Method, apparatus, device, medium and product for processing log

Abstract

Embodiments of the present disclosure relate to a method, apparatus, device, medium and product for processing logs. The method comprises determining a plurality of logs related to a running of an application. The method further comprises identifying a target log with a risky behavior in the plurality of logs. The method further comprises obtaining context information of the target log from the plurality of logs, the context information comprising the target log. The method further comprises attributing the target log based on a plurality of rules for the risky behavior and the context information to determine a risky issue of the target log. Through the method, the automatic attribution of the risky behavior in the logs can be realized by utilizing the plurality of logs in the running of the application in combination with the plurality of rules related to the plurality of logs, which greatly reduces resource consumption, improves the efficiency of processing the risky behavior in the logs, and improves user experience.

Description

Technical Field

[0001] The embodiments of this disclosure generally relate to the Internet field, and more specifically to methods, apparatus, devices, media, and products for processing logs. Background Technology

[0002] In today's modern information society, internet technology is developing rapidly. Users often encounter permissions issues related to various application activities when using different software applications. For example, when a user uses a software application on a smartphone, the application may collect certain information after obtaining the user's permission, such as the smartphone's hardware information, system information, and information from other applications. Furthermore, with the development of internet technology, the collection, storage, and sharing of this information has become increasingly common.

[0003] However, during the use of software applications, users are typically granted certain permissions. The abuse of these permissions can lead to some software applications collecting device and user information without restriction, resulting in data privacy breaches and information security vulnerabilities. Therefore, the protection of data privacy and the strengthening of information security during user software application usage are increasingly worthy of in-depth research. Summary of the Invention

[0004] Embodiments of this disclosure provide a method, apparatus, device, medium, and product for processing logs.

[0005] According to a first aspect of this disclosure, a method for processing logs is provided. The method includes identifying multiple logs related to the operation of an application. The method further includes identifying a target log among the multiple logs that exhibits risky behavior. The method also includes obtaining contextual information about the target log from the multiple logs, the contextual information including the target log. The method further includes attributing the target log based on multiple rules for risky behavior and the contextual information to determine the risk issues of the target log.

[0006] In a second aspect of this disclosure, an apparatus for processing logs is provided. The apparatus includes a plurality of log determination module configured to determine a plurality of logs related to the operation of an application; a target log identification module configured to identify a target log among the plurality of logs exhibiting risky behavior; a context information acquisition module configured to acquire context information of the target log from the plurality of logs, the context information including the target log; and an attribution module configured to attribute the target log to determine risk issues based on multiple rules for risky behavior and the context information.

[0007] In a third aspect of this disclosure, an electronic device is provided, including at least one processor; and a storage device for storing at least one program, which, when executed by the at least one processor, causes the at least one processor to implement the method according to the first aspect of this disclosure.

[0008] In a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method according to a first aspect of this disclosure.

[0009] In a fifth aspect of this disclosure, a computer program product is provided. This computer program product includes a computer program that, when executed by a processor, implements the method according to a first aspect of this disclosure.

[0010] It should be understood that the content described in this section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The above and other objects, features and advantages of this disclosure will become more apparent from the accompanying drawings, in which like reference numerals generally denote like parts.

[0012] Figure 1 The illustration shows a schematic diagram of an example environment in which some embodiments of the present disclosure may be implemented;

[0013] Figure 2 The illustration shows a schematic diagram of an example method for processing logs according to some embodiments of the present disclosure;

[0014] Figure 3 The illustration shows a schematic diagram of an example flowchart for processing logs according to some embodiments of the present disclosure;

[0015] Figure 4 The illustration shows an example of a creation rule for processing logs according to some embodiments of the present disclosure;

[0016] Figure 5 The illustration shows a schematic diagram of an example of detailed information on rules for processing logs according to some embodiments of the present disclosure;

[0017] Figure 6 The illustration shows an example of a data mining strategy for processing logs according to some embodiments of the present disclosure;

[0018] Figure 7The illustration shows an example of information from a work order used for processing logs according to some embodiments of the present disclosure;

[0019] Figure 8 The illustration shows a schematic diagram of an example of reattribution of historical logs according to some embodiments of the present disclosure;

[0020] Figure 9 The illustration shows a schematic block diagram of an apparatus for processing logs according to some embodiments of the present disclosure;

[0021] Figure 10 A schematic block diagram of an example device suitable for implementing various embodiments of the present disclosure is illustrated.

