An intelligent tamper-proof log auditing method, device, medium and product

Abstract

The application discloses an intelligent anti-tampering log auditing method and device, medium and product, relates to the technical field of computer information security and network log auditing, and comprises the following steps: collecting multi-source heterogeneous log data and performing standardized processing; automatically identifying various sensitive information and sensitive field desensitization processing based on a pre-trained semantic recognition model; performing encryption processing on the desensitized log data by using an asymmetric searchable encryption algorithm, generating ciphertext logs and corresponding log abstracts; performing block chain storage of the log abstracts, and solidifying log original verification credentials by using the non-tamperable characteristics of the block chain storage module; and performing intelligent abnormal behavior detection, auditing analysis and integrity verification according to the ciphertext logs and the log abstracts after block chain storage, so as to obtain log auditing results. The application can realize integrated safety management and control of the whole life cycle of logs, including collection, desensitization, encryption, storage, auditing and verification, and can improve the security, integrity and intelligent auditing level of log data.

Description

Technical Field

[0001] This application relates to the fields of computer information security and network log auditing technology, and in particular to an intelligent anti-tampering log auditing method, device, medium and product. Background Technology

[0002] In digital business scenarios, operating systems, business applications, network firewalls, databases, and cloud platforms continuously generate massive amounts of heterogeneous logs. These logs are core legal credentials for security operations and maintenance, attack attribution, compliance with information security standards, and internal control auditing. Existing log auditing technologies have the following problems: (1) Weak anti-tampering capability of logs: Traditional logs are stored in plaintext or simple symmetric encryption without independent evidence. Internal maintenance personnel and external attackers can directly modify or delete logs. After tampering, the source cannot be traced and verified, which cannot meet the mandatory requirements for log integrity and immutability.

[0003] (2) Insufficient flexibility in desensitizing sensitive data: The existing desensitization schemes are fixed and static rules, which cannot automatically identify dynamically added sensitive fields in the logs. Either the desensitization is too excessive and loses key audit information, or the desensitization is incomplete and causes leakage of user privacy and transaction data.

[0004] (3) Audit analysis relies on manual labor and is inefficient: massive logs rely on manual configuration of fixed rules to match risks, which cannot adapt to new dynamic attacks, cannot learn normal user behavior on its own, and the identification of risks such as abnormal login, unauthorized operation, and injection attack is delayed.

[0005] In summary, there is an urgent need for a secure, scalable, and intelligent log auditing technology solution that covers the entire chain, in order to address the problem that existing technologies cannot simultaneously meet the requirements of log tamper prevention, intelligent privacy masking, intelligent risk auditing, and integrity verification. Summary of the Invention

[0006] The purpose of this application is to provide an intelligent anti-tampering log auditing method, device, medium and product that can realize integrated security management of the entire log lifecycle, including collection, desensitization, encryption, evidence storage, auditing and verification, thereby improving the security, integrity and intelligent auditing level of log data.

[0007] To achieve the above objectives, this application provides the following solution: Firstly, this application provides an intelligent anti-tampering log auditing method, which includes the following steps: Collect multi-source heterogeneous log data and perform standardization processing on the multi-source heterogeneous log data to obtain standardized log data.

[0008] Based on a pre-trained semantic recognition model, various sensitive information in the standardized log data is automatically identified. Sensitive fields are then de-identified by adaptive matching of access subject permissions and business usage scenarios to obtain de-identified log data.

[0009] The de-identified log data is encrypted using an asymmetric searchable encryption algorithm to generate ciphertext logs and corresponding log digests. The ciphertext logs are then stored in a distributed database, while the log digests are sent to a blockchain evidence storage module. The distributed database is used to store the ciphertext logs, and the blockchain evidence storage module is a functional module used to perform blockchain evidence storage on the log digests.

[0010] Based on the blockchain notarization module, the log digest is notarized on the blockchain, and the original verification certificate of the log is solidified by the immutability of the blockchain notarization module, thus obtaining the notarized log digest.

[0011] Based on the encrypted log and the log summary stored on the blockchain, intelligent abnormal behavior detection, audit analysis, and integrity verification are performed to obtain the log audit results.

[0012] Optionally, multi-source heterogeneous log data is collected, and the multi-source heterogeneous log data is standardized to obtain standardized log data, specifically including the following steps: A hybrid collection mode, employing both agent-based and agentless methods, is used to collect multi-source heterogeneous log data.

[0013] The multi-source heterogeneous log data is converted to a standard format to obtain multi-source heterogeneous log data.

[0014] A cyclic redundancy check algorithm is used to perform integrity verification on the multi-source heterogeneous log data in the standard format to obtain standardized log data.

[0015] Optionally, the pre-trained semantic recognition model is a BERT deep learning model; the sensitive fields include identity, financial and account-related sensitive fields; the de-identification strategy includes at least one of masking strategy, replacement strategy, truncation strategy, encryption strategy, and custom regular expression de-identification strategy.

