs, such as Apache access logs and Linuxauth.log, it uses line-by-line splitting and parsing. For binary-format logs, such as MySQL... For binlog, the format version needs to be identified based on the magic word in the file header, and each log entry needs to be deserialized according to event type. After obtaining the raw log data, each collection channel sends the data to a distributed message queue in a unified message format, using an Apache Kafka or RabbitMQ aggregation topic, such as raw-logs-topic. Before sending, the collection engine adds a source tag to each log entry, including the collector ID, device IP, device type, and collection timestamp.

[0023] Step 200: Perform adaptive normalization on the original dataset to generate standardized audit event items, thus obtaining the processed dataset.

[0024] It is important to note that, such as Figure 2As shown, the method for obtaining the dataset includes: performing log type feature fingerprint recognition on each original log data in the original dataset. The feature fingerprint consists of a fixed set of fields in the log message header, a keyword co-occurrence vector in the log message body, and a regular expression structure feature triplet representing the overall format of the log line. The extracted feature fingerprint is then compared with the fingerprint features of each rule template in a pre-set rule template library. The similarity matching uses a weighted cosine similarity algorithm, where the matching weight for log message header fields is 0.4, the keyword co-occurrence vector matching weight is 0.35, and the regular expression structure feature matching weight is 0.25. The rule template with the highest similarity is selected as the matching result. A template matching confidence threshold is set; if the highest similarity is greater than or equal to the preset template matching confidence threshold, then... Based on the field mapping relationships defined in the matched rule template, the values ​​of each standardized field are extracted from the original log data. If the highest similarity is less than the template matching confidence threshold, the rule self-generation process is initiated. The original log data format is clustered using density clustering algorithm or variational autoencoder. Logs with the same field delimiter, the same keyword order, and the same numerical distribution pattern are grouped into one category. The field boundaries and semantics of the category are automatically identified, and an initial parsing rule template is generated. The initial parsing rule template is output to the operation and maintenance terminal for manual confirmation and annotation. After confirmation, it is included in the rule template library. The extracted standardized field values ​​are assembled according to the preset standardized data structure to generate standardized audit event items. All standardized audit event items constitute the processing dataset.

[0025] Specifically, in the method for extracting the feature fingerprint triplet, the fixed set of fields in the log message header is as follows: For Syslog format logs, extract the PRI value, such as "<134>", the timestamp format, such as "Jun 10 10:30:15" or "2025-06-10T10:30:15Z", and the hostname field; for JSON format logs pulled by WebAPI, take the set of all field names of the JSON root node as the fixed field set; for plain text logs, such as Apache access logs, take the fixed format part at the beginning of the line, such as "127.0.0.1 - - [10 / Jun / 2025:10:30:15 [+0000]”, Keyword co-occurrence vector in the log message body: After segmenting the log message body by spaces and punctuation, stop words such as “the”, “of”, “at”, etc. are filtered out, and the frequency of the remaining words is counted. A keyword union of all log types in the preset rule template library with a preset dictionary length is constructed. For example, it contains the co-occurrence vector of 1000 common words such as “DENY”, “ALLOW”, “TCP”, “UDP”, “src”, “dst”, “user”, “file”, “error”, “warning”, etc. The i-th dimension of the vector is the TF value of the word in the current log. Regular expression structure features of the overall format of the log line: Variable fields in the log message body, such as IP address, numeric port number, timestamp, and file path, are replaced with the corresponding placeholder tokens <IP>, <NUM>, <TIME>, and <PATH>, respectively, to obtain a structural skeleton string. For example, the original log “src=10.0.0.5 dst=8.8.8.8 proto=TCP sport=54321” is replaced with “src=<IP> In the weighted cosine similarity matching algorithm, dst="<IP>", proto="<WORD>", and sport="<NUM>", the feature fingerprint of the log to be matched is vector F_new, and the feature fingerprint of a template in the rule template library is vector F_template. The cosine similarity between the two on three sub-features are sim_header (message header similarity), sim_keyword (keyword co-occurrence vector similarity), and sim_structure (regular structure similarity), calculated as follows: sim_header = (size of the intersection of fixed field sets) / (size of the union of fixed field sets), sim_keyword = (F_new_keyword · F_template_keyword) / (||F_new_keyword|| × ||F_template_keyword||), sim_structure = (edit distance similarity of the structural skeleton string = 1 - Levenshtein distance / max(len1, len2), weighted total similarity S_total = 0.4 × sim_header + 0.35 × sim_keyword + 0.25 × sim_ The template matching confidence threshold is set to 0.75, based on the empirical benchmark of industry rule matching systems. The typical threshold range is 0.70-0.85. Below 0.75, the false match rate increases sharply; above 0.75, the rejection rate for new logs is too high. When the highest similarity is <0.75, rule self-generation is initiated. The DBSCAN clustering algorithm is configured as follows: Neighborhood radius eps: By calculating the edit distance distribution between all pairs of original log samples, the 25th percentile of the distance distribution histogram is taken as eps, ensuring that 25% of sample pairs are less than this value to guarantee intra-cluster compactness. The algorithm implementation is as follows: randomly sample 1000 log pairs, calculate the edit distance, and sort them... The 250th value is taken after the sequence; the minimum number of samples, minPts, is fixed at 3 to avoid grouping noise points into separate classes; the distance metric is normalized edit distance, which is the edit distance divided by the maximum length of two log messages, ensuring comparability between long and short logs. If a variational autoencoder (VAE) is used, the input is a character-level one-hot encoded sequence of the log message, taking the first 512 characters and padding with zeros if necessary. The encoder outputs a 128-dimensional latent variable, the decoder reconstructs the input sequence, and clustering is performed using K-Means in the latent variable space. The K value is determined by the elbow rule, grouping logs with similar latent variables into one class. For the set of log samples of the same class after clustering, the following operations are performed. The process involves calculating the entropy of character positions, aligning all log messages in the set by left alignment at the beginning of each line, and analyzing the character type distribution at each position. Character types are categorized into five types: numeric, uppercase, lowercase, symbol, and space. The entropy value of position p is H(p) = -Σ_{type∈5}P(type,p)×log2(P(type,p)). When H(p) < 0.5, the position is considered a fixed character position; when H(p) ≥ 0.5, it is considered a variable character position. Field separators and field boundaries are also identified: a continuous sequence of variable character positions constitutes a variable field, and a continuous sequence of fixed character positions constitutes a fixed field. For example, the log entry "src=10.0.0.5 dst=8.8.8".The character position statistics of "8" will identify "src=" and "dst=" as fixed fields (keywords), while "10.0.0.5" and "8.8.8.8" are variable fields; field semantic inference: for each identified variable field, semantic classification is performed based on its content characteristics. If the field value matches the IP address regular expression ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ and each segment is within the range of 0-255, it is marked as an IP address class. If the field value is a pure number and falls within the range of 1-65535, it should be labeled as a port number. If the field value conforms to the ISO 8601 time format or the Unix timestamp format, it is marked as a timestamp. If the field value is less than or equal to 32 characters and contains only letters, it is labeled as a username string. If the field value is a high entropy value, the information entropy is >4.0, meaning the character distribution is highly random, such as "a7f9e2c1", it is labeled as a hash / identifier class; Initial template assembly: The identified fixed field names, such as "src=", are used as keys, and the corresponding variable field semantic types, such as "IP address class", are used as values ​​to assemble a key-semantic type mapping table. At the same time, the separators between the fields, such as spaces, are recorded. This mapping table is the initial parsing rule template.