[0022] In the various figures, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0023] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0024] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0025] For example, upon receiving a user's proactive request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0026] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0027] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0028] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0029] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0030] In today's information society, data privacy and information security are becoming increasingly important. With the rapid development of internet technology and the continuous improvement of data processing capabilities, the collection, storage, processing, and sharing of personal information have become increasingly common. In this context, managing and monitoring application privacy risks has become a crucial issue. Traditional privacy risk management mainly relies on stack trace analysis and manual log review, which requires a significant investment of manpower.

[0031] However, even with significant manpower investment, traditional stack trace analysis and manual log review still struggle to detect and capture the full picture of application privacy risks in real time. For example, stack trace analysis is a method to locate errors and risks by examining application stack information. This method relies on developers' deep understanding of the code and stack structure. However, as application complexity increases, stack information becomes larger and more complex, increasing the difficulty and workload of analysis. Furthermore, stack trace analysis typically provides only limited contextual information, making it difficult to comprehensively capture the full picture of privacy risk behaviors. Similarly, manual log review is a method to locate problems and risks by analyzing system-generated log files. Manual review requires substantial manpower and time and is easily limited by the reviewers' expertise and experience. When faced with massive amounts of log data, the efficiency and accuracy of manual review are difficult to guarantee. Simultaneously, manual review methods struggle to detect and respond to privacy risk logs in real time. This leads to a significant decline in user experience.

[0032] To address at least the aforementioned and other potential problems, embodiments of this disclosure propose a method for processing logs. In this method, a computing device first identifies multiple logs related to the operation of an application. After identifying the multiple logs, a target log among them exhibiting risky behavior is identified. Next, the computing device obtains contextual information about the target log from the multiple logs. This contextual information includes the target log itself. Finally, the computing device uses multiple rules for risky behavior and the obtained contextual information to attribute the target log to determine the risk issues associated with it. This method, by utilizing multiple logs related to application operation and combining them with multiple rules associated with those logs, enables automated attribution of risky behavior in logs, significantly reducing resource consumption, improving the efficiency of processing risky behavior in logs, and enhancing the user experience.

[0033] It is understood that this disclosure is only described in conjunction with relevant embodiments and is not intended to limit the scope of protection of this disclosure. Any technical solutions in other disclosures that fall within the scope of protection of this disclosure should be protected.

[0034] The embodiments of this disclosure will now be described in further detail with reference to the accompanying drawings. Figure 1 An example environment is shown in which the devices and / or methods of embodiments of this disclosure may be implemented. In environment 100, computing device 102 can acquire data information of application 104. Additionally, application 104 may run on computing device 102, and computing device 102 may be used to perform processing on relevant data in application 104, such as processing log information generated during the runtime of application 104.

[0035] Examples of computing device 102 include, but are not limited to, personal computers, server computers, handheld or laptop devices, mobile devices (such as mobile phones, personal digital assistants (PDAs), media players, etc.), multiprocessor systems, consumer electronics, minicomputers, mainframe computers, and distributed computing environments that include any of the above systems or devices.

[0036] like Figure 1 As shown, computing device 102 first identifies multiple logs related to the operation of application 104. These multiple logs 106 contain information related to the operation of the application, such as runtime log information, code debugging information, and stack trace information.

[0037] Subsequently, the computing device 102 can identify a target log 108 among multiple logs 106 that exhibits risky behavior 110. It is understood that the target log 108 is one of the multiple logs 106 exhibiting risky behavior, and the multiple logs 106 may also include other logs exhibiting risky behavior. Furthermore, risky behavior 110 can be one of multiple risky behaviors.

[0038] Next, the computing device 102 obtains the context information 112 of the target log 108 from multiple logs 106. The context information 112 includes the target log 108. For example, the context information includes 100 or 200 logs surrounding the target log. It is understood that the number of logs in the context information can be defined by the user, and this application does not impose any restrictions on this.

[0039] Finally, computing device 102 can use multiple rules 114 and contextual information 112 to match risky behavior 110 to attribute 116 to target log 108, thereby determining risk issues 118 of target log 108. Additionally, attribution 116, besides being used to determine risk issues 118 of target log 108, can also be used to determine the scope of impact of risk issues 118.

