2520 results about "Log data" patented technology

A network mapping behavior anomaly detection method and system based on machine learning is provided. The method includes: collecting dual-source traffic data, generating a structured log data set through dual-source log fusion engine; performing subgraph matching calculation to obtain a mapping behavior deviation degree; generating communication data containing a watermark identifier in a session corresponding communication path; verifying whether attack events carry the watermark identifier; generating a network mapping behavior anomaly detection report. According to the disclosure, an adaptive attack behavior model is constructed through a multi-modal feature vector based on structured logs and a graph protocol mapping rule base, so that the cognitive robustness to protocol camouflage and path drift is fundamentally enhanced, a real-time verification chain of detection results is built, and traditional passive detection is transformed into self-proof active defense through cross verification of watermark carrying state and behavior trajectory.

The invention relates to the field of log fault analysis, in particular to a log aggregation fault diagnosis method and system based on artificial intelligence. The method comprises the following steps: collecting a multi-modal heterogeneous log, carrying out sliding time sequence slicing processing, carrying out time sequence association sequence reconstruction, and constructing a time sequence reconstruction log data stream; log event deep semantic analysis is carried out on the time sequence reconstruction log data stream, event semantic topological evolution is carried out, and a multi-dimensional event topological representation matrix is constructed; performing routine event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix, and marking abnormal fault points; and the occurrence timestamp and the abnormal propagation rate of the abnormal fault point are calculated, fault space-time diffusion evolution is carried out, and a dynamic fault propagation path map is constructed. Through efficient and accurate fault traceability analysis, the fault diagnosis efficiency is greatly improved, and the stability and reliability of log data are improved.

Activity monitoring of a cloud compute environment based on container orchestration data may be performed by a data platform. For example, the data platform may obtain audit log data generated by a container orchestrator within a cloud compute environment, generate a data model based on the audit log data, and use the data model to monitor the activity for a security issue. The data model may be indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment and the monitored activity may be activity with respect to the one or more containerized applications. Corresponding methods, systems, and products are also disclosed.

The invention, which relates to the technical field of network awareness anomaly detection, discloses a network awareness anomaly detection system based on big data, comprising a data acquisition module, a feature fusion module, a map construction module, a model calculation module, a root cause reasoning module, a threshold decision module and a response control module. The data acquisition module receives network flow data, equipment state data and system log data and outputs a standardized feature set; the feature fusion module is connected with the data acquisition module, dynamically calculates a weight coefficient of each data source based on information entropy, performs feature aggregation of privacy protection through a federated learning framework, and outputs a fusion feature vector; the atlas construction module is connected with the feature fusion module, maintains a network equipment node set and a communication edge set in real time, and updates a space-time association atlas according to a topology change event; and the model calculation module is connected with the atlas construction module, extracts topological features through a space-time diagram convolutional network, and updates a detection model based on an incremental learning mechanism.

The invention provides an AI-based laboratory equipment scheduling optimization method and system, and the method comprises the steps: firstly obtaining a state monitoring data set containing the characteristics of equipment operation power consumption, idle time length, environment interference factors and the like in real time, and then carrying out the multi-dimensional analysis of the state monitoring data set; generating an availability evaluation index set containing characteristics of equipment load fluctuation, maintenance period prediction, compatibility matching and the like, and an experiment task priority queue, performing cross decision analysis on the availability evaluation index set and the experiment task priority queue based on a preset dynamic resource allocation model, and obtaining a scheduling strategy set containing a task allocation path, a cooperative operation rule and a conflict resolution mechanism; scheduling strategy parameters are calibrated according to experimental task operation log data, an optimized execution instruction set is generated, instructions are fed back to an equipment control system to adjust the equipment state, a dynamic resource allocation model is iteratively updated according to execution feedback data, and efficient scheduling optimization of laboratory equipment is achieved.