[0016] Optionally, an asymmetric searchable encryption algorithm is used to encrypt the de-identified log data to generate ciphertext logs and corresponding log digests, specifically including the following steps: A searchable encryption algorithm based on elliptic curve cryptography is used to treat the anonymized log data as plaintext, generating ciphertext logs and corresponding index vectors. The index vectors are used to achieve fast retrieval of the ciphertext logs and support retrieval without full decryption in the ciphertext state.

[0017] The SHA series of algorithms are used to calculate the log digest corresponding to the encrypted log.

[0018] Optionally, intelligent abnormal behavior detection, audit analysis, and integrity verification are performed based on the encrypted log and the log digest stored on the blockchain to obtain the log audit results, specifically including the following steps: The encrypted log is decrypted to obtain the decrypted log data.

[0019] The decrypted log data is input into the time-series behavior prediction model for abnormal behavior detection and audit analysis, and the abnormal behavior identification results are output, and a corresponding audit report is generated.

[0020] Obtain the integrity verification request and recalculate the log summary of the target log corresponding to the integrity verification request; the target log is the log data to be verified for integrity in the integrity verification request.

[0021] The log summary of the target log is compared with the log summary of the blockchain-preserved log stored in the blockchain notarization module to obtain the information comparison result.

[0022] Based on the information comparison results, it is determined whether the target log has been tampered with, and a log tampering judgment result is obtained; the log tampering judgment result, the abnormal behavior identification result, and the audit report constitute the log audit result.

[0023] Optionally, based on the information comparison results, it is determined whether the target log has been tampered with, and a log tampering determination result is obtained. This specifically includes the following steps: When the information comparison result shows that the log digest of the target log is inconsistent with the log digest after blockchain notarization, it is determined that the log tampering judgment result is that the target log has been tampered with.

[0024] When the information comparison result shows that the log digest of the target log is consistent with the log digest after blockchain notarization, it is determined that the log tampering judgment result is that the target log has not been tampered with.

[0025] Optionally, the intelligent anti-tampering log auditing method further includes a hierarchical key management step, specifically including the following steps: Multi-level independent keys are defined based on role-based permissions. Different operating entities are assigned exclusive keys, and all keys are stored in a hardware-secure encrypted carrier, supporting periodic automatic key rotation. The multi-level independent keys include system configuration keys, audit decryption keys, and collection and authentication keys.

[0026] In a second aspect, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the intelligent anti-tampering log auditing method described in any one of the above.

[0027] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the intelligent anti-tampering log auditing method described in any one of the above.

[0028] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the intelligent anti-tampering log auditing method described above.

[0029] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides an intelligent anti-tampering log auditing method, device, medium, and product. First, by standardizing log data format, it eliminates differences in data dimensions and field formats between logs from different business systems, enabling unified processing of multi-source heterogeneous log data and reducing the difficulty of subsequent log identification, encryption, and auditing. Second, it automatically identifies sensitive information within logs through a pre-trained semantic recognition model. Simultaneously, it adaptively matches desensitization strategies based on access permissions and business scenarios to desensitize sensitive fields, accurately distinguishing sensitive log content and achieving differentiated sensitive data masking. This avoids the leakage of sensitive information due to plaintext storage and transfer of logs, balancing data security and log availability in different business scenarios. Third, it encrypts desensitized logs using an asymmetric searchable encryption algorithm, separating the ciphertext logs and log digests for storage. The ciphertext logs are stored in a distributed database, ensuring large-capacity storage of massive logs and supporting rapid retrieval. Simultaneously, the log digests are uploaded separately to a blockchain evidence storage module, achieving physical isolation between log business data and verification credentials, preventing all evidence from becoming invalid if a single storage medium is tampered with. Furthermore, the log digests are stored on the blockchain using a blockchain-based notarization module. The immutability of this module solidifies the original verification credentials of the logs, enabling the log digests to be permanently stored on the blockchain. This locks the original verification credentials for each log entry, ensuring that the log digest cannot be deleted or modified once it's on the chain. This provides a fixed and reliable benchmark for subsequent log authenticity verification. Simultaneously, intelligent abnormal behavior detection and audit analysis are performed in conjunction with encrypted logs. Log integrity verification is completed using the on-chain solidified digests. This integrates behavioral risk identification and log authenticity verification into a single process, outputting complete log audit results in one go. It automatically identifies abnormal operations in the logs and simultaneously verifies whether the logs themselves have been tampered with, eliminating the need for two separate systems to perform auditing and verification, thus simplifying the entire log auditing process. Furthermore, the entire process of this application forms a complete closed loop of "log standardization - sensitive information desensitization - encrypted storage - on-chain digest solidification - auditing - integrity verification", which can realize integrated security management of the entire log lifecycle from collection - desensitization - encryption - evidence storage - auditing - verification. While ensuring the protection of sensitive log information and the storage of massive logs, it also ensures the authenticity and reliability of log data used for auditing, improves the accuracy and reliability of log audit results, and enhances the security, integrity and intelligent level of log data auditing. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 An application environment diagram of an intelligent anti-tampering log auditing method provided in an embodiment of this application; Figure 2 A flowchart illustrating an intelligent anti-tampering log auditing method provided in an embodiment of this application; Figure 3 A schematic diagram of the structure of an intelligent anti-tampering log auditing system provided in one embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0032] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0033] The purpose of this application is to provide an intelligent anti-tampering log auditing method, device, medium, and product, which is applicable to security and compliance auditing scenarios of government and enterprise information systems, cloud platforms, network devices, and databases. It can realize integrated security management and control of the entire log lifecycle, including collection, desensitization, encryption, evidence storage, auditing, and verification, expand the applicable scenarios of the technology, and improve the security, integrity, and intelligent level of log data auditing.

