3656 results about "Log data" patented technology

A network mapping behavior anomaly detection method and system based on machine learning is provided. The method includes: collecting dual-source traffic data, generating a structured log data set through dual-source log fusion engine; performing subgraph matching calculation to obtain a mapping behavior deviation degree; generating communication data containing a watermark identifier in a session corresponding communication path; verifying whether attack events carry the watermark identifier; generating a network mapping behavior anomaly detection report. According to the disclosure, an adaptive attack behavior model is constructed through a multi-modal feature vector based on structured logs and a graph protocol mapping rule base, so that the cognitive robustness to protocol camouflage and path drift is fundamentally enhanced, a real-time verification chain of detection results is built, and traditional passive detection is transformed into self-proof active defense through cross verification of watermark carrying state and behavior trajectory.

The invention relates to the field of log fault analysis, in particular to a log aggregation fault diagnosis method and system based on artificial intelligence. The method comprises the following steps: collecting a multi-modal heterogeneous log, carrying out sliding time sequence slicing processing, carrying out time sequence association sequence reconstruction, and constructing a time sequence reconstruction log data stream; log event deep semantic analysis is carried out on the time sequence reconstruction log data stream, event semantic topological evolution is carried out, and a multi-dimensional event topological representation matrix is constructed; performing routine event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix, and marking abnormal fault points; and the occurrence timestamp and the abnormal propagation rate of the abnormal fault point are calculated, fault space-time diffusion evolution is carried out, and a dynamic fault propagation path map is constructed. Through efficient and accurate fault traceability analysis, the fault diagnosis efficiency is greatly improved, and the stability and reliability of log data are improved.

The invention discloses a security event log real-time monitoring and analyzing system and method for a power grid communication network, and relates to the technical field of network security management. The causal relationship graph building module is used for building a causal relationship graph of the target power grid communication network; the multi-dimensional correlation analysis module is used for collecting and analyzing multi-source heterogeneous log data in real time; the abnormal security event identification module is used for identifying an abnormal security event according to the causal relationship graph and the multi-dimensional correlation analysis result; and the attack chain tracking response module is used for tracking the attack chain. According to the method, the technical problem that the existing power grid communication network security monitoring lacks tracking of abnormal event evolution from the time dimension and cannot accurately identify and track a multi-stage attack chain is solved, and the effects of dynamically tracking the evolution process of the abnormal event and identifying a potential attack chain by establishing a time causal chain graph are achieved. And the detection precision and the response speed of the attack behavior are improved.

The invention relates to the technical field of network security, in particular to a computer network information security monitoring method, system and device and a medium, and the method comprises the steps: obtaining encrypted traffic data and application log data in a network environment, and constructing a space-time associated original data set based on the encrypted traffic data and the application log data; performing protocol analysis on the original data set with the time-space association to generate a protocol fingerprint feature vector; inputting the protocol fingerprint feature vector and the application log data into a preset heterogeneous multi-modal analysis model, and obtaining a multi-dimensional security situation assessment result containing a threat level and an attack path; and based on the multi-dimensional security situation assessment result, generating a dynamic defense strategy instruction set through a reinforcement learning algorithm, and issuing a strategy instruction to a network execution node in real time. The method and the device have the effects of realizing real-time accurate detection of encryption threats and constructing a dynamic defense system with balanced security and efficiency.

Analyzing log data from multiple sources across computing environments, including: re receiving log data from multiple sources; identifying, by an anomaly detection framework, an anomaly based on the log data; and providing an alert for the anomaly.

Activity monitoring of a cloud compute environment based on container orchestration data may be performed by a data platform. For example, the data platform may obtain audit log data generated by a container orchestrator within a cloud compute environment, generate a data model based on the audit log data, and use the data model to monitor the activity for a security issue. The data model may be indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment and the monitored activity may be activity with respect to the one or more containerized applications. Corresponding methods, systems, and products are also disclosed.