[0040] In addition, after the attribution 116 for target log 108 is completed, the identified risk issues 118 and their scope of impact can be analyzed to generate an analysis report on risky behavior. The report is then presented to the user in a visual manner for easy viewing and further analysis.

[0041] This method utilizes multiple logs from application runtime, combined with various rules related to those logs, to automate the attribution of risky behaviors within the logs. Furthermore, it can generate analytical reports on risk issues, significantly reducing manpower consumption, improving the efficiency of processing risky behaviors in logs, and enhancing the user experience.

[0042] The above combination Figure 1 The following is a schematic diagram illustrating an example environment in which some embodiments of this disclosure may be implemented, in conjunction with... Figure 2 The illustration depicts an example method for processing logs according to some embodiments of the present disclosure. This example method can be provided by... Figure 1 The computing device 102 or any suitable computing device in the system shall execute the test.

[0043] like Figure 2As shown, in example method 200, at box 202, multiple log entries related to the application's operation are identified. To analyze risks during program or application operation, it is typically necessary to obtain logs that record its operational or runtime information.

[0044] Before determining the multiple log entries 106, the computing device 102 first acquires multiple initial log entries, and then preprocesses these initial log entries to obtain the multiple log entries 106. These initial log entries include information related to application operation, such as application runtime information, code debugging information, stack traces, and other application runtime-related information. The runtime information includes user login status, application foreground / background status, etc.

[0045] In one example, multiple log entries (106) can be obtained by formatting multiple initial log entries. For instance, the timestamp information of multiple initial log entries can be formatted. If the timestamp information is in an unreadable form such as "1294847574", it can be converted into a readable form such as "2024-05-06".

[0046] In another example, multiple log entries (106) can be obtained by cleaning multiple initial log entries. Since these initial log entries may contain dirty data—generally inaccurate, incomplete, or invalid data due to various reasons—this type of data cannot provide practical application value. Instead, it consumes storage space, wastes resources, and may even lead to serious business problems.

[0047] However, dirty data doesn't necessarily include risky behavior. Therefore, built-in rules are needed to filter this dirty data to prevent it from being incorrectly identified as risky behavior later. In one example, built-in rules can be set to filter out black and gray market data. In another example, built-in rules can be set to filter out additional data generated due to application malfunctions caused by user tampering. In yet another example, built-in rules can be set to filter non-critical logs, such as system logs, script logs, and user-generated logs, to improve efficiency in the data processing process.

[0048] In another example, multiple log entries 106 can be obtained by synchronizing the time of multiple initial log entries. For instance, application 104 is deployed worldwide, so users of application 104 may be located in various parts of the world, and there are time differences between different regions. In this case, the time in different regions can be synchronized to the same time zone by synchronizing the time in multiple initial log entries, so as to facilitate subsequent data processing.

[0049] Additionally, the processing of multiple initial logs may include at least one of the three preprocessing steps described above. That is, multiple initial logs can also be processed by combining two or all three preprocessing steps to obtain multiple logs 106. It is understood that the use of at least one of the three preprocessing steps can be determined based on actual needs, and this application does not impose any limitations on this.

[0050] In some embodiments, after multiple log entries 106 are identified, the multiple log entries 106 are stored in a database dedicated to storing logs so that they can be retrieved repeatedly for attribution in the future.

[0051] Furthermore, the computing device 102 can also acquire multiple rules for processing multiple logs. In some embodiments, these multiple rules 114 are obtained by analyzing and summarizing historical logs. In some embodiments, after identifying multiple logs 106, the computing device 102 further creates multiple rules 114 for the multiple logs 106 based on a portion of the acquired logs. Additionally, the created multiple rules 114 can be stored in a risk rule base dedicated to storing rules, and this risk rule base can be updated by adding new rules or deleting old rules.

[0052] Among these rules, several (114) include access control rules, data breach identification rules, or abnormal behavior detection rules. In one example, an access control rule could be a rule controlling an application's access to specific information; for instance, it could be a rule controlling an application's access to geolocation information in a specific region, such as controlling an application's access to geolocation information in country A. In another example, a data breach rule could be a rule controlling an application's access to specific data; for instance, it could be a rule controlling an application's access to clipboard information to prevent user data leaks. In yet another example, an abnormal behavior detection rule could be a rule controlling an application's use of device hardware; for instance, it could be a rule controlling an application's use of a smartphone camera.