[0034] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] The intelligent anti-tampering log auditing method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be set up independently, integrated into server 104, or placed in the cloud or on another server. Terminal 102 can send multi-source heterogeneous log data to server 104. After receiving the multi-source heterogeneous log data, server 104 standardizes the multi-source heterogeneous log data to obtain standardized log data. Based on a pre-trained semantic recognition model, it automatically identifies various sensitive information in the standardized log data, and performs sensitive field desensitization processing by adaptively matching desensitization strategies based on access subject permissions and business usage scenarios to obtain desensitized log data. Finally, it encrypts the desensitized log data using an asymmetric searchable encryption algorithm to generate ciphertext logs and corresponding log digests, and then transmits the ciphertext... Logs are stored in a distributed database, and the log digest is simultaneously sent to a blockchain notarization module. The distributed database is used to store the encrypted logs, and the blockchain notarization module is a functional module used to perform blockchain notarization on the log digest. Based on the blockchain notarization module, the log digest is notarized on the blockchain, and the original verification certificate of the log is solidified using the immutability of the blockchain notarization module, resulting in a notarized log digest. Intelligent abnormal behavior detection, audit analysis, and integrity verification are performed based on the encrypted logs and the notarized log digest to obtain log audit results. Server 104 can feed back the obtained log audit results to terminal 102. In addition, in some embodiments, the intelligent anti-tampering log auditing method can also be implemented by server 104 or terminal 102 alone. For example, terminal 102 can directly perform intelligent anti-tampering log auditing on multi-source heterogeneous log data, or server 104 can obtain multi-source heterogeneous log data from the data storage system and perform intelligent anti-tampering log auditing on the multi-source heterogeneous log data.

[0036] The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, and IoT devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers, or it can be a cloud server.

[0037] In one exemplary embodiment, such as Figure 2 As shown, an intelligent anti-tampering log auditing method is provided. This method is executed by a computer device, specifically by a terminal or server alone, or by both a terminal and a server. In this embodiment, the method is applied to... Figure 1 Taking server 104 as an example, the following steps are included.

[0038] S1: Collect multi-source heterogeneous log data and perform standardization processing on the multi-source heterogeneous log data to obtain standardized log data.

[0039] S2: Based on a pre-trained semantic recognition model, automatically identify various sensitive information in the standardized log data, and perform sensitive field desensitization processing by adaptively matching desensitization strategies in combination with access subject permissions and business usage scenarios to obtain desensitized log data.

[0040] S3: The de-identified log data is encrypted using an asymmetric searchable encryption algorithm to generate ciphertext logs and corresponding log digests. The ciphertext logs are stored in a distributed database, and the log digests are sent to a blockchain evidence storage module. The distributed database is a database used to store the ciphertext logs, and the blockchain evidence storage module is a functional module used to perform blockchain evidence storage on the log digests.

[0041] S4: Based on the blockchain notarization module, the log digest is notarized on the blockchain, and the original verification certificate of the log is solidified by utilizing the immutability of the blockchain notarization module, thus obtaining the notarized log digest.

[0042] S5: Perform intelligent abnormal behavior detection, audit analysis, and integrity verification based on the encrypted log and the log summary after blockchain notarization to obtain the log audit results.

[0043] Implementing steps S1 to S5 above can achieve integrated security management of the entire log lifecycle, including collection, desensitization, encryption, evidence storage, auditing, and verification. This improves the security, integrity, and intelligent auditing of log data, and solves the problem that existing technologies cannot simultaneously address the needs of log tamper prevention, intelligent privacy desensitization, intelligent risk auditing, and integrity verification.

[0044] As an optional implementation, step S1 involves collecting multi-source heterogeneous log data and standardizing the multi-source heterogeneous log data to obtain standardized log data. This specifically includes the following steps: S11: Employs a hybrid collection mode of agent and agentless methods to collect multi-source heterogeneous log data.