The invention relates to the technical field of server load management and dynamic resource scheduling, and discloses a server load state evaluation method based on a dynamic evaluation algorithm, which comprises the following steps: data acquisition: acquiring performance index data, log data and network flow data from a multi-modal data source of a server; data preprocessing: performing time alignment, data cleaning, feature extraction and normalization processing on the acquired data; and self-supervised learning modeling: extracting feature representation from the multi-modal data through a self-supervised pre-training task, wherein the self-supervised pre-training task comprises a time sequence covering prediction task. Through multi-modal data fusion and self-supervised learning, the dynamic characteristics of the server load are accurately extracted, real-time load classification, anomaly detection and trend prediction are realized, the evaluation precision and real-time performance are significantly improved, and at the same time, a resource scheduling strategy of rule driving and reinforcement learning is combined, the server resource allocation efficiency is optimized, and the overload risk is reduced.

The invention, which relates to the technical field of network awareness anomaly detection, discloses a network awareness anomaly detection system based on big data, comprising a data acquisition module, a feature fusion module, a map construction module, a model calculation module, a root cause reasoning module, a threshold decision module and a response control module. The data acquisition module receives network flow data, equipment state data and system log data and outputs a standardized feature set; the feature fusion module is connected with the data acquisition module, dynamically calculates a weight coefficient of each data source based on information entropy, performs feature aggregation of privacy protection through a federated learning framework, and outputs a fusion feature vector; the atlas construction module is connected with the feature fusion module, maintains a network equipment node set and a communication edge set in real time, and updates a space-time association atlas according to a topology change event; and the model calculation module is connected with the atlas construction module, extracts topological features through a space-time diagram convolutional network, and updates a detection model based on an incremental learning mechanism.

The invention provides a network security protection method and system based on information fusion, and the method comprises the steps: firstly obtaining a multi-source heterogeneous data set, which comprises a traffic interaction data unit, an equipment log data unit and a protocol analysis data unit, of a target network, then carrying out the time sequence correlation analysis of the traffic interaction data unit, and generating a traffic behavior feature set; and executing state mode analysis on the equipment log data unit to generate an equipment operation feature set, and executing semantic recognition on the protocol analysis data unit to generate a protocol analysis feature set. Then, on the basis of a multi-dimensional feature fusion rule, cross-dimensional feature fusion processing is carried out on the feature set, and a network situation feature set is generated; and calling a threat identification model to carry out threat identification on the set, generating a threat identification result set containing threat type identifiers and influence range parameters, and finally generating a security response strategy set according to the threat identification result and issuing the security response strategy set to a security control node to execute protection operation, thereby effectively improving the network security protection capability.

The invention discloses a log abnormal behavior analysis method and system based on sorting learning and an attention mechanism, and relates to the technical field of system operation and maintenance. The method comprises the following steps: performing structured analysis on original log data and constructing a log sequence; extracting a periodic component, a trend component and a residual component through periodic neural decomposition; generating a running phase label based on the service calling relation and labeling a log sequence; modeling an association structure between log events by using a multi-head attention mechanism of phase perception, and outputting an abnormal score in combination with a sorting learning strategy; fusing the periodic stability index and the abnormal score to construct a health measurement value, and executing abnormal judgment and alarm strategy control based on a joint result; a structure-limited confrontation sample mechanism and structure deviation detection are introduced in the training and reasoning process, and the robustness of the model to structure disturbance is enhanced. The method has the technical advantages of being high in periodic modeling adaptability, high in anomaly detection precision, excellent in structure defense capability and the like.

The invention discloses a network security threat intelligent identification and defense method based on artificial intelligence, and the method comprises the steps: S1, collecting network flow data, user behavior data and system log data from a network security system, and outputting a finally converged network feature data set; s2, performing global optimization search on the network feature data set by applying a hyper-entropy differential evolution algorithm to generate network feature data optimized by hyper-entropy differential evolution; s3, constructing a network traffic anomaly detection probability model based on variational Bayesian reasoning by using the network feature data after hyper-entropy differential evolution optimization; s4, inputting the network feature data set into the network traffic anomaly detection probability model, and evaluating the risk probability of an abnormal behavior; and S5, generating a self-adaptive defense strategy based on a detection result, and forming defense strategy data. According to the invention, the overall stability and defense capability of the network security system are improved.