[0026] Step 300: Based on the processed dataset, construct a dynamic correlation analysis model using a graph neural network, output correlated threat events, and obtain the output threat event set.

[0027] It is important to note that, such as Figure 6As shown, the method for obtaining the output threat event set includes: using a sliding time window of a preset length as the processing unit, extracting a standardized audit event item set within the current time window from the processing dataset; and constructing a heterogeneous graph structure G=(V, E, ...) using events in the standardized audit event item set as edges and IP addresses, user accounts, and device resources appearing in the events as nodes. R), where V represents the set of entity nodes, E represents the set of event edges, and R represents the set of edge types. Edge types include at least event temporal relationship types and event causal relationship types. A feature vector is initialized for each IP address node in the heterogeneous graph structure. The IP address node feature vector includes the connection initiation frequency, connection reception frequency, connection destination port entropy value, uplink / downlink traffic ratio, and geolocation tag encoding value of the IP address within the current time window. A feature vector is initialized for each user account node in the heterogeneous graph structure. The user account node feature vector includes the login count, login time period distribution entropy value, operation command category distribution entropy value, and access resource sensitivity level distribution value of the user account within the current time window. A feature vector is initialized for each device resource node in the heterogeneous graph structure. The device resource node feature vector includes the number of open ports of the device, the set of running service category encodings, and the maximum historical vulnerability score. The heterogeneous graph structure is input into the relational graph attention network for node embedding and updating. The relational graph attention network independently calculates the attention coefficient between nodes for each relation type r. The outputs of multiple attention heads are concatenated to obtain the updated embedding representation of each node. A time decay factor is introduced into the calculation formula of the attention coefficient, so that the event edge that occurs earlier within the time window is given a lower weight and the event edge that occurs later is given a higher weight. The expression of the time decay factor is λ(Δt)=exp(-γ·Δt), where Δt represents the time difference of the event edge relative to the end of the current time window, and γ is a preset decay coefficient. After obtaining the updated embedding representation of all nodes, each connected subgraph in the heterogeneous graph structure is extracted. Each connected subgraph is compared with the pre-constructed normal business behavior baseline graph, and the anomaly score of each connected subgraph is calculated. The anomaly score is the structural deviation measure between the adjacency matrix of the connected subgraph and the expected adjacency matrix of the corresponding node pair in the baseline graph. Connected subgraphs with anomaly scores exceeding the preset anomaly score threshold are marked as associated threat events. The event edge sequence contained in the associated threat events is extracted and arranged in chronological order to form a multi-stage attack behavior chain. All associated threat events constitute the output threat event set.