[0045] S12: Perform format conversion processing on the multi-source heterogeneous log data to obtain multi-source heterogeneous log data in standard format.

[0046] S13: The cyclic redundancy check algorithm is used to perform integrity verification on the multi-source heterogeneous log data in the standard format to obtain standardized log data.

[0047] As an optional implementation, in step S2, the pre-trained semantic recognition model is a BERT deep learning model; the sensitive fields include identity, financial and account sensitive fields; the de-identification strategy includes at least one of masking strategy, replacement strategy, truncation strategy, encryption strategy and custom regular expression de-identification strategy.

[0048] As an optional implementation, in step S3, an asymmetric searchable encryption algorithm is used to encrypt the de-identified log data to generate ciphertext logs and corresponding log digests, specifically including the following steps: S31: Using a searchable encryption algorithm based on elliptic curve cryptography (ECC), the de-identified log data is used as plaintext to generate ciphertext logs and corresponding index vectors; the index vectors are used to realize fast retrieval of the ciphertext logs and support retrieval without full decryption in ciphertext state.

[0049] S32: Calculate the log digest corresponding to the encrypted log using the SHA (Secure Hash Algorithm) series of algorithms (e.g., SHA-256).

[0050] As an optional implementation, in step S5, intelligent abnormal behavior detection, audit analysis, and integrity verification are performed based on the encrypted log and the log digest stored on the blockchain to obtain the log audit result. This specifically includes the following steps: S51: Decrypt the encrypted log file to obtain the decrypted log data.

[0051] S52: Input the decrypted log data into the time-series behavior prediction model for abnormal behavior detection and audit analysis, output the abnormal behavior identification results, and generate the corresponding audit report.

[0052] S53: Obtain the integrity verification request and recalculate the log summary of the target log corresponding to the integrity verification request; the target log is the log data to be verified for integrity in the integrity verification request.

[0053] S54: Compare the log summary of the target log with the log summary of the blockchain-stored log stored in the blockchain notarization module to obtain the information comparison result.

[0054] S55: Based on the information comparison results, determine whether the target log has been tampered with, and obtain the log tampering judgment result; the log tampering judgment result, the abnormal behavior identification result, and the audit report constitute the log audit result.

[0055] As an optional implementation, in step S55, based on the information comparison result, it is determined whether the target log has been tampered with, and a log tampering determination result is obtained, specifically including the following situations: (1) When the information comparison result is that the log digest of the target log is inconsistent with the log digest after blockchain notarization, the log tampering judgment result is that the target log has been tampered with.

[0056] (2) When the information comparison result is that the log digest of the target log is consistent with the log digest after blockchain notarization, the log tampering judgment result is that the target log has not been tampered with.

[0057] Currently, traditional log encryption uses a single global master key. Key leakage leads to the complete plaintext disclosure of all logs. There is no hierarchical access control mechanism, allowing any operator to decrypt all logs, resulting in inadequate access control. Therefore, the intelligent anti-tampering log auditing method proposed in this application further includes a hierarchical key management step. Specifically, it involves dividing the data into multiple levels of independent keys based on role-based permissions, assigning exclusive keys to different operating entities, storing all keys in a hardware secure encryption carrier (HSM), and supporting periodic automatic key rotation. This addresses the aforementioned problems of traditional log encryption. The multiple levels of independent keys include a system configuration key, an audit decryption key, and a data collection authentication key, respectively tailored to administrators, auditors, and ordinary operators.

[0058] Based on the same inventive concept, this application also provides an intelligent anti-tampering log auditing system for implementing the intelligent anti-tampering log auditing method described above. The solution provided by this system is similar to the implementation scheme described in the above method; therefore, the specific limitations in the embodiments of the intelligent anti-tampering log auditing system provided below can be found in the limitations of the intelligent anti-tampering log auditing method described above, and will not be repeated here.

[0059] In one exemplary embodiment, such as Figure 3As shown, an intelligent anti-tampering log auditing system is provided. This system includes a log acquisition module, an intelligent desensitization module, a searchable encryption module, a log auditing module, and a blockchain evidence storage module. The log acquisition module primarily collects multi-source heterogeneous log data and standardizes it to obtain standardized log data. The intelligent desensitization module automatically identifies various sensitive information in the standardized log data based on a pre-trained semantic recognition model. It then adaptively matches desensitization strategies based on access permissions and business usage scenarios to perform desensitization processing on sensitive fields, resulting in desensitized log data. The searchable encryption module encrypts the desensitized log data using an asymmetric searchable encryption algorithm, generating ciphertext logs and corresponding log digests. The ciphertext logs are stored in a distributed database, and the log digests are sent to the blockchain evidence storage module. The blockchain evidence storage module performs blockchain evidence storage on the log digests and uses its immutable nature to solidify the original log verification credentials, resulting in blockchain-certified log digests. The log auditing module is primarily used to perform intelligent abnormal behavior detection, audit analysis, and integrity verification based on the encrypted logs and the log digests stored on the blockchain, thereby obtaining log audit results. Additionally, the system may include a key management module, which is mainly used to divide multi-level independent keys based on role-based permissions, assign exclusive keys to different operating entities, and store all keys in a hardware-secure encrypted carrier, supporting periodic automatic key rotation. The above modules work collaboratively to achieve full lifecycle security auditing of log data.