The invention discloses an AI data warehouse full-link blood relationship tracking method and device, and relates to the technical field of data processing. The method comprises the following steps: obtaining structured log data with business terms and entity tags; establishing a knowledge graph according to the structured log data and the business document; generating blood relationship metadata according to the knowledge graph and the data job execution log; constructing a blood relationship cognition map according to the blood relationship metadata, the data operation log and the business document; generating a governance strategy vector according to the blood relationship cognitive map, the system real-time index and the service SLO, and sending the governance strategy vector to an execution engine, so that the execution engine carries out processing according to the governance strategy vector; and obtaining a governance strategy execution result, user feedback information of the governance strategy execution result and a system log generated in a governance process. According to the method, complex semantics and causal relationships behind data operation can be captured.

The invention provides an AI-based laboratory equipment scheduling optimization method and system, and the method comprises the steps: firstly obtaining a state monitoring data set containing the characteristics of equipment operation power consumption, idle time length, environment interference factors and the like in real time, and then carrying out the multi-dimensional analysis of the state monitoring data set; generating an availability evaluation index set containing characteristics of equipment load fluctuation, maintenance period prediction, compatibility matching and the like, and an experiment task priority queue, performing cross decision analysis on the availability evaluation index set and the experiment task priority queue based on a preset dynamic resource allocation model, and obtaining a scheduling strategy set containing a task allocation path, a cooperative operation rule and a conflict resolution mechanism; scheduling strategy parameters are calibrated according to experimental task operation log data, an optimized execution instruction set is generated, instructions are fed back to an equipment control system to adjust the equipment state, a dynamic resource allocation model is iteratively updated according to execution feedback data, and efficient scheduling optimization of laboratory equipment is achieved.

The invention provides an emergency command converged communication system resource dynamic scheduling method based on artificial intelligence. The method comprises the following steps: S1, acquiring a plurality of sensors and log data of an emergency command system; constructing a dynamic graph neural network optimization communication topology, and selecting an optimal communication path; combining resource prediction and the optimized communication topology to formulate a global optimal resource scheduling strategy, and generating an optimal resource allocation scheme for each task; the resource pool comprises available computing resources and communication bandwidth; dynamically adjusting resource allocation and a communication path in a task execution process, and generating task execution feedback of a corresponding task; the system state is monitored in real time, and resource prediction, topology adjustment and scheduling strategies are optimized based on execution error feedback of task execution feedback. According to the method, efficient and intelligent dynamic resource scheduling is realized in an emergency command converged communication system through resource prediction of self-supervised learning, self-adaptive topological optimization of a variable topological graph neural network and global scheduling of reinforcement learning driving.

The invention relates to the technical field of database operation and maintenance, in particular to a database operation and maintenance decision-making method and device based on a large language model.The method comprises the steps that real-time operation indexes and historical log data of a database are collected, and multi-dimensional time sequence features are extracted; and analyzing the characteristics by using a large language model, judging whether a performance bottleneck or an abnormal risk exists or not, and determining the relevance between the performance bottleneck or the abnormal risk and a database performance problem. If the risk exists, acquiring a system load sudden change trend and a resource request rate, quantifying a system pressure degree, and inputting a performance optimization model to generate an adaptive tuning strategy; calculating statement complexity through an SQL audit log, and selecting an index adjustment strategy in combination with an index optimization model; evaluating the influence of the tuning strategy and the index strategy on the throughput, the response delay and the resource utilization rate, and determining a target high-performance strategy; according to the scheme, accurate optimization and efficient operation and maintenance of database performance are realized through intelligent analysis and dynamic adjustment and optimization.