[0028] Specifically, the scheduling logic of the sliding time window is as follows: The system maintains a circular buffer to store the most recent L minutes of standardized audit event items. The default window length L is 15 minutes. The window sliding step size is fixed at 50% of the window length, that is, it slides once every 7.5 minutes. The window overlap rate is 50% to ensure that the attack chain is not cut off by the window boundary. Each time it slides, the oldest 50% of the data in the window is discarded and the new 50% of the data is included. The construction rules for nodes and edges are as follows: IP address nodes: Extract the src_ip and dst_ip fields from each standardized audit event item, and create or reference the corresponding IP nodes respectively. If the same IP address appears multiple times in the window, the same node ID is reused. User account nodes: Extract the us... The `user_name` field, if `user_name` is NULL, generates an "Anonymous User" node in the format "ANON_<src_ip>", preserving the context of the user's operation. Device resource nodes: Extract the `object` field; if `object` is a file path, database table name, or URL, create a resource node. Event edges: Generate one event edge for each standardized audit event item, with the direction from the initiator to the receiver, e.g., `src_ip→dst_ip`, or `user→resource`. The edge type `R` is determined by `event_type`: `DENY / ALLOW` for "network access event", `DOWNLOAD / UPLO` for "network access event". AD stands for "File Operation Event", LOGIN / LOGOUT stands for "Authentication Event". The detailed calculation method for node feature vectors is as follows: IP address node feature vector: Count the number of times the IP appears as the src_ip within the window, normalized to [0,1]. Count the number of times the IP appears as the dst_ip, also normalized. Collect all dst_port values ​​accessed when the IP is used as the src, calculate the entropy value H_ports=-Σ(p_i×log2p_i), where p_i is the frequency of accessing the i-th type of port, and normalize again to [0,1]. An entropy value close to 1 indicates a dispersed port distribution, while a value close to 0 indicates a concentrated port distribution. Uplink / Downlink traffic ratio: Number of uplink events / Number of downlink events, take the logarithm. After compression, the sigmoid function is mapped to [0,1]. Geographic location tag encoding: The country / region code (e.g., CN / US) of the IP address is obtained from the GeoIP database and encoded into a 5-dimensional vector using one-hot encoding, selecting the top 5 regions. User account node feature vector, dimension = 8, includes login count: the number of LOGIN events for the user within the window, normalized; Login time period distribution entropy: The 24 hours of a day are divided into 8 time periods, each 3 hours long, and the distribution of login events in each time period is statistically analyzed, the entropy value is calculated, and then normalized; Operation command category distribution entropy value: The frequency of operation types (read / write / execute / delete / control) is statistically analyzed, and the entropy value is calculated and normalized.Access sensitivity level distribution values: Resources are tagged with sensitivity levels according to a preset dictionary: 0 = Public, 1 = Internal, 2 = Confidential, 3 = Top Secret. Access frequency for each level is statistically analyzed, weighted averaged, and then normalized. Device resource node feature vectors, dimension 6, include: Number of open ports: Queryed from the asset management database and normalized; Set of running service category codes: The top 3 most frequently run services, such as HTTP / SSH / MySQL, are selected, one-hot encoded as 3-dimensional; Maximum historical vulnerability score: Queryed from the CVE database for the maximum CVSS score of known vulnerabilities for this device and normalized.

[0029] Specifically, regarding the attention coefficients, the attention coefficients for node i and its neighbor node j under relation type r are as follows: ; Where h_i and h_j are the feature vectors of the current layer nodes, the first layer is the initial feature vector with dimension d=64, obtained by node initialization, W_r is the learnable weight matrix of relation type r with dimension d'×d, d'=64, consistent with the output dimension, initialized using Xavier, and updated through backpropagation during training, a_r is the learnable attention weight vector of relation type r with dimension 2d'×1, i.e. 128×1, also obtained through training, the negative slope of LeakyReLU is 0.2, used to introduce nonlinearity, λ(Δt)=exp(-γ·Δt), γ=0.01 (preset decay coefficient, corresponding to a half-life of about 100 seconds), Δt is in seconds. For example, the edge weight that occurred 10 seconds ago was exp(-0.1)=0.905, decreased to exp(-1)=0.368 100 seconds ago, and decreased to exp(-3)=0.050 300 seconds ago. Multi-head attention merging: K=4 heads are used to balance computational efficiency and expressiveness. Each head independently calculates α_ij,k^(r) and W_r^k. The final node update is as follows: ; Where σ is the ELU activation function, the output dimension is 4×64=256 dimensions, and then the 256 dimensions are compressed back to 64 dimensions through a linear projection layer, which is used as the output of this layer and input into the next layer. A total of 2 layers are stacked. The expected adjacency matrix of the baseline graph: For node pair (u,v) under relation type r, the baseline graph stores an expected occurrence frequency freq_base(u,v,r) = (number of times the event edge between the node pair occurs in the normal period of the past 30 days) / (total duration of 30 days / window duration), and also stores the expected time interval mean μ_Δt and standard deviation σ_Δt. The actual adjacency matrix of the connected subgraph of the current window: calculate the actual occurrence frequency of node pair (u,v) in the window freq_win(u,v,r). The structural deviation metric, i.e., the anomaly score, is calculated as follows: ; Where Frobenius bias = ||A_win-A_base||F / (|V|²), and temporal bias = (1 / |E_win|)×Σ{e∈E_win}|Δt_e-μ_Δt| / σ_Δt, A_win represents the actual adjacency matrix of the current window, A_base represents the expected adjacency matrix of the baseline graph, E_win represents the set of event edges in the current window, Δt_e represents the time interval of event edge e, μ_Δt represents the mean time interval of the node to the event edge in the baseline, and σ_Δt represents the standard deviation of the time interval of the node to the event edge in the baseline. When Score > 0.7, a preset anomaly threshold is set. Based on the normal distribution 3σ principle, when the bias exceeds 3 times the standard deviation of the baseline mean, an anomaly is determined, and the connected subgraph is marked as an associated threat event.