[0060] In this embodiment, the log collection module is used to collect multi-source heterogeneous log data from heterogeneous log sources. Multi-source heterogeneous log data refers to raw log data from multiple independent and different types of business or device sources, with inconsistent data formats, field structures, encodings, and output specifications. It supports various types such as operating system logs, application logs, network device logs, and database logs. The module converts the multi-source heterogeneous log data into standard format multi-source heterogeneous log data through preset format parsing rules and performs integrity verification on the standard format multi-source heterogeneous log data.

[0061] In this embodiment, the log collection module employs a hybrid collection mode combining agent and agentless methods. This includes both agent-based and agentless collection modes. The agent-based mode is suitable for fixed log sources such as servers and terminals, while the agentless mode is suitable for log sources where agents cannot be installed, such as network devices and cloud services. The log collection module incorporates over 100 heterogeneous log parsing rules and supports custom parsing templates. It converts the collected multi-source heterogeneous log data into a standardized format, such as JSON, containing timestamps, log source identifiers, event types, and content details. CRC32 (cyclic redundancy check) is used to ensure the integrity of the log data during the collection process.

[0062] In this embodiment, the intelligent desensitization module is used to dynamically desensitize sensitive data in standardized logs, including a sensitive field identification unit and a dynamic desensitization unit.

[0063] The sensitive field identification unit automatically identifies sensitive fields in logs based on the BERT deep learning model, including personal identification information, financial transaction information, account passwords, etc. After the log data is accessed by Flink, it first undergoes cleaning and preprocessing: special symbols and control characters are removed, and the text is truncated according to the maximum input length requirement of the BERT deep learning model, resulting in plain text data usable for model processing. The Java-implemented BERT tokenizer is then called to load the vocabulary and perform word segmentation on the cleaned text, generating a token sequence containing [CLS] and [SEP] identifiers, which is then converted into tensor format data such as input IDs and attention masks required by the model. In the Flink Rich Map Function operator, the constructed tensor data is input into the ONNX (Open Neural Network Exchange Format) model for session execution inference, obtaining the predicted label sequence corresponding to each token. Based on the label mapping configuration, the numeric labels output by the model are converted into corresponding sensitive field types, and combined with the token's position information in the original text, the type, content, and start and end positions of the sensitive fields in the logs are extracted. Finally, log data containing the sensitive field identification results is output for subsequent desensitization processing.

[0064] The dynamic de-identification unit dynamically selects de-identification strategies based on the log usage scenario (audit analysis, daily monitoring, compliance reporting) and user permissions. These strategies include replacement, masking, encryption, truncation, and custom regular expression de-identification strategies, and support user-defined de-identification rules.

[0065] In this embodiment, the sensitive field identification unit of the intelligent desensitization module adopts the BERT deep learning model. Through training on massive amounts of labeled log data, it achieves automatic identification of various sensitive fields such as ID card numbers, mobile phone numbers, bank card numbers, and account passwords, with an accuracy rate ≥98%. The dynamic desensitization unit presets replacement, masking, encryption, truncation, and custom regular expression desensitization strategies. The replacement strategy replaces sensitive fields with placeholders (e.g., replacing the middle four digits of a mobile phone number with asterisks, such as "138****1234"). The masking strategy hides the middle part of sensitive fields. The encryption strategy uses the AES-256 algorithm to encrypt sensitive fields. The truncation strategy truncates the first N characters of sensitive fields. The custom regular expression desensitization strategy allows operators to write their own regular expression rules, accurately locating special sensitive fields specific to business needs and not covered by general rules through regular expression matching, and completing the desensitization process to achieve personalized desensitization. The system automatically matches the desensitization strategy based on the user role (administrator, auditor, or ordinary operator) and usage scenario. For example, an auditor uses a masking strategy when viewing logs, and an encryption strategy is used when reporting for compliance.

[0066] In this embodiment, the searchable encryption module is used to encrypt and store the de-identified log data, while supporting efficient retrieval in the encrypted state. It adopts a searchable encryption algorithm based on elliptic curve cryptography to convert the log data into ciphertext and store it in a distributed database, and generates a log digest.