The invention discloses a cloud platform auditing method based on multi-modal data processing, and relates to the technical field of cloud platform auditing. Independent features of text, image, audio, video and log data are extracted, each piece of modal information can be subjected to refined analysis in a corresponding feature space, and in a cross-modal feature fusion stage, a multi-modal feature fusion model is obtained. The correlation between different modal data is calculated by using a cross-modal consistency comparison network CMCN, and feature alignment is optimized through an attention mechanism, so that multi-modal information can be mutually verified, and misjudgment and missed judgment caused by independent auditing are reduced; in the auditing decision-making link, an auditing model based on deep learning is constructed, and end-to-end illegal content judgment is realized in combination with anomaly detection and a self-adaptive risk control threshold value, so that the intelligent level of an auditing system is improved; in addition, the suspicious areas of the image and the video are visually marked, and an auditing conclusion is generated by utilizing a natural language to generate an NLG model, so that the auditing result is more transparent.

The invention relates to a network attack tracing method and device based on a threat graph, equipment and a medium. The method comprises the steps of obtaining network security log data from multiple security data sources, and performing standardization processing to obtain a structured network security event data set; extracting threat entities and behavior relationships among the threat entities from the structured network security event data set to obtain an entity set and a relationship set; constructing a threat map according to the entity set and the relationship set, and performing time data slicing according to the timestamp to obtain a map snapshot and map metadata; based on a predefined attack chain template, identifying an attack chain sub-graph conforming to an attack behavior structure in the threat graph to obtain an attack chain set and a path reachability matrix; and according to the attack chain set and the path reachability matrix, attack path inversion is carried out by taking the target node as an end point, and an attack traceability path and a graph evolution process display result are obtained. By adopting the method, the network attack path can be identified and the attack source can be traced.

The invention discloses an abnormal behavior detection method and system based on a multi-source log and electronic equipment, and the method comprises the steps: collecting log data, carrying out alignment processing and data preprocessing, and generating normalized log data; carrying out attribute screening on the standardized log data set, and packaging the screened logs into a JSON format; extracting features of the log data, converting the features into data points, clustering the data points, and retaining a log cluster according to a clustering result; mining a hidden association mode between log attribute items in the log cluster by using an improved Apriori algorithm, generating an association rule, and constructing a knowledge graph based on the association rule; and constructing a time sequence of the log data by using a self-adaptive time window, and inputting the time sequence and the tag sequence of the log data into the LSTM neural network by combining context information in the knowledge graph and a tag sequence generated by an association rule to obtain an abnormal behavior detection result. According to the method, the log data format is unified, correlation analysis is enhanced, and the accuracy of an anomaly detection result is obviously improved.

The invention discloses a trajectory portrait generation method and system based on artificial intelligence, and the method comprises the steps: generating a structured data flow graph according to a dynamic access log, a data operation behavior record and an authority change event of an enterprise heterogeneous data source; outputting high-order semantic feature representation of data flow by using a space-time diagram neural network based on the structured data flow map; according to the high-order semantic feature representation, multi-source semantic features are fused through a cross-modal attention mechanism, and a global embedding vector of the data track is generated; and based on the global embedded vector, simulating a path evolution process of data flow by adopting a dynamic brain network evolution model, predicting a potential abnormal diffusion path through a nonlinear kinetic equation, and generating a risk-aware trajectory portrait. By utilizing the embodiment of the invention, the expression capability of the track portrait can be improved, and an advanced technical basis is provided for enterprise safety management, operation optimization and decision support.

The invention relates to the field of computers, in particular to a micro-service fault positioning method and device based on causal inference and a knowledge graph. The method comprises the following steps: firstly, collecting an original calling link, a multi-dimensional time sequence index and log data of a micro-service system, analyzing the correlation of micro-service indexes by using a partial correlation algorithm, then inferring the causal relationship of the indexes by using a structural causal model, and mapping the causal relationship of the indexes to specific service calling by using a principal component analysis method. And constructing a service dependency relationship. And then defining a knowledge graph ontology, constructing a fault dependency graph according to an index causal relationship and a service dependency relationship, and fusing the fault dependency graph with a calling link graph to form a complete fault dependency knowledge graph with multi-level influence. And finally, storing the graph in a graph database, taking exception as a service node starting point, and outputting a fault root cause candidate set through exception detection, random walk and node score calculation. According to the invention, the efficiency and accuracy of fault positioning are improved, and the stable operation of the micro-service system is ensured.