[0053] Then, at box 204, identify the target log with risky behavior among the multiple logs.

[0054] Once multiple log entries 106 are identified, the computing device 102 can further identify the target log entry 108 among the multiple log entries 106. For example, by traversing the behaviors in the multiple log entries 106, risky behaviors in the multiple log entries 106 can be identified, and then the log corresponding to the risky behavior can be identified as the target log entry 108.

[0055] In some embodiments, a log can be identified as a target log 108 by adding a tracing identifier to the log corresponding to the risky behavior. Additionally, when multiple logs 106 include multiple target logs with risky behavior, the multiple target logs can be identified by adding multiple different tracing identifiers to the multiple target logs.

[0056] Next, at box 206, the context information of the target log is obtained from the plurality of logs, the context information including the target log.

[0057] After identifying the target log 108, the computing device 102 will further obtain the context information 112 of the target log 108. The context information 112 can be used and combined with multiple rules 114 to attribute the target log 108 116.

[0058] Context information 112 includes a predetermined number of logs from the target log 108. Computing device 102 can select this predetermined number of logs from multiple logs 106, and determine this predetermined number of logs as context information 112. In one example, computing device 102 selects the first 50 and last 50 logs of the target log 108, totaling 101 logs, as context information 112 in chronological order. In another example, computing device 102 selects the first 30 logs of the target log 108, totaling 31 logs, as context information 112 in chronological order. In yet another example, computing device 102 selects the last 50 logs of the target log 108, totaling 51 logs, as context information 112 in chronological order.

[0059] Finally, at box 208, the target log is attributed based on multiple rules for risky behavior and the contextual information to determine the risk issues of the target log.

[0060] After determining the context information 112 and multiple rules 114, the computing device 102 further utilizes the context information 112 and multiple rules 114 to perform attribution 116 on the target log to determine risk issues 118 of the target log 108. It should be noted that attribution 116, in addition to being used to determine risk issues 118 of the target log 108, can also be used to determine the scope of impact of risk issues 118. In one example, the scope of impact of risk issues 118 can indicate the severity of risk issues 118; the larger the scope of impact of risk issues 118, the higher the severity of risk issues 118.

[0061] In some embodiments, since the attribution process requires processing a large amount of data from multiple log entries 106, a message queue can be used to improve the efficiency of processing multiple log entries 106 during the attribution process. Alternatively, a Kafka message queue can be used to process multiple log entries 106. It is understood that any other method can be used to improve the efficiency of processing multiple log entries 106, and this application does not impose any limitations on this.

[0062] In some embodiments, by matching the content of the context information 112 and the rules in the plurality of rules 114, when there is a rule in the plurality of rules 114 that matches the context information, the rule can be determined as the target rule, and then the computing device 102 can use the determined target rule to perform attribution 116 on the target log 108.

[0063] In some embodiments, matching the content of the context information 112 and the rules in the multiple rules 114 is performed using regular expressions. For example, when the data size of the context information 112 is small, key information from the rule content of the multiple rules 114 can be written into a regular expression, and the regular expression can be used to match the context information 112. When the regular expression can match the result, the rule is determined as the target rule.

[0064] Additionally, when the data size of context information 112 is large, the matching efficiency of regular expressions may decrease. In this case, program code can be used to further combine with regular expressions to improve matching efficiency and accuracy. It should be noted that the program code can be Python, C, C#, or any other language code capable of implementing the matching process; this application makes no restrictions on this.

[0065] In some embodiments, when no rule matching the context information exists among the multiple rules 114, the computing device 102 can generate a target rule for the risky behavior 110 based on the context information 112. Additionally, the computing device 102 can add the generated target rule to the multiple rules 114 and update the multiple rules 114.

[0066] After multiple rules 114 are updated, the updated rules 114 can be reused to reattribute unattributed logs. Additionally, the computing device 102 can also identify multiple historical logs with risky behavior within a predetermined time period, for example, multiple historical logs within 24 hours prior to a target time point, and then reattribute these historical logs using the updated rules 114. In one example, the computing device 102 retrieves 100 historical logs from 3 PM on May 6, 2024, and the 24 hours prior, and reattributes these historical logs using the updated rules 114.