[0067] In this embodiment, the searchable encryption module employs a searchable encryption algorithm based on elliptic curve cryptography. The elliptic curve selected is secp256r1 (an elliptic curve cryptography algorithm with a 256-bit security level). The de-identified standardized logs are used as plaintext to generate an index vector and ciphertext. The ciphertext is stored in a distributed database (using an Elasticsearch cluster, supporting horizontal scaling). The index vector is used to achieve fast retrieval in the encrypted state, avoiding the inefficiency caused by decrypting all logs. Simultaneously, the SHA-256 log digest of the logs is calculated for subsequent integrity verification.

[0068] In this embodiment, the log auditing module is used to implement intelligent anomaly detection and audit analysis, including an abnormal behavior detection unit and an audit analysis unit.

[0069] The abnormal behavior detection unit constructs an abnormal behavior model based on machine learning algorithms. This model employs an LSTM model, which identifies dangerous behaviors such as abnormal logins, unauthorized operations, and malicious commands in real time by training normal behavior patterns in log data. In the Flink real-time computing environment, the abnormal behavior model is constructed as follows: First, normal behavior data from log data is collected as training samples. These samples are cleaned and feature extracted, and relevant features such as login behavior, operation behavior, and command execution are selected and converted into a vector format that Flink can process. Then, the vector-formatted training samples are input into the LSTM model, and the model is trained through code to fit normal behavior patterns, generating the trained abnormal behavior model. After deployment, the model receives log data in real time, extracts corresponding behavioral features, inputs them into the model, and compares them with the trained normal behavior patterns to automatically identify abnormal logins (login behavior outside of preset normal login periods or from uncommon login terminals / IPs) and dangerous behaviors such as unauthorized operations and malicious commands.

[0070] The audit analysis unit supports multi-dimensional audit retrieval by time range, log type, event level, and other dimensions, automatically generates compliance audit reports, and allows for traceability of the complete log flow. The specific process is as follows: It receives anonymized and encrypted log data; presets three search dimensions: time range, log type, and event level; and allows users to input search criteria to complete precise queries by writing search logic for each dimension. After summarizing the search results, it extracts key information required for compliance auditing and generates standardized audit reports based on preset compliance standards. Relying on the link identifiers retained during the log flow process, it achieves complete traceability of the log flow from access, identification, anonymization, storage to retrieval, ensuring the traceability of audit data.

[0071] In this embodiment, the abnormal behavior detection unit of the log audit module adopts an LSTM model. By training normal operation log data, a user behavior baseline is constructed. When the real-time collected log data deviates from the baseline by more than a preset threshold (default 3 times the standard deviation), it is judged as abnormal behavior, including abnormal login (such as login from a different location, multiple incorrect passwords), unauthorized operation (such as ordinary users accessing the administrator interface), malicious instructions (such as SQL injection, command injection), etc. The audit analysis unit supports multi-dimensional combined retrieval by time range, log source, event level (information, warning, error, critical), etc., and generates audit reports that comply with the network security level protection 2.0, SOX Sarbanes-Oxley Act and other compliance requirements. The reports support export in PDF and Excel formats and include the complete flow chain of logs from "collection-de-identification-encryption-storage-audit".

[0072] In this embodiment, the key management module adopts a role-based access control (RBAC) hierarchical key mechanism, i.e., a multi-role hierarchical key mechanism, including a system configuration key, an audit decryption key, and a collection authentication key. Automatic key rotation is supported. Different roles hold independent keys for collection nodes. The system configuration key is used by the administrator for system configuration, including key generation, distribution, and retrieval. The audit decryption key is used by auditors for retrieving and decrypting encrypted logs; each auditor has an independent key and can only decrypt and view log data within their authorized scope. The collection authentication key is used by ordinary operators for authentication during the log collection process, preventing unauthorized collection nodes from accessing the system. All keys are stored using a hardware-secure encrypted carrier and support automatic key rotation (default rotation every 90 days), thereby effectively improving key security.

[0073] In this embodiment of the application, the blockchain evidence storage module is used to upload the log digest information generated by the searchable encryption module to the consortium blockchain. By utilizing the immutability of the blockchain, the integrity of the log data is evidenced. When it is necessary to verify the integrity of the log, the log digest is recalculated and compared with the digest information on the blockchain to realize the authenticity verification of the log data.

[0074] In this embodiment, the blockchain evidence storage module adopts a consortium blockchain architecture, with nodes including an audit center node, a regulatory node, and a node belonging to the log source unit. The blockchain uses the PBFT (Practical Byzantine Fault Tolerance) consensus mechanism, with a consensus latency of ≤500ms. The blockchain evidence storage module receives SHA-256 log digests sent by the searchable encryption module, packages them onto the chain in chronological order, and each block contains the hash value of the previous block, forming an immutable chain structure. It supports querying the digest information on the blockchain by log source identifier and timestamp for log integrity verification.