The invention relates to the technical field of database operation and maintenance, in particular to a database operation and maintenance decision-making method and device based on a large language model.The method comprises the steps that real-time operation indexes and historical log data of a database are collected, and multi-dimensional time sequence features are extracted; and analyzing the characteristics by using a large language model, judging whether a performance bottleneck or an abnormal risk exists or not, and determining the relevance between the performance bottleneck or the abnormal risk and a database performance problem. If the risk exists, acquiring a system load sudden change trend and a resource request rate, quantifying a system pressure degree, and inputting a performance optimization model to generate an adaptive tuning strategy; calculating statement complexity through an SQL audit log, and selecting an index adjustment strategy in combination with an index optimization model; evaluating the influence of the tuning strategy and the index strategy on the throughput, the response delay and the resource utilization rate, and determining a target high-performance strategy; according to the scheme, accurate optimization and efficient operation and maintenance of database performance are realized through intelligent analysis and dynamic adjustment and optimization.

The invention relates to a network attack tracing method and device based on a threat graph, equipment and a medium. The method comprises the steps of obtaining network security log data from multiple security data sources, and performing standardization processing to obtain a structured network security event data set; extracting threat entities and behavior relationships among the threat entities from the structured network security event data set to obtain an entity set and a relationship set; constructing a threat map according to the entity set and the relationship set, and performing time data slicing according to the timestamp to obtain a map snapshot and map metadata; based on a predefined attack chain template, identifying an attack chain sub-graph conforming to an attack behavior structure in the threat graph to obtain an attack chain set and a path reachability matrix; and according to the attack chain set and the path reachability matrix, attack path inversion is carried out by taking the target node as an end point, and an attack traceability path and a graph evolution process display result are obtained. By adopting the method, the network attack path can be identified and the attack source can be traced.

The invention relates to an intelligent operation and maintenance method and apparatus based on a knowledge graph and a large model, and an electronic device. The method comprises the steps of collecting multi-source runtime data of a Kubernetes cluster; constructing a knowledge graph with time dimension based on the resource change event, recording termination time in response to graph relationship failure, recording starting time in response to a newly added relationship and not setting the termination time, and associating the entity with the performance index and the log data; responding to the diagnosis request, scheduling a specialized agent by a coordination agent through multi-agent cooperation to retrieve associated information from multi-source data, and iteratively integrating to generate a structured context; and inputting the generated structured context information into a large model reasoning service to output a fault root cause diagnosis and solution. The technical problems that information dispersion and relevance are weak, root cause positioning is difficult and time-consuming, comprehensive context sensing ability is lacked and expert experience is excessively relied on are solved.

The invention discloses a privacy protection data sharing and cooperative training method and system based on federated learning. The method comprises the steps of receiving software development log data, adaptively judging the sensitivity degree according to a data type, dynamically adjusting noise disturbance intensity according to the sensitivity degree to perform data desensitization, and generating a sensitivity index; selecting a feature extraction strategy, extracting time sequence correlation features from the desensitization data, constructing a dynamic graph structure with a weight, and obtaining a time sequence feature vector through iterative fusion; calculating the time sequence correlation of the time sequence feature vector to obtain a data quality score, and setting a contribution weight based on the quality score to perform parameter aggregation; combining sensitivity indexes with data quality scores to construct a security sharing domain, decoupling global training parameters into knowledge fragments in the domain, formulating a recombination rule, and selectively acquiring the required knowledge fragments by all parties for local training. According to the method, deep collaboration is realized on the premise of protecting data privacy, and the collaboration training effect is improved.

Techniques for operating a chatbot system for enterprise-level conversational agents are disclosed. These techniques are performed by an application or cloud service executing on one or more computing devices. An enterprise system can deploy conversational agents onto user devices to run as chat interfaces for logging analytics question-answering. One example application or cloud service may be a multi-model chat mechanism configured to support these chat interfaces with backend functionality. In response to an incoming question, the chat mechanism first consolidates the question with any conversation history and then, classifies the user's question as either a question regarding unstructured document data, a question regarding structured log data, or a hybrid question. Based on the classification, the chat mechanism can generate a proper large language model (LLM) response.