[0030] Step 400: Introduce a dynamic confidence assessment mechanism based on reinforcement learning, construct a Markov decision process, and learn the optimal confidence scoring strategy and alarm threshold adjustment strategy through a deep Q-network to obtain the strategy adjustment term.

[0031] It is important to note that, such as Figure 4As shown, the method for obtaining policy adjustment items includes: taking each associated threat event in the output threat event set as the object to be evaluated, constructing a Markov decision process quadruple (S, A, P, R), where S represents the state space, A represents the action space, P represents the state transition probability function, and R represents the reward function. Each state in the state space S is composed of three parts: the feature vector of the associated threat event, the feature vector of the current network environment context, and the feature vector of the external threat intelligence. The feature vector of the associated threat event includes the number of event edges contained in the event, the number of IP address nodes involved, the length of the time span, the anomaly score, and the completeness score of the attack behavior chain. The feature vector of the current network environment context includes the current time period type code, the current business type code, and the current target asset importance level code. The feature vector of the external threat intelligence includes the external reputation score of the attack source IP in the event and the MITRE corresponding to the attack behavior pattern in the event. The ATT&CK tactical phase coding and global activity index of similar threat events, action space A includes continuously valued threshold adjustment actions and discretely valued level determination actions. Threshold adjustment actions include raising, lowering, or keeping the first and second thresholds unchanged within a preset range, with a single adjustment step size of a preset fixed step size. Level determination actions involve adjusting the confidence score of the current associated threat event to the target level. The reward function R is defined as follows: when an associated threat event is correctly determined to be a real attack and its confidence score is higher than the second threshold and correctly upgraded to an emergency event, a positive reward is given. A reward of +1.0 is given when an associated threat event is incorrectly identified as a real attack but is actually a false alarm and its confidence score is higher than the second threshold, thus being mistakenly upgraded to an emergency event. A negative reward of -1.5 is given when an associated threat event is a real attack but its confidence score is lower than the first threshold, thus being mistakenly downgraded to an observation event and causing a missed report. A negative reward of -2.0 is given when an associated threat event is a harmless event and its confidence score is lower than the first threshold, thus being correctly downgraded to an observation event. A positive reward of +0.5 is given when the goal is to maximize the cumulative discount reward. The optimal state-action value function Q(s, a) is learned through a deep Q-network. The deep Q-network takes state s as input and outputs the Q-value estimate corresponding to each action in the action space A. The action with the largest Q-value is selected as the optimal action to be executed in the current state. The training of the deep Q-network adopts an experience replay mechanism and a target network mechanism.