[0075] Based on the above-mentioned intelligent anti-tampering log auditing system, its intelligent anti-tampering log auditing process specifically includes the following steps: Step 1: Log Collection and Standardization: The log collection module collects multi-source heterogeneous log data from various log sources, performs format conversion and integrity verification, and obtains standardized log data.

[0076] In this embodiment, the log collection module uses a hybrid collection mode of Agent and Agentless to collect multi-source heterogeneous log data from various log sources. It converts the data into a standardized JSON format through built-in parsing rules and uses CRC32 verification to ensure log integrity. If the verification fails, the data is collected again. An alarm is triggered after three failures.

[0077] Step 2: Intelligent Dynamic Desensitization: The intelligent desensitization module identifies sensitive fields in standardized log data through a deep learning model, dynamically selects desensitization strategies based on the usage scenario and user permissions, completes the desensitization processing of sensitive data, and obtains desensitized log data.

[0078] In this embodiment of the application, the BERT deep learning model of the intelligent desensitization module automatically identifies sensitive fields in standardized log data and matches desensitization strategies according to user roles and usage scenarios. For example, when a regular operator views a log containing a mobile phone number, a replacement strategy is used to convert the middle four digits of the mobile phone number into asterisks. When an auditor views the log, a masking strategy is used to convert the mobile phone number into "138****1234".

[0079] Step 3: Searchable Encrypted Storage: The searchable encryption module uses a searchable encryption algorithm based on elliptic curve cryptography to encrypt the de-identified log data, generate encrypted logs and corresponding log digests, store the encrypted logs in a distributed database, and send the log digests to the blockchain evidence storage module.

[0080] In this embodiment, the searchable encryption module uses the secp256r1 elliptic curve searchable encryption algorithm to encrypt the de-identified logs, generating ciphertext and SHA-256 log digest. The ciphertext is stored in the Elasticsearch distributed database, and the digest is sent to the blockchain evidence storage module.

[0081] Step 4: Blockchain Evidence Storage: The blockchain evidence storage module uploads the received log digest to the consortium blockchain for evidence storage.

[0082] In this embodiment of the application, the blockchain evidence storage module packages the received digest information in chronological order and stores it on the blockchain through the PBFT consensus mechanism. Each digest information is associated with a log source identifier and a timestamp, which facilitates subsequent query and verification.

[0083] Step 5: Intelligent Audit Analysis: The log audit module monitors the plaintext behavior corresponding to encrypted logs in real time based on machine learning models (authorized logs can be viewed by decrypting them with the auditor's key), identifies abnormal behavior, and generates audit reports.

[0084] In this embodiment, the auditor obtains the audit decryption key through the key management module, logs into the log audit module, and retrieves encrypted logs within the authorized scope. The system quickly locates the target log through the index vector of the searchable encryption algorithm, and displays it after decryption. The abnormal behavior detection unit monitors log data in real time based on the LSTM model. When abnormal behavior is detected, an alarm is immediately triggered (supporting three alarm methods: email, SMS, and system pop-up), and detailed information of the abnormal behavior is recorded (including log source, time, content, and operating subject).

[0085] Step 6: Log Integrity Verification: When it is necessary to verify the integrity of logs, first determine the target log to be verified, then recalculate the log digest of the target log and compare it with the corresponding log digest stored on the blockchain. If they match, it means that the target log is complete and has not been tampered with; if they do not match, it means that the target log is incomplete and has been tampered with.

[0086] In this embodiment of the application, when compliance verification requires checking the integrity of logs, the user inputs the log source identifier and time range of the target log. The system recalculates the SHA-256 log digest of the logs within that range and compares it with the corresponding digest information stored on the blockchain. If they match, the log is determined to be complete; if they do not match, the log is determined to have been tampered with, and an integrity verification report is generated.

[0087] The intelligent anti-tampering log auditing method and intelligent anti-tampering log auditing system proposed in this application have the following technical advantages: (1) Enhance log security: Logs are encrypted and stored by using searchable encryption algorithms, and log summaries are made immutable by combining blockchain evidence storage, thus providing double protection for the integrity and confidentiality of log data and effectively resisting internal and external tampering attacks.

[0088] (2) Intelligent dynamic desensitization: Based on deep learning, sensitive field identification and scenario-based dynamic desensitization strategy can maximize the retention of log audit value and improve desensitization flexibility while ensuring privacy and security.

[0089] (3) Improve audit efficiency: Intelligent detection of abnormal behavior is achieved through machine learning models, eliminating the need for manual configuration of rules, and can quickly locate security risks and adapt to dynamic attack scenarios.

[0090] (4) Optimize key management: Adopt a multi-role hierarchical key mechanism combined with hardware secure encryption carrier storage to avoid the overall security risk caused by the leakage of a single key and improve system security.

[0091] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 4As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores multi-source heterogeneous log data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an intelligent anti-tampering log auditing method.