The invention relates to the technical field of network operation and maintenance, in particular to an automatic operation and maintenance method and system based on artificial intelligence, and the method comprises the steps: collecting detailed log information containing a security event in real time through a security information and event management system configured at a target endpoint; performing cleaning, labeling and structured processing on the log data by utilizing a proxy artificial intelligence system to generate standardized metadata, and performing MITRE ATTamp with the standardized metadata; mapping the CK knowledge base, identifying technical features and behavior patterns of attacks, comparing enriched log data with an external threat intelligence source, analyzing TTP of a known attack group, generating a threat intelligence association report, generating a targeted response plan by using a large language model, generating an executable command sequence according to the response plan, and generating a threat intelligence association report; the proxy executor is connected with the server through a WebSocket protocol, executes a command in a POSIX shell environment, captures and returns an execution result, verifies the execution result, carries out necessary command optimization, records an optimized response to a vector database, and automatically matches a historical event and triggers a predefined response process through a vector retrieval mechanism. And continuous threat monitoring and adaptive response are realized. According to the method, the problem that a closed loop aiming at a terminal executor, data enrichment and historical event recall cannot be formed by security operation and maintenance in the prior art can be solved.

The invention relates to the technical field of engineering construction supervision, and discloses a building engineering construction supervision system based on big data analysis, and the system comprises a multi-modal data collection module which is used for collecting multi-source data of a construction site, and the multi-source data comprises structure sensor data, environment monitoring data, video image data, construction log data and building information model (BIM) state data; performing standardization processing and time synchronization on the data to generate a construction state data sequence; and the construction event modeling module identifies key events in the construction process based on the construction state data sequence and constructs a construction event graph, and the construction event graph is composed of event nodes representing construction events and event edges representing event collaboration or time correlation. By introducing an event atlas construction mechanism based on multi-source construction data driving, structured expression and semantic association mapping of key behavior units of a construction site are realized, and the problem of insufficient non-structured information processing capability in construction monitoring is overcome.

The invention relates to the field of semiconductor manufacturing, and discloses a wafer processing quality backtracking evaluation method driven by a cross-modal knowledge graph, comprising the following steps: acquiring and preprocessing time sequence process data and text log data; modeling the time series data by adopting a long short-term memory network to predict the defect probability, extracting entities and relationships from a text by adopting a BERT model, and respectively constructing a process knowledge graph, a defect knowledge graph and an equipment knowledge graph; aligning the cross-modal features by using a generative adversarial network, and fusing the cross-modal features into a unified cross-modal knowledge graph; based on the unified atlas, probability backtracking reasoning of defect causes is carried out, and an active process parameter correction strategy is generated; and outputting a comprehensive quality score through the self-weighted dynamic evaluation model. According to the method, intelligent closed loop from passive diagnosis to active optimization can be realized, the accuracy and efficiency of defect positioning are remarkably improved, and a dynamic and comprehensive quality evaluation means is provided.

The invention relates to the technical field of power system data processing and network security, in particular to a system log data anomaly detection and management system and method. The system comprises an atlas establishment module, an anomaly identification module and a feedback adjustment module. According to the method, the global knowledge graph is constructed through the graph establishment module, the deviation degree is calculated in combination with historical baselines, direct association anomalies are judged, the potential influence degree between nodes is calculated based on a graph neural network propagation mechanism through the anomaly recognition module, and non-direct association anomalies are recognized through feature vector cosine similarity. A multi-dimensional feature matching rule base is combined to determine an anomaly type and execute response measures, a feedback adjustment module collects execution data through buried points, quantifies and evaluates effectiveness, optimizes a scheme through feature backtracking and root cause positioning and relies on digital twinborn simulation and gray scale landing to realize scheme iteration, and a feedback adjustment module performs feedback adjustment. The accuracy of anomaly detection and the dynamic adaptation capability of response measures are improved, and the method is suitable for log management and risk prevention and control of a complex system.

The embodiment of the invention provides a fault cause determination method and device, a storage medium, electronic equipment and a computer program product, and relates to the field of data analysis, and the method comprises the steps: receiving a fault analysis request sent by a target object, and determining a preliminary fault cause list corresponding to the fault analysis request; an analysis task corresponding to the preliminary fault reason in the preliminary fault reason list is determined, the analysis task is executed to obtain abnormal data corresponding to the analysis task, and the abnormal data at least comprises one of abnormal log data, abnormal index data and abnormal service data; and determining the fault contribution evaluation information corresponding to the plurality of candidate fault reasons according to the abnormal data, and determining the target fault reason of the target fault in the plurality of candidate fault reasons according to the fault contribution evaluation information, thereby solving the problem of relatively long time consumption caused by determining the fault reason depending on personal experience in related technologies.