[0067] In some embodiments, after the attribution 116 for the target log 108 is completed, the computing device 102 may further generate business credentials for the target log 108. For ease of understanding, business credentials may also be referred to as work orders. Work orders include basic information such as business work order name, work order number, work order type, etc.

[0068] In some embodiments, after the attribution 116 for the target log 108 is completed, the computing device 102 can further combine the context information 112 to generate analysis results of risk issues corresponding to the target log 108. The risk issues include risk behaviors 110 and the scope of impact of the risk behaviors. Subsequently, the analysis results are presented to the user in a visual manner, for example, by generating an analysis report for the user.

[0069] This method utilizes multiple logs related to application runtime information, code debugging, and stack traces, combined with multiple rules associated with these logs, to automate the attribution of risky behaviors in the logs. Furthermore, it can generate analysis reports on risk issues, significantly reducing manpower consumption, improving the efficiency of processing risky behaviors in logs, and enhancing the user experience.

[0070] The above combination Figure 2 A schematic diagram of an example method for processing logs according to some disclosed embodiments is described below. Figure 3 This is a schematic diagram illustrating an example flowchart for processing logs according to some embodiments of the present disclosure. This example method can be... Figure 1 The computing device 102 or any suitable computing device in the system shall execute the test.

[0071] like Figure 3 As shown in Example 300, the configuration is first reported at 302. After receiving the instruction to report the configuration, the computing device 102 reports the configuration at the target application 304. During this process, the computing device 102 collects multiple raw logs related to the application's runtime information, code debugging information, and stack information.

[0072] The acquired raw logs were then preprocessed in data center 306 to obtain multiple log entries. The preprocessing steps included at least one of the following: format conversion, data cleaning, or time synchronization.

[0073] Furthermore, after acquiring multiple logs, the system identifies target logs exhibiting risky behavior and determines their contextual information. Subsequently, it uses this contextual information and multiple rules for risky behavior in rule base 308 to perform aggregation and attribution 310 on the target logs to determine their risk issues. Additionally, rule base 308 includes rule-related functions such as editing, adding, and deleting rules.

[0074] Once the attribution for the target log is complete, a work order (312) will be generated. Users can then use this work order to implement corrective action (314) to prevent potential risks.

[0075] When the attribution of the target log is not completed, the computing device 102 continues to consume at 316, and continues to push the next step of the target log that has not been attributed. Then, the rule editing function of the rule base 320 is used to generate a rule at 318. After the generated rule for the target log is generated, the generated rule is entered at 322.

[0076] In some embodiments, after the generated rules are entered, the rule base is updated, and the computing device 102 can further utilize the updated rule base to backtrack historical data. For example, multiple historical logs within a predetermined time period can be re-attributed.

[0077] This method leverages multiple logs related to application runtime information, code debugging, and stack traces, combined with various rules associated with these logs, to automate the attribution of risky behaviors within the logs. It can further generate analytical reports on risk issues, significantly reducing manpower consumption, improving the efficiency of processing risky behaviors in logs, and enhancing the user experience. Furthermore, it allows for the re-attribution of historical logs that were not previously attributed using updated rule bases, improving the ability to process historical data.

[0078] The above combination Figure 3 A schematic diagram illustrating an example of a flowchart for processing logs according to some disclosed embodiments is shown below. Figure 4 A schematic diagram illustrating examples of creation rules for processing logs according to some embodiments of this disclosure.

[0079] like Figure 4 As shown in Example 400, in conjunction with the previous Example 300, the rule base includes the functionality to create rules. The rule creation page 402 includes a rule purpose, and at 404, the user can select the rule purpose. It is understood that multiple different rule purposes are pre-stored, and the user can choose according to their needs.

[0080] The rule creation page (402) also includes a runtime priority (406) for the rule to be created. For example, a runtime priority of 100 corresponds to the priority of P2. In one example, a higher runtime priority number indicates a higher priority for the corresponding rule. It is understood that the level of runtime priority can be defined by the user, and this application does not impose any restrictions on this.