[0092] Figure 4 The structures shown are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements. In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0093] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0094] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0095] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with relevant regulations and be authorized by the owner of the corresponding device.

[0096] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0097] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0098] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for intelligent anti-tampering log auditing, characterized in that, The intelligent anti-tampering log auditing method includes: Collect multi-source heterogeneous log data and perform standardization processing on the multi-source heterogeneous log data to obtain standardized log data; Based on a pre-trained semantic recognition model, various sensitive information in the standardized log data is automatically identified. Sensitive fields are then desensitized by adaptive matching desensitization strategies based on access subject permissions and business usage scenarios, resulting in desensitized log data. The de-identified log data is encrypted using an asymmetric searchable encryption algorithm to generate ciphertext logs and corresponding log digests. The ciphertext logs are then stored in a distributed database, while the log digests are sent to a blockchain evidence storage module. The distributed database is used to store the ciphertext logs, and the blockchain evidence storage module is a functional module used to perform blockchain evidence storage on the log digests. Based on the blockchain notarization module, the log digest is notarized on the blockchain, and the original verification certificate of the log is solidified by the immutability of the blockchain notarization module, so as to obtain the log digest after blockchain notarization. Based on the encrypted log and the log summary stored on the blockchain, intelligent abnormal behavior detection, audit analysis, and integrity verification are performed to obtain the log audit results.

2. The intelligent anti-tampering log auditing method according to claim 1, characterized in that, Collect multi-source heterogeneous log data and perform standardization processing on the multi-source heterogeneous log data to obtain standardized log data, specifically including: A hybrid collection mode, employing both agent-based and agentless methods, is used to collect multi-source heterogeneous log data. The multi-source heterogeneous log data is converted to a standard format to obtain multi-source heterogeneous log data. A cyclic redundancy check algorithm is used to perform integrity verification on the multi-source heterogeneous log data in the standard format to obtain standardized log data.

3. The intelligent anti-tampering log auditing method according to claim 1, characterized in that, The pre-trained semantic recognition model is a BERT deep learning model; the sensitive fields include identity, financial and account sensitive fields; the de-identification strategy includes at least one of the following: masking strategy, replacement strategy, truncation strategy, encryption strategy, and custom regular expression de-identification strategy.

4. The intelligent anti-tampering log auditing method according to claim 1, characterized in that, The de-identified log data is encrypted using an asymmetric searchable encryption algorithm to generate ciphertext logs and corresponding log digests, specifically including: A searchable encryption algorithm based on elliptic curve cryptography is used to treat the anonymized log data as plaintext, generating ciphertext logs and corresponding index vectors. The index vectors are used to achieve fast retrieval of the ciphertext logs and support retrieval without full decryption in the ciphertext state. The SHA series of algorithms are used to calculate the log digest corresponding to the encrypted log.

5. The intelligent anti-tampering log auditing method according to claim 1, characterized in that, Based on the encrypted log and the log digest stored on the blockchain, intelligent abnormal behavior detection, audit analysis, and integrity verification are performed to obtain log audit results, specifically including: The encrypted log is decrypted to obtain the decrypted log data; The decrypted log data is input into the time-series behavior prediction model for abnormal behavior detection and audit analysis, and the abnormal behavior identification results are output, and a corresponding audit report is generated. Obtain an integrity verification request and recalculate the log summary of the target log corresponding to the integrity verification request; the target log is the log data to be verified for integrity in the integrity verification request. The log summary of the target log is compared with the log summary of the blockchain-preserved log stored in the blockchain notarization module to obtain the information comparison result. Based on the information comparison results, it is determined whether the target log has been tampered with, and a log tampering judgment result is obtained; the log tampering judgment result, the abnormal behavior identification result, and the audit report constitute the log audit result.

6. The intelligent anti-tampering log auditing method according to claim 5, characterized in that, Based on the information comparison results, it is determined whether the target log has been tampered with, and the log tampering determination result is obtained, specifically including: When the information comparison result shows that the log digest of the target log is inconsistent with the log digest after blockchain notarization, it is determined that the log tampering judgment result is that the target log has been tampered with; When the information comparison result shows that the log digest of the target log is consistent with the log digest after blockchain notarization, it is determined that the log tampering judgment result is that the target log has not been tampered with.

7. The intelligent anti-tampering log auditing method according to claim 1, characterized in that, The intelligent anti-tampering log auditing method further includes: a hierarchical key management step, specifically including: Multi-level independent keys are defined based on role-based permissions. Different operating entities are assigned exclusive keys, and all keys are stored in a hardware-secure encrypted carrier, supporting periodic automatic key rotation. The multi-level independent keys include system configuration keys, audit decryption keys, and collection and authentication keys.

8. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that the processor executes the computer program to implement the intelligent anti-tampering log auditing method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the intelligent anti-tampering log auditing method according to any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the intelligent anti-tampering log auditing method according to any one of claims 1-7.

Images