The invention relates to the technical field of application state diagnosis, in particular to an application state dynamic diagnosis and automatic repair method and system.The method comprises the steps that multi-source heterogeneous logs are collected and standardized in real time, key fields are extracted, context information is injected, and structured log data are generated; inputting the structured log data into a dynamic anomaly detection model, constructing a dual-path detection mechanism based on LSTM time sequence analysis and a graph neural network, identifying an abnormal mode and positioning a fault root cause; according to the output of the anomaly detection model, a repair action is triggered in a grading manner through an intelligent repair strategy engine; in the repairing process, system state changes are stored and recorded through a pre-writing type redundancy log, automatic rollback during abnormity is achieved on the basis of check point information, and data consistency and system stability are guaranteed. The problem of service interruption or data inconsistency possibly caused by traditional automatic repair is avoided, and the reliability of automatic operation and maintenance is improved.

The invention provides a server cluster operation and maintenance method based on multi-source heterogeneous data fusion and a dynamic knowledge graph, and the method comprises the following steps: collecting a performance index, a log text and topological structure data of a server cluster, splicing the performance data and the log data based on a unified time window, and generating a multi-modal feature sequence; and analyzing the sequence by using an unsupervised deep learning model, constructing a dynamic health baseline, and generating a health degree portrait through the deviation with real-time data. When an exception is detected, mapping an exception event into a dynamic topological graph constructed based on a topological structure; analyzing a fault propagation probability between nodes by using a graph neural network algorithm, positioning a root cause node, and generating a disposal strategy to execute disposal operation; and collecting the processed recovery data as a feedback signal, and updating the deep learning model by using incremental learning. The method has the beneficial effects that the fault discovery accuracy is improved, the alarm storm is effectively inhibited, the root cause is directly positioned, and the model self-iteration adaptability is higher.

The invention relates to the technical field of electrical testing, in particular to a battery testing method and system, and the method comprises the steps: obtaining a voltage data sequence and historical log data of each cell in a to-be-tested battery pack; determining a dynamic instability score of each battery cell according to the parameter volatility index of each battery cell and the spatial correlation weight between each battery cell and the adjacent battery cell; on the basis of the historical log data, analyzing a repeated cumulative effect of all historical damage events corresponding to each battery cell, and determining a historical damage degree of each battery cell; performing deep fusion on the dynamic instability score and the historical damage degree through a nonlinear function to obtain a comprehensive risk index of each battery cell; and based on the extreme values and distribution of the comprehensive risk indexes of all the cells, determining a fault degree capable of representing the overall health risk of the battery pack, and determining a health test result of the battery pack according to the fault degree. According to the method, the accuracy and reliability of battery pack testing are improved.

The invention relates to the technical field of power data analysis, and provides a power network user permission anomaly detection method and system based on time sequence behavior mining, which are used for improving the security situation awareness capability of a power network. The method comprises the steps of obtaining an authority operation log data set of a target power network user, performing time sequence behavior pattern extraction processing on the authority operation log data set, and generating a time sequence behavior feature set of the target power network user, and inputting the time sequence behavior feature set into a debugged permission anomaly detection model to perform multi-dimensional deviation analysis, generating a permission operation anomaly detection result of the target power network user, and triggering a permission risk early warning signal according to the permission operation anomaly detection result. And the authority risk early warning signal is sent to the power network authority management terminal so as to execute authority rechecking operation.

The invention provides a transformer substation operation and maintenance-based lock control terminal work log query method and system, and the method comprises the steps: collecting an original operation log stream generated by a transformer substation lock control terminal in a preset time period, serializing the original operation log stream to obtain a log data sequence, and then carrying out the context correlation analysis and recognition of an entity interaction relationship and behavior attribute description in a log text; a structured log metadata set is obtained after standardized integration; constructing a spatial topological index based on the physical layout and the electrical connection relationship of the substation equipment, mapping the equipment associated information in the spatial topological index to a corresponding node position of the spatial topological index, and generating a spatial enhanced log data set; receiving a natural language query request, generating a structured query expression, performing multi-dimensional retrieval matching on the spatial enhancement log data set, and outputting a preliminary query result set; and carrying out time sequence correlation analysis and operation influence evaluation on the log records to generate a query report. According to the invention, efficient and accurate query of the work log of the transformer substation lock control terminal can be realized.