The embodiment of the invention discloses an optical module health state detection method and device, a storage medium and a program product. The method comprises the following steps: extracting time sequence features from time sequence data of an optical module, and extracting key features from system log data of the optical module; fusing the time sequence features and the key features based on the constructed hybrid model, and generating fused features to obtain a current health degree score of the optical module; collecting a historical health degree score of the optical module in a preset time range; detecting at least one environmental parameter of the environment where the optical module is located; obtaining a dynamic threshold value of the optical module based on the historical health degree score and the environmental parameters; and judging the health state of the optical module based on the relationship between the current health degree score and the dynamic threshold. According to the method, the health state of the optical module can be comprehensively, accurately and efficiently evaluated based on multi-dimensional data features, powerful support is provided for operation and maintenance management of the optical module, and the method is of great significance in guaranteeing service continuity and reducing operation and maintenance cost.

The invention discloses a multi-modal data fusion network attack detection method, and relates to the technical field of computer network security, and the method comprises the following steps: 1, network flow data collection and attribute analysis; step 2, multi-dimensional feature extraction and attack path drawing; 3, cross-modal data fusion and model construction integration are carried out; 4, model activation enabling and attack route evaluation; and 5, real-time data access and attack detection judgment. According to the multi-modal data fusion network attack detection method, through detailed analysis of multi-dimensional attributes of network flow data, potential feature information in the data is comprehensively mined, and multi-source information such as an attack path diagram, terminal equipment log data and threat intelligence data is further fused; and cross-modal interactive learning is carried out to construct a multi-modal attack detection model, so that the limitation of traditional single data source detection is broken through, and the relevance and complementarity among data are fully utilized.

The invention relates to an intelligent operation and maintenance method and apparatus based on a knowledge graph and a large model, and an electronic device. The method comprises the steps of collecting multi-source runtime data of a Kubernetes cluster; constructing a knowledge graph with time dimension based on the resource change event, recording termination time in response to graph relationship failure, recording starting time in response to a newly added relationship and not setting the termination time, and associating the entity with the performance index and the log data; responding to the diagnosis request, scheduling a specialized agent by a coordination agent through multi-agent cooperation to retrieve associated information from multi-source data, and iteratively integrating to generate a structured context; and inputting the generated structured context information into a large model reasoning service to output a fault root cause diagnosis and solution. The technical problems that information dispersion and relevance are weak, root cause positioning is difficult and time-consuming, comprehensive context sensing ability is lacked and expert experience is excessively relied on are solved.

The invention discloses a data fragment storage index optimization method and system, and relates to the technical field of data fragment storage, and the method comprises the steps: determining an observation time period according to a data access mode and short-term fluctuation characteristics; monitoring data performance, and performing log data analysis; and performing data resource adjustment, and adjusting task allocation. According to the method, data loading is efficiently managed and adjusted, the user experience and reliability of a system are improved, the importance of a dynamic data management method based on the observation time period is highlighted, hot spot fragments can be recognized in time when the load is too high through setting of a dynamic threshold value, and therefore effective measures are taken, and the workload of a user is reduced. According to the method and the device, the waste of system resources is reduced, the use efficiency of the resources is improved, data operation can be completed under the condition that a main thread is not interfered, the data transmission efficiency and the storage utilization rate are improved, and the overall processing capacity and fluency of the system are improved.

The present invention relates to the technical field of computers, and provides a log processing method and system, a log management platform, and an electronic device. The method comprises: acquiring real-time log data of each service system, and storing the log data in a message queue; according to a preset time window, writing the log data in the message queue into a target file of a specified storage directory; and in response to completion of data writing of a current time window, on the basis of the storage directory of the target file, calling a log analysis interface of a log analysis service to perform log analysis on the target file. The log processing method in the present invention reduces the risk incident rate of service systems, and improves the localization accuracy of an anomaly condition of a service log.