[0081] The page for creating rule 402 also includes information such as the name of the rule to be created 408, license type 410, detection scenario 412, rule label 414, privacy compliance 416, attachments 418, and business scope 420.

[0082] Among them, license type 410 can be the conditions under which the rule to be created can be executed, such as information such as the region, geographical location, and time period in which the rule to be created can be executed. Monitoring category 412 is secondary information corresponding to license type 410, such as specific region information, specific geographical location, and specific time information in which the rule to be created can be executed. Rule label 414 can be defined by the user to allow the user to more quickly and efficiently identify the purpose of the rule.

[0083] In some embodiments, privacy compliance 416 indicates the level of privacy risk involved in the rule to be created. In one example, the privacy compliance 416 option is enabled when the level of privacy risk involved in the rule to be created is high. It is understood that whether to enable privacy compliance 416 is also up to the user, and this application does not impose any restrictions on this.

[0084] Appendix 418 may be supplementary information for the rule to be created, such as associated rules for the rule to be created, information on devices that can be used, information on systems that can be used, and other information.

[0085] The business scope 420 includes the business scope of the target application to which the rule to be created can be applied. Users can also add a description of the rule to be created in box 422 to help other users better understand the rule.

[0086] After the basic information for the rule to be created is filled in, you can select "Create a work order" at step 424. If selected, once the rule is created, a work order for the target log will be automatically generated whenever the rule takes effect, facilitating subsequent user follow-up and rectification. Then, confirm at step 428 that the rule to be created has been completed. If the rule is no longer needed, you can cancel the rule creation at step 426.

[0087] This method allows for the creation of rules to update the rule base, and the updated rule base can be used to attribute target logs and historical logs, thereby improving the processing efficiency of historical data.

[0088] The above combination Figure 4 A schematic diagram illustrating examples of log creation rules according to some disclosed embodiments is provided below. Figure 5 A schematic diagram illustrating examples of rule details for processing logs according to some embodiments of this disclosure.

[0089] like Figure 5 As shown in Example 500, in conjunction with the previous Example 400, Example 500 illustrates the rule details of one of a plurality of rules.

[0090] Box 502 displays specific information about the rule, including the rule number, creator, rule name "[Location_Region_Restriction] xxxxxxxx", privacy compliance information "Location Region", rule description "xxxxxxx", rule tag, license type "Location", monitoring scenario "Location_Region_Restriction", attachment "Assignment Required", work order "Work Order ID-xxxxx", and business scope.

[0091] It also displays the priority of the current rule, for example, the current rule priority is P0, and the priority has been enabled, and error warnings are not enabled.

[0092] In some embodiments, the rules also include code information. Since some rules are applicable to large-scale log data processing, in addition to using regular expressions, example code 504 in the rules can be used to assist in processing large-scale logs, thereby improving the efficiency and accuracy of log processing.

[0093] The above combination Figure 5 A schematic diagram illustrating examples of rule details for processing logs according to some disclosed embodiments is shown below. Figure 6 A schematic diagram illustrating examples of data mining strategies for processing logs according to some embodiments of the present disclosure.

[0094] like Figure 6 As shown in Example 600, box 602 displays detailed information about the data mining strategy. Box 602 shows details of multiple rules and allows searching for and viewing specific rules.

[0095] In addition, you can select specific rule tags from the drop-down list to view multiple rules with the same tag in batches. For each rule, you can also perform operations, such as deleting or editing it.

[0096] The above combination Figure 6 A schematic diagram illustrating examples of data mining strategies for processing logs, based on some disclosed embodiments, is shown below. Figure 7 A schematic diagram illustrating an example of information for processing all work orders in a log, according to some embodiments of this disclosure.

[0097] like Figure 7 As shown in Example 700, box 702 displays information about all work orders.

[0098] Box 702 displays information such as work order identifier (ID), work order name, work order status (expired or completed), secondary items (dynamic monitoring warnings), primary items (sensitive permission monitoring alarms), work sequence (location), and monitoring category (xxxxx) for each work order.

[0099] Furthermore, a work order can be created at point 704. After the attribution of the target log is completed, a work order for the target log can be generated manually, and the information required by the user can be added to the created work order to facilitate the subsequent progress and rectification of the target log.