[0032] Specifically, the feature vector dimension of the associated threat event is 7: Number of event edges: the total number of event edges contained in the associated threat event extracted from the output threat event set, normalized to [0,1]; Number of IP nodes involved: the number of IP nodes in the connected subgraph, normalized; Time span length: the time difference between the earliest and latest events in the subgraph, normalized; Anomaly score: the Score value calculated in step 300, directly taking the value [0,1]; Attack behavior chain integrity score: according to the attack chain stages defined by the ATT&CK framework, calculate the number of stages actually covered by the subgraph / 7, for example, the integrity covering the three stages of reconnaissance, delivery, and exploitation is 3 / 7 = 0.429; Total number of nodes: the total number of nodes contained in the connected subgraph, normalized; External attack source mark: whether there is an IP address in the subgraph that appears in the blacklist of external threat intelligence, if so, it is 1, otherwise it is 0; Current network environment context feature vector dimension is 4: Current time period type encoding: obtain the weekday and hour of the current system time, mapped to 4 types. Type; Weekday daytime (Monday to Friday 8:00-18:00) is coded as 1, weekday nighttime (18:00-next day 8:00) is coded as 2, weekend daytime is coded as 3, and weekend nighttime is coded as 4; Current business type code: By querying the business system asset management table, obtain the main business service type running on the target asset and map it as Web service code 1, database service code 2, file service code 3, email service code 4, and other code 5; Current target asset importance level code: Query the asset importance registration table and take the code value directly according to the asset level; Core=3, Important=2, General=1; Current alarm load rate: The number of pending alarms generated in the past hour / the maximum processing capacity threshold of the security operation and maintenance team, used to avoid alarm storms increasing the operation and maintenance burden; External threat intelligence feature vector dimension=3: External reputation score of attack source IP: By calling the API of the external threat intelligence platform, inputting src_ip, obtaining the reputation score, dividing by 100 to normalize to [0,1], and then inverting; MITRE ATT&CK Tactical Phase Encoding: Query the ATT&CK tactical ID corresponding to the attack behavior pattern, map the tactical ID to an integer code of 1-14, and normalize it to [0,1]; Global Activity Index of Similar Threat Events: Obtain the number of global reports of this attack type from the threat intelligence source in the past 24 hours, divide it by the historical maximum number of reports, and truncate it to [0,1]; The dimension of the final state vector s is 7+4+3=14, the discretization and normalization process of action space A, threshold adjustment action: both the first threshold and the second threshold are in the interval [0,1], and the first threshold < the second threshold is satisfied. Discretize the threshold adjustment action into the following options: Increase the first threshold: T1+=0.05, but ensure T1+0.05<T2; Decrease the first threshold: T1-=0.05, but ensure T1-0.05≥0; Increase the second threshold: T2+=0.05, but ensure T2+0.05≤1; Decrease the second threshold: T2-=0.05, but ensure T2-0.05>T1; Simultaneously increase T1 and T2: T1+=0.05, T2+=0.05, ensuring T2≤1; Simultaneously decrease T1 and T2: T1-=0.05, T2-=0.05, ensuring T1≥0; Keep unchanged: T1 and T2 are not adjusted. The action space contains 7 discrete action options. Confidence score adjustment: The deep Q-network outputs a continuous value Δp∈[-0.1, +0.1] represents the correction amount obtained by Sigmoid mapping to the original confidence score. The corrected confidence score p' = clamp(p + Δp, 0, 1). The detailed implementation logic of the reward function R is as follows: The reward function is determined jointly by the manual judgment result and system observation. In specific implementation, the system obtains the manual judgment conclusion 48 hours after each alarm processing. The mark made by the operation and maintenance personnel in the work order system is used as the basis for reward calculation: Real attack: Confidence score ≥ T2 and upgraded to an emergency event → r = +1.0; If the confidence score is between T1 and T2, it is marked as pending judgment → r = +0.3; If the confidence score ≤ T1, it is wrongly downgraded to an observation event → r = -2.0, serious missed report; False alarm: Confidence score ≥ T2 is upgraded to an emergency event → r=-1.5; confidence level between T1-T2 → r=-0.5, wasting manpower in analysis; confidence level ≤ T1, correctly downgraded to an observed event → r=+0.5, correctly filtered; cases where real attacks are not detected: the system itself cannot actively detect them, but learns about them through post-event traffic backtracking or external notification, uniformly assigns r=-2.0, and sends them back as strong negative samples; state transition probability function P: in a reinforcement learning environment, P is determined by the environment itself, without explicit modeling; deep Q-networks adopt a model-free approach, implicitly learning state transition rules by collecting experience tuples through interaction with the environment.

[0033] It is important to note that the Deep Q-Network has a three-layer fully connected neural network structure, including an input layer, hidden layers, and an output layer. The number of neurons in the input layer is equal to the dimension of the state space S. The hidden layer contains two sub-layers: the first sub-layer contains 256 neurons and uses the ReLU activation function, and the second sub-layer contains 128 neurons and uses the ReLU activation function. The number of neurons in the output layer is equal to the number of discrete actions in the action space A. The output layer does not use an activation function and directly outputs the Q-value estimate corresponding to each action. The Deep Q-Network employs a target network mechanism, setting up a target network with the same structure as the main network. Every preset number of training steps, the main network copies the current network parameters to the target network. The target network is used to calculate the target Q-value to stabilize the training process.

[0034] Specifically, the input layer has a dimension of 14, consistent with the state space dimension. Input data is Z-score standardized before entering the network, with each dimension subtracted from its historical mean and divided by its historical standard deviation. The mean and standard deviation vectors use the statistics of the first 100 state samples during the initial training phase and are subsequently updated online using an exponentially weighted moving average with a decay factor of 0.99. The first hidden layer has 256 neurons, fully connected, with weights initialized using He, variance of 2 / fan_in, bias initialized to 0, and ReLU activation function. Negative inputs are directly truncated to 0. Dropout is added to the output of this layer with a dropout rate of p=0.2 to prevent overfitting. The second hidden layer has 128 neurons, fully connected, with weights initialized using He, ReLU activation function, and dropout rate of p=0.2. The output layer has 7 neurons, corresponding to 7 discrete actions in the action space, with weights initialized using Xavier, bias of 0, and no activation function. It directly outputs the Q-value estimates for each action.