The invention provides a private intelligent code collaborative optimization method and system based on graph retrieval, and relates to the technical field of software engineering intelligent auxiliary tools, and the method comprises the steps: obtaining a source code file and operation log data of a private project; the method comprises the following steps: performing syntax tree analysis on a source code file through a Tree-siter analyzer to generate a corresponding abstract syntax tree; constructing a code knowledge graph by analyzing a function call relationship, an inheritance relationship and a module dependency relationship; monitoring the change of a project file in the code knowledge graph through a code change event processor, and updating the code knowledge graph in real time when the file is changed; establishing an association relationship between the running log data and a corresponding function node in the code knowledge graph; the method comprises the following steps: analyzing a natural language problem of a developer into a Cypher query statement through an intelligent Agent; obtaining a query result from the graph database; and formatting the query result to generate a final result.

The invention discloses a two-phase immersed liquid cooling liquid level intelligent dynamic regulation and control system and method, and relates to the technical field of liquid cooling intelligent processing. The two-phase immersion type liquid cooling liquid level intelligent dynamic regulation and control method comprises the steps that S1, state observation data, execution control data and log data in the liquid cooling liquid level regulation and control process are collected and preprocessed, and a standardized liquid cooling state data set is constructed; s2, the synchronism of the evaporation strengthening trend is evaluated, and the opening degree of an electronic control valve is adjusted; s3, analyzing a control feasible region under gas-liquid balance constraint, and optimizing the working mode of the two-way pump; and S4, the consistency of the feedback trend and the rolling decision is analyzed, and the circulating flow of the cooling coil and the heat exchange intensity of the condenser are adjusted. The problems that when power consumption of an existing two-phase immersion liquid cooling system changes dramatically, due to lag control of a single sensor and lack of multi-dimensional data prediction, evaporation and liquid supplementing actions are prone to being mismatched, and liquid level decline, pressure abnormity and chip dry burning are caused are solved.

The invention relates to the technical field of cable aging diagnosis, in particular to a cable aging diagnosis monitoring method and system. The method comprises the following steps: acquiring cable operation log data and cable internal structure design data, extracting a cable structure distribution condition in combination with an operation log, and evaluating cable operation state data; electric power sudden demand characteristics are identified, and then a non-uniform thermal coupling unbalance state is determined; based on the thermal coupling unbalance and the operation state data, detecting the coupling failure condition of the cable multilayer structure, and further judging the structural integrity damage condition; deducing a load stability disintegration situation according to a structure damage and insulation strength reduction trend; further detecting the decline of the quality of transmitted electric energy, analyzing the increase degree of abnormal voltage fluctuation, and identifying the fatigue trend of the metal material of the cable; through the above cable aging diagnosis, the cable aging diagnosis data is output. According to the cable aging diagnosis method and device, cable aging diagnosis is diagnosed, so that cable aging diagnosis is more accurate and efficient.

The invention relates to a multi-account security management method and system based on a mobile energy storage charging pile. According to the method, a multi-level user account system and a dynamic authority management mechanism are established, a dynamic token carrying authority attributes is generated through encryption verification to achieve access control, user operation is captured in real time to generate log data with an identity label, the log data are synchronized with a cloud end, and an equipment control instruction is generated in combination with Internet of Things data collection and authority verification. Meanwhile, authority rules are dynamically updated, whole-course tracing of operation behaviors of the charging pile system, real-time effectiveness of authority change and linkage management and control of equipment states and user authorities are achieved, and the problem that potential safety hazards are caused by extensive authority control, difficult operation tracing and authority strategy lagging of a traditional charging pile management system is effectively solved.