Techniques for determining a response of a simulated vehicle to a simulated object in a simulation are discussed herein. Log data captured by a physical vehicle in an environment can be received. Object data representing an object in the log data can be used to instantiate a simulated object in a simulation to determine a response of a simulated vehicle to the simulated object. Additionally, one or more trajectory segments in a trajectory library representing the log data can be determined and instantiated as a trajectory of the simulated object in order to increase the accuracy and realism of the simulation.

The invention discloses a privacy protection data sharing and cooperative training method and system based on federated learning. The method comprises the steps of receiving software development log data, adaptively judging the sensitivity degree according to a data type, dynamically adjusting noise disturbance intensity according to the sensitivity degree to perform data desensitization, and generating a sensitivity index; selecting a feature extraction strategy, extracting time sequence correlation features from the desensitization data, constructing a dynamic graph structure with a weight, and obtaining a time sequence feature vector through iterative fusion; calculating the time sequence correlation of the time sequence feature vector to obtain a data quality score, and setting a contribution weight based on the quality score to perform parameter aggregation; combining sensitivity indexes with data quality scores to construct a security sharing domain, decoupling global training parameters into knowledge fragments in the domain, formulating a recombination rule, and selectively acquiring the required knowledge fragments by all parties for local training. According to the method, deep collaboration is realized on the premise of protecting data privacy, and the collaboration training effect is improved.

The invention discloses an international propagation effect accurate evaluation method and system based on a large language model, and relates to the field of international propagation effect evaluation, and the method comprises the steps: obtaining a behavior log data set of a user, and dividing the user to a preset life cycle stage; extracting an interest label set of the user in a continuous time window, calculating a weight change rate of the same semantic keyword, and generating a user interest drift trend feature; extracting a propagation content feature vector of the to-be-evaluated propagation content, and calculating a basic matching degree with the interest label set; dynamically correcting the basic matching degree in combination with the life cycle stage and interest drift trend characteristics to obtain a final matching degree; extracting a path mode feature vector of the user, performing parameter matching with a propagation path mode library, and determining a propagation effect evaluation level; dividing the users into user groups according to the propagation effect evaluation levels, and implementing an intervention strategy on the user groups; according to the invention, refined grading evaluation of the propagation effect can be realized.

The invention discloses an aggregation analysis method for whole-network file and external black and grey production detection. The method comprises the following steps: S1, collecting original data related to black and grey production and generating structured log data; s2, constructing a heterogeneous graph containing multiple types of nodes such as files, IP addresses, domain names and accounts; s3, constructing node feature vectors and fusing node type information; s4, inputting a heterogeneous graph neural network to extract node cross-type aggregation features; s5, inputting the adaptive multi-channel graph convolutional network, and combining the structure attention and the attribute attention to generate a high-order semantic representation of the node; and S6, based on the semantic residual error and the path structure, reasoning and identifying a high-risk node and a propagation path map thereof. According to the method, graph neural modeling and behavior path reasoning capabilities are fused, and the method is suitable for black-gray link detection and abnormal node identification tasks in a large-scale network environment.

The invention discloses a log abnormal behavior detection method and system based on periodic pattern mining and incremental learning, and relates to the technical field of system abnormality monitoring. The method comprises the steps of obtaining original log data and executing preprocessing operation; main periodic frequency components are extracted through time frequency analysis to form a periodic set, a periodic stable part sequence and a transient change part sequence are divided, and a periodic modeling mechanism and a transient modeling mechanism are used for modeling; a joint prediction model is constructed, Monte Carlo Dropout is introduced to estimate uncertainty, and Bayesian weighting is adopted to generate a prediction value; abnormity is judged through a periodic residual error, a transient residual error and an overall residual error, and an abnormal causal path is analyzed and identified in combination with transfer entropy; a memory sample driven playback and distillation mechanism is adopted to execute incremental training, and modeling structure parameters are dynamically adjusted. The method has the capabilities of periodic rule modeling, unsteady behavior expression, prediction fusion, abnormal causal identification and continuous model learning.