[0035] Step 500: Set a first threshold and a second threshold. Alarms with confidence levels below the first threshold are automatically downgraded to observation events, alarms with confidence levels above the second threshold are upgraded to emergency events, and alarms with confidence levels between the first threshold and the second threshold are marked as events to be analyzed. This dynamically balances the false alarm rate and false negative rate of security analysis to obtain a set of security warning events.

[0036] It is important to note that, such as Figure 3 and Figure 5 As shown, the method for obtaining the security warning event set includes: both the first threshold and the second threshold are continuous values ​​between 0 and 1, with the first threshold being less than the second threshold. The initial default value of the first threshold is 0.3, and the initial default value of the second threshold is 0.7. During the operation of the dynamic confidence assessment mechanism, the first and second thresholds are automatically adjusted by the deep Q network according to the current network environment context and real-time threat situation, rather than remaining fixed. When the confidence score is greater than or equal to 0 and less than or equal to the first threshold, the corresponding alarm is marked as an observation event. Observation events do not trigger real-time alarm push and automatic handling processes; they are only written to... Long-term storage is used for post-event auditing. When the confidence score is greater than the first threshold and less than the second threshold, the corresponding alarm is marked as an event to be analyzed. Events to be analyzed trigger the push of alarm notifications and related evidence to security operations personnel, waiting for manual analysis and confirmation. Automatic blocking is not performed before the manual analysis is completed. When the confidence score is greater than or equal to the second threshold and less than or equal to 1, the corresponding alarm is marked as an emergency event. Emergency events trigger real-time alarm push and automatic blocking processes without waiting for manual confirmation. Through adaptive adjustment of the first and second thresholds, a dynamic balance between false alarm rate and false negative rate is achieved.

[0037] Specifically, the first threshold T1 = 0.3 and the second threshold T2 = 0.7. These values ​​are based on statistical analysis of tens of thousands of historical security alert data. In the historical data, the average confidence score of real attack events is approximately 0.82 with a standard deviation of 0.15, while the average confidence score of false alarm events is approximately 0.25 with a standard deviation of 0.12. Taking the midpoint of the intersection of the two distributions, 0.3 and 0.7, as the initial boundaries, approximately 95% of real attack scores are higher than 0.7 (T2), and approximately 95% of false alarm scores are lower than 0.3 (T1). The initial false alarm rate and false negative rate are both around 5%. The execution process of the dynamic update mechanism is as follows: at the end of each time window, DeepQ network... The network outputs an action to adjust the threshold based on the current state s. Assuming T1=0.3 and T2=0.7, the network output action is "simultaneously increase T1 and T2 by 0.05." Then T1 is updated to 0.35 and T2 to 0.75. The adjusted threshold immediately takes effect in the alarm classification of the next time window. The constraint condition for the adjustment action is: 0≤T1<T2≤1. If an action violates the constraint, the system automatically ignores the action and reverts to the threshold before adjustment. For observation events, the system writes the complete information of the alarm into a long-term stored "observation event table," retaining it for at least 180 days. No real-time notifications or automatic blocking are triggered. The event log is batch-compiled daily at midnight, generating a "Filtered Event Summary" section in the daily report for security operations personnel to review the following day to prevent accidental system downgrade to real attacks. For events awaiting analysis: the system pushes a work order to the alarm work order queue of the security operations management platform. The work order includes: alarm ID, occurrence time, source IP, destination IP, event summary, related attack behavior chain topology diagram, confidence score, and suggested analysis action. "Recommend blocking" or "Recommend ignoring" is determined by the system based on the relative position of the confidence score to T1 / T2: if the confidence score > (T1+T2) / 2, blocking is recommended; otherwise, ignoring is recommended. The work order status is initially "Pending Processing" for operations personnel. After opening the work order through the web visualization interface and viewing the detailed evidence, click the "Confirm Blocking", "Confirm Release", or "Mark False Alarm" button to complete the assessment. The manual operation record is stored in the audit log. Before the manual assessment is completed, no automatic blocking operation is performed to avoid accidentally affecting normal business traffic. Emergency event handling: The system executes three parallel paths simultaneously: pushes alarm notifications to maintenance personnel, automatically executes the blocking policy, writes the event into the "Emergency Event Table" and marks it as "Automatically Handled", and generates a work order for the emergency event at the same time, but the status is automatically set to "Automatically Handled". Maintenance personnel need to supplement the confirmation of "Handling Effective" or "Handling Ineffective" within 24 hours after the event.

[0038] Step 600: Issue handling strategies to the security alarm event set, including automatic blocking strategies and manual judgment strategies, obtain the strategy issuance items, collect feedback on the handling results, and send the positive and negative feedback samples back to the graph neural network and reinforcement learning model for incremental training and parameter updates.