[0100] The above combination Figure 7 A schematic diagram illustrating an example of information for processing all work orders in the log, according to some disclosed embodiments. The following is in conjunction with... Figure 8 A schematic diagram illustrating an example of reattributing historical logs for processing logs according to some embodiments of the present disclosure.

[0101] like Figure 8 As shown in Example 800, box 802 displays the page for reattributing historical logs. In box 802, a time period can be selected at 804, such as the start and end dates of the logs for which reattribution is required.

[0102] Subsequently, at point 806, select the permission type for reattribution, such as "location", and at point 808, select the monitoring scenario, such as "location_region_restriction".

[0103] Additionally, you can select the type of logs to be processed in the traceback type. In one example, you can select "Unprocessed," which means processing only logs that were not attributed. In another example, you can select "Unknown," which means processing only unknown logs. In yet another example, you can select "All," which means processing all logs.

[0104] In some embodiments, when data in a database specifically used to store multiple logs is cleared or the amount of data is insufficient, the option to "reacquire logs" can be selected, and then the computing device 102 reacquires multiple logs.

[0105] Once all information is confirmed, computing device 102 performs retrospective attribution to re-attribute multiple historical logs. It then generates analysis results and reports on the risky behaviors identified in these historical logs, presenting these reports to the user in a visual format.

[0106] like Figure 9 As shown, the device 900 includes a multiple log determination module 902, configured to determine multiple logs related to the operation of the application; a target log identification module 904, configured to identify a target log with risky behavior among the multiple logs; a context information acquisition module 906, configured to acquire context information of the target log from the multiple logs, the context information including the target log; and an attribution module 908, configured to attribute the target log to determine the risk issues of the target log based on multiple rules for risky behavior and context information.

[0107] In some embodiments, the context information acquisition module 906 includes: a predetermined number of log acquisition modules configured to select a predetermined number of logs, including the target log, from a plurality of logs; and a context information determination module configured to determine the predetermined number of logs as context information.

[0108] In some embodiments, the attribution module 908 includes: a matching module configured to match context information with the content of rules in a plurality of rules; and a target log attribution module configured to attribute a target log using a target rule in response to the existence of a target rule in the plurality of rules that matches the context information.

[0109] In some embodiments, the apparatus 900 further includes: a target rule generation module configured to generate a target rule for risky behavior based on the context information in response to the absence of a rule that matches the context information among a plurality of rules; and a plurality of rule update module configured to update a plurality of rules by adding the target rule to the plurality of rules.

[0110] In some embodiments, the apparatus 900 further includes: a multiple historical log determination module configured to determine multiple historical logs with risky behavior within a predetermined time period; and a reattribution module configured to reattribute the multiple historical logs using multiple updated rules.

[0111] In some embodiments, the matching of context information with the content of the rules among the plurality of rules is achieved by at least one of the following methods: regular expressions or program code.

[0112] In some embodiments, the multiple rules include at least one of the following: access control rules, data breach identification rules, or abnormal behavior detection rules.

[0113] In some embodiments, the apparatus 900 further includes: a business credential generation module configured to generate business credentials for a target log in response to the target log being attributed; and a business logic adjustment module configured to adjust business logic related to the target log based on the business credentials.

[0114] In some embodiments, the apparatus 900 further includes: an analysis result generation module configured to generate analysis results of risk issues corresponding to the target log based on context information in response to the target log being attributed; and a result report generation module configured to generate a result report on the analysis results based on the analysis results.

[0115] In some embodiments, the multiple log determination module 902 includes: a multiple initial log acquisition module configured to acquire multiple initial logs related to application runtime information, code debugging, and stack traces; and a preprocessing module configured to determine multiple logs by preprocessing the multiple initial logs.

[0116] In some embodiments, preprocessing includes at least one of the following: format conversion, data cleaning, or time synchronization.

[0117] In some embodiments, the apparatus 900 further includes: a plurality of rule creation modules configured to create a plurality of rules for the plurality of logs based on the plurality of logs.

[0118] In some embodiments, attribution for a target log is implemented using a message queue.

[0119] Figure 10 A schematic block diagram of an example device 1000 that can be used to implement embodiments of the present disclosure is shown. Figure 1The computing device 102 can be implemented using device 1000. As shown, device 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 1002 or loaded from storage unit 1008 into random access memory (RAM) 1003. The RAM 1003 can also store various programs and data required for the operation of device 1000. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Input / output (I / O) interface 1005 is also connected to bus 1004.