The invention discloses an electric energy meter detection assembly line fault diagnosis and prediction method based on multi-modal time sequence analysis. The method comprises the steps of collecting multi-modal data including electric energy meter visual data, time sequence sensor data and text log data in real time; performing cross-modal fusion of time sequence alignment on the multi-modal data to generate joint feature representation; performing joint optimization of fault diagnosis and prediction; performing fault diagnosis based on the joint feature representation, and outputting a current fault type and probability; predicting a future fault probability based on the equipment state continuous evolution model; in response to batch conduction characteristics which are output by the prediction model and reach a preset abnormal value, triggering recalculation of the associated modal data; correcting an initial condition of the equipment state continuous evolution model according to the fault type obtained through re-calculation; and dynamically adjusting a diagnosis decision threshold according to the prediction confidence output by the corrected equipment state continuous evolution model.

The invention provides an intelligent task scheduling and optimizing method and system, a medium and equipment, and the method comprises the steps: analyzing task metadata through a database storage process, generating a task dependency graph according to an obtained task dependency matrix, and converting the task dependency graph into a visual interaction interface; identifying a key link with longest time consumption and a bottleneck task on the key link through the created time prediction model, and generating a multi-dimensional optimization suggestion based on an identification result; automatically adjusting a task scheduling script according to the multi-dimensional optimization suggestion and generating a standardized configuration file, dynamically allocating resources according to the standardized configuration file, and monitoring an execution state of a task through a fault-tolerant mechanism; and performing intelligent early warning according to the task log data collected in real time and the system performance index, and generating a multi-dimensional analysis report. The system is an intelligent scheduling system integrating dependency analysis, link optimization and execution monitoring, and automatic analysis and optimization of a complex task network are achieved.

Methods, systems, and machine-readable mediums to perform a neural network to encode log data. In at least one embodiment, a processor comprising one or more circuits to encode at least one log message, at least in part, by encoding a first type of information in the at least one log message to obtain a first encoding, encoding a second type of information in the at least one log message to obtain a second encoding, and obtaining a resultant encoding at least in part by combing at least the first and second encodings.

The invention relates to the technical field of data storage, and discloses an intelligent hierarchical storage method and system for cold and hot data of a solid state disk, and the method comprises the steps: collecting spatial position change data and vibration state data, and carrying out the preprocessing to obtain a multi-dimensional feature data set; performing quantification processing on the influence degree of the spatial position change data and the vibration state data to obtain an interference weight value; constructing a joint feature matrix based on the interference weight value and the historical access record, and predicting hotspot data distribution; if the matching degree of the hotspot data distribution and the current storage layout is lower than a preset matching degree threshold value, migrating the high-frequency access data to a low-delay area to obtain an optimized storage layout; when the access response time is larger than a preset time threshold value, log data are generated, and delay load features are extracted; and carrying out secondary adjustment on the optimized storage layout to obtain a final dynamic storage scheme. According to the method, dynamic optimization of the storage performance of the solid state disk can be realized, and delay loss caused by cold and hot data mismatching is reduced.

The invention discloses a network attack cross-platform collaborative protection processing method and device, and relates to the technical field of network security. The method comprises the following steps: each heterogeneous security device captures security log data in real time, converts the security log data into an uplink protocol message containing security event semantic description, and sends the uplink protocol message to a central server; analyzing and reasoning the uplink protocol message through a built-in large language model to construct an attack chain of a network attack behavior, generating a downlink protocol message containing an action intention based on the attack chain and a preset disposal strategy library, and sending the downlink protocol message to the target heterogeneous security device; and the target heterogeneous security equipment converts the downlink protocol message into an operation instruction which can be executed by the target heterogeneous security equipment through a built-in translation engine. According to the method, different types of safety equipment logs and instructions are converted into unified semantic information which can be understood by a machine in the interaction process, and real-time association, intention recognition and automatic two-way cooperation of safety events are achieved.

A computer system retrieves provisioning data and observability data (metrics, logs, events, alerts, inventory) for a plurality of components from remote servers. The computer system extracts component identifiers from the provisioning data and the log data. The computer system identifies relationships between components from the provisioning data and the log data, such as environmental variable relationships, network relationships, session relationships, access relationships, and network connection relationships. The computer system generates a topology in which nodes represent components and edges represent relationships. The topology is updated to show changes to components and relationships. A user may interact with a visual representation of the topology to change data displayed or invoke changes to the components and relationships represented by the topology.