[0039] It is important to note that, such as Figure 4 As shown, the method for obtaining policy delivery items includes: For security alarms marked as emergency events, automatic blocking policies are automatically issued through a unified handling policy engine in conjunction with network security devices. The automatic blocking policies include: issuing access control list blocking rules to the target firewall device to block inbound and outbound traffic of the threat source IP address; issuing ACL rules to the target switch device via SNMP or RESTCONF protocol to isolate the threat source IP address at the Layer 2 network level; and issuing TCP RST reset commands to the dedicated blocker device to forcibly terminate the existing connection between the threat source IP address and the target IP address. For security alarms marked as events to be analyzed, manual analysis and suggestion policies containing alarm details, associated attack behavior chain topology, confidence score, and suggested handling actions are pushed to the terminal devices of security operations personnel. Security operations personnel manually confirm whether to execute blocking, allowing, or ignoring operations through a visual interface. The execution results of the handling policies are collected, including the success and failure status of the blocking command, the number of reconnection attempts of the threat source IP address within a preset time period after blocking, and the difference in abnormal traffic changes of the target IP address before and after blocking.

[0040] A network security analysis system based on system log audit analysis utilizes the aforementioned network security analysis method based on system log audit analysis, comprising: a multi-source heterogeneous log acquisition module, which acquires raw log data from various devices and business systems in the network through a multi-source heterogeneous log acquisition engine and aggregates it into a raw dataset; an adaptive normalization processing module, configured with a log type fingerprint recognition engine, a rule template matching engine, and a rule self-generation engine, which performs adaptive normalization processing on the raw dataset to generate standardized audit event items, thus obtaining a processed dataset; and a graph neural network dynamic association analysis module, configured with a heterogeneous graph construction unit, a relational graph attention network computation unit, a baseline graph storage unit, and an abnormal connected subgraph detection unit. The testing unit constructs a heterogeneous graph from the processed dataset using a sliding time window and updates node embeddings through a relational graph attention network, outputting a set of associated threat events. The reinforcement learning dynamic confidence assessment module, equipped with a deep Q-network inference unit, a state feature encoding unit, and a threshold adaptive adjustment unit, calculates confidence scores for the set of associated threat events and adaptively adjusts alarm thresholds to generate a set of security alarm events. The coordinated handling and closed-loop feedback module, equipped with a policy execution engine unit, an alarm hierarchical push unit, and a feedback sample collection unit, issues handling strategies to the set of security alarm events and collects handling results to feed back to the graph neural network dynamic correlation analysis module and the reinforcement learning dynamic confidence assessment module for incremental training and parameter updates.

[0041] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended embodiments and their equivalents.

Claims

1. A network security analysis method based on system log audit analysis, comprising: The raw log data of various devices and business systems in the network is obtained by a multi-source heterogeneous log collection engine to obtain the raw dataset. The raw dataset is then subjected to adaptive normalization processing to generate standardized audit event items, resulting in the processed dataset. Its key features include: based on the processed dataset, a dynamic correlation analysis model is constructed using a graph neural network to output correlated threat events, resulting in an output threat event set. A dynamic confidence assessment mechanism based on reinforcement learning is introduced, and a Markov decision process is constructed. The optimal confidence scoring strategy and alarm threshold adjustment strategy are learned through a deep Q-network to obtain strategy adjustment terms. The confidence score is used to characterize the probability estimate that the correlated threat event belongs to a real attack behavior. A first threshold and a second threshold are set. Alarms with confidence scores below the first threshold are automatically downgraded to observation events, alarms with confidence scores above the second threshold are upgraded to emergency events, and alarms with confidence scores between the first and second thresholds are marked as events to be analyzed, so as to dynamically balance the false alarm rate and false negative rate of security analysis, resulting in a security warning event set. A handling strategy is issued to the security warning event set, including an automatic blocking strategy and a manual analysis strategy, resulting in strategy issuance terms. Feedback is collected on the handling results, and the positive and negative samples are fed back to the graph neural network and reinforcement learning model for incremental training and parameter updates.

2. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The methods for obtaining the original dataset include: The multi-source heterogeneous log collection engine simultaneously enables Syslog protocol reception, Kafka message queue subscription, WebAPI interface call, and file disk read methods to aggregate the collected raw log data into a distributed message queue. Each raw log data is then labeled with a source tag according to the collection channel, resulting in the raw dataset.

3. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The method for obtaining the dataset includes: For each original log data in the original dataset, log type feature fingerprint identification is performed. The feature fingerprint consists of a fixed set of fields in the log message header, a keyword co-occurrence vector in the log message body, and a regular expression structure feature triplet of the overall format of the log line. The extracted feature fingerprint is matched with the fingerprint features of each rule template in the pre-set rule template library. The rule template with the highest similarity is selected as the matching result to generate standardized audit event items. All standardized audit event items constitute the processing dataset.

4. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The method for obtaining the output threat event set includes: Using a sliding time window of preset length as the processing unit, a standardized audit event item set within the current time window is extracted from the processing dataset. Using events in the standardized audit event item set as edges and IP addresses, user accounts, and device resources appearing in the events as nodes, a heterogeneous graph structure is constructed. Feature vectors are initialized for each user account node and each device resource node in the heterogeneous graph structure. The heterogeneous graph structure is then input into a relational graph attention network for node embedding updates. After obtaining the updated embedding representations of all nodes, each connected subgraph in the heterogeneous graph structure is extracted. Each connected subgraph is compared with a pre-constructed baseline graph of normal business behavior, and anomaly scores are calculated for each connected subgraph. Connected subgraphs with anomaly scores exceeding a preset anomaly score threshold are marked as associated threat events. The event edge sequences contained in the associated threat events are extracted and arranged in chronological order to form a multi-stage attack behavior chain. All associated threat events constitute the output threat event set.

5. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The methods for obtaining the strategy adjustment items include: Each associated threat event in the output threat event set is taken as the object to be evaluated, and a Markov decision process quadruple (S, A, P, R) is constructed, where S represents the state space, A represents the action space, P represents the state transition probability function, and R represents the reward function. Each state in the state space S is composed of three parts: the feature vector of the associated threat event, the feature vector of the current network environment context, and the feature vector of the external threat intelligence. The action space A includes threshold adjustment actions with continuous values ​​and level determination actions with discrete values. The optimal state-action value function Q(s, a) is learned through a deep Q-network. The deep Q-network takes state s as input and outputs the Q-value estimate corresponding to each action in the action space A. The action with the largest Q-value is selected as the optimal action to be executed in the current state. The training of the deep Q-network adopts an experience replay mechanism and a target network mechanism.

6. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The deep Q-network has a three-layer fully connected neural network structure, including: The system consists of an input layer, hidden layers, and an output layer. The number of neurons in the input layer is equal to the dimension of the state space S. The hidden layer contains two sub-layers: the first sub-layer contains 256 neurons and uses the ReLU activation function, and the second sub-layer contains 128 neurons and uses the ReLU activation function. The number of neurons in the output layer is equal to the number of discrete actions in the action space A. The output layer does not use an activation function and directly outputs the Q-value estimate corresponding to each action.

7. The network security analysis method based on system log audit analysis according to claim 1, characterized in that: The method for obtaining the security warning event set includes: When the confidence score is greater than or equal to 0 and less than or equal to the first threshold, the corresponding alarm is marked as an observation event. When the confidence score is greater than the first threshold and less than the second threshold, the corresponding alarm is marked as an event to be analyzed. When the confidence score is greater than or equal to the second threshold and less than or equal to 1, the corresponding alarm is marked as an emergency event.

8. A network security analysis method based on system log audit analysis according to claim 1, characterized in that: The methods for obtaining the policy-issued items include: For security alerts marked as emergency events, an automatic blocking policy is automatically issued through a unified handling strategy engine that links network security devices. For security alerts marked as events to be assessed, a manual assessment suggestion policy is pushed to the terminal devices of security operations personnel. This policy includes alert details, a topology diagram of the associated attack behavior chain, a confidence score, and suggested handling actions. Security operations personnel can then manually confirm whether to execute the blocking, allowing, or ignoring operation through a visual interface. The execution results of the handling policy are collected, including the success or failure status of the blocking command, the number of reconnection attempts of the threat source IP address within a preset time period after blocking, and the difference in abnormal traffic changes of the target IP address before and after blocking.

9. A network security analysis system based on system log auditing and analysis, characterized in that: A network security analysis method based on system log audit analysis, as described in any one of claims 1-8, includes: The multi-source heterogeneous log collection module acquires raw log data from various devices and business systems in the network through the multi-source heterogeneous log collection engine and aggregates it into a raw dataset. The adaptive normalization processing module is equipped with a log type fingerprinting engine, a rule template matching engine, and a rule self-generation engine. It performs adaptive normalization processing on the original dataset to generate standardized audit event items and obtain the processed dataset. The graph neural network dynamic association analysis module is equipped with a heterogeneous graph construction unit, a relational graph attention network computing unit, a baseline graph storage unit, and an abnormal connected subgraph detection unit. It constructs a heterogeneous graph from the processed dataset in a sliding time window and updates the node embedding through the relational graph attention network, outputting a set of associated threat events. The reinforcement learning dynamic confidence assessment module is equipped with a deep Q-network inference unit, a state feature encoding unit, and a threshold adaptive adjustment unit. It calculates confidence scores for the set of associated threat events and adaptively adjusts the alarm threshold to generate a set of security alarm events. The linkage response and closed-loop feedback module is equipped with a strategy execution engine unit, an alarm hierarchical push unit, and a feedback sample collection unit. It issues response strategies to the security alarm event set and collects the response results to the graph neural network dynamic correlation analysis module and the reinforcement learning dynamic confidence evaluation module for incremental training and parameter updates.

Images