[0120] Multiple components in device 1000 are connected to I / O interface 1005, including: input unit 1006, such as keyboard, mouse, etc.; output unit 1007, such as various types of monitors, speakers, etc.; storage unit 1008, such as disk, optical disk, etc.; and communication unit 1009, such as network card, modem, wireless transceiver, etc. Communication unit 1009 allows device 1000 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0121] The various processes and handling described above, such as methods 200 and examples 300 to 800, can be executed by processing unit 1001. For example, in some embodiments, methods 200 and examples 300 to 800 can be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 1008. In some embodiments, part or all of the computer program can be loaded and / or installed on device 1000 via ROM 1002 and / or communication unit 1009. When the computer program is loaded into RAM 1003 and executed by CPU 1001, one or more actions of example methods 200 and examples 300 to 800 described above can be performed.

[0122] This disclosure can be a method, apparatus, system, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0123] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0124] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0125] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0126] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0127] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0128] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0130] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for processing logs, comprising: Identify multiple log entries related to the application's operation; Identify the target logs containing risky behavior among the multiple logs; Obtain the context information of the target log from the multiple logs, wherein the context information includes the target log; as well as Based on multiple rules targeting risky behavior and the contextual information, the target log is attributed to determine the risk issues of the target log.

2. The method according to claim 1, wherein obtaining the context information of the target log from the plurality of logs includes: Select a predetermined number of logs, including the target log, from the plurality of logs; as well as The predetermined number of logs are determined as the context information.

3. The method of claim 1, wherein attributing the target log to determine the risk issues of the target log includes: The context information is matched with the content of the rules among the multiple rules; as well as In response to the existence of a target rule among the multiple rules that matches the context information, the target log is attributed using the target rule.

4. The method according to claim 3, further comprising: In response to the absence of a rule matching the context information among the plurality of rules, a target rule for the risky behavior is generated based on the context information; as well as The multiple rules are updated by adding the target rule to them.

5. The method according to claim 4, further comprising: Identify multiple historical log entries containing risky behavior within a predetermined time period; as well as The updated rules are used to re-attribute the various historical log entries.

6. The method of claim 3, wherein matching the context information with the content of the rules among the plurality of rules is achieved by at least one of the following methods: Regular expressions or program code.

7. The method of claim 1, wherein the plurality of rules comprises at least one of the following: Access control rules, data breach identification rules, or abnormal behavior detection rules.

8. The method according to claim 1, further comprising: In response to the target log being attributed, business credentials for the target log are generated; as well as Based on the business credentials, adjust the business logic related to the target log.

9. The method according to claim 1, further comprising: In response to the attribution of the target log, an analysis result of the risk issue corresponding to the target log is generated based on the context information; as well as Based on the analysis results, a results report is generated.

10. The method of claim 1, wherein determining the multiple logs related to the operation of the application comprises: Obtain multiple initial logs related to the application's runtime information, code debugging, and stack trace; as well as The multiple initial logs are preprocessed to determine the multiple logs.

11. The method of claim 10, wherein the preprocessing comprises at least one of the following: Format conversion, data cleaning, or time synchronization.

12. The method according to claim 9, further comprising: Based on the multiple log entries, create the multiple rules for the multiple log entries.

13. The method of claim 1, wherein the attribution of the target log is implemented using a message queue.

14. An apparatus for processing logs, comprising: The multiple log determination module is configured to determine multiple logs related to the operation of the application; The target log identification module is configured to identify target logs with risky behavior among the multiple logs; The context information acquisition module is configured to acquire context information of the target log from the plurality of logs, wherein the context information includes the target log; as well as The attribution module is configured to attribute the target log to determine the risk issues of the target log based on multiple rules for risky behavior and the context information.

15. An electronic device comprising: At least one processor; as well as A storage device for storing at least one program, which, when executed by the at least one processor, causes the at least one processor to implement the method according to any one of claims 1-13.

16. A computer-readable storage medium having a computer program stored thereon, the computer program implementing the method according to any one of claims 1-13 when executed by a processor.

17. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-13.

Images