5025 results about "Log data" patented technology

A network mapping behavior anomaly detection method and system based on machine learning is provided. The method includes: collecting dual-source traffic data, generating a structured log data set through dual-source log fusion engine; performing subgraph matching calculation to obtain a mapping behavior deviation degree; generating communication data containing a watermark identifier in a session corresponding communication path; verifying whether attack events carry the watermark identifier; generating a network mapping behavior anomaly detection report. According to the disclosure, an adaptive attack behavior model is constructed through a multi-modal feature vector based on structured logs and a graph protocol mapping rule base, so that the cognitive robustness to protocol camouflage and path drift is fundamentally enhanced, a real-time verification chain of detection results is built, and traditional passive detection is transformed into self-proof active defense through cross verification of watermark carrying state and behavior trajectory.

The invention provides a communication network operation and maintenance fault positioning and tracking method and system, relates to the technical field, and belongs to the technical field of communication network fault diagnosis. According to the method, historical operation data, including network flow data, performance index data and alarm log data, of communication network equipment are collected, fault feature vectors are generated through training of a deep learning model, and a fault feature knowledge base is constructed; receiving operation data reported by equipment in real time to perform feature extraction, and performing similarity matching based on the fault feature knowledge base to determine a fault type; and analyzing a fault propagation path by adopting a graph traversal algorithm, determining fault root cause equipment by calculating a fault probability score of an equipment node, and generating a fault tracking report. According to the invention, accurate positioning and rapid diagnosis of communication network faults are realized, the fault processing efficiency is improved, and the network operation and maintenance cost is reduced.

The invention relates to the field of log fault analysis, in particular to a log aggregation fault diagnosis method and system based on artificial intelligence. The method comprises the following steps: collecting a multi-modal heterogeneous log, carrying out sliding time sequence slicing processing, carrying out time sequence association sequence reconstruction, and constructing a time sequence reconstruction log data stream; log event deep semantic analysis is carried out on the time sequence reconstruction log data stream, event semantic topological evolution is carried out, and a multi-dimensional event topological representation matrix is constructed; performing routine event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix, and marking abnormal fault points; and the occurrence timestamp and the abnormal propagation rate of the abnormal fault point are calculated, fault space-time diffusion evolution is carried out, and a dynamic fault propagation path map is constructed. Through efficient and accurate fault traceability analysis, the fault diagnosis efficiency is greatly improved, and the stability and reliability of log data are improved.

The invention discloses a security event log real-time monitoring and analyzing system and method for a power grid communication network, and relates to the technical field of network security management. The causal relationship graph building module is used for building a causal relationship graph of the target power grid communication network; the multi-dimensional correlation analysis module is used for collecting and analyzing multi-source heterogeneous log data in real time; the abnormal security event identification module is used for identifying an abnormal security event according to the causal relationship graph and the multi-dimensional correlation analysis result; and the attack chain tracking response module is used for tracking the attack chain. According to the method, the technical problem that the existing power grid communication network security monitoring lacks tracking of abnormal event evolution from the time dimension and cannot accurately identify and track a multi-stage attack chain is solved, and the effects of dynamically tracking the evolution process of the abnormal event and identifying a potential attack chain by establishing a time causal chain graph are achieved. And the detection precision and the response speed of the attack behavior are improved.

The invention relates to the technical field of data analysis, and discloses a business data analysis method, device and equipment based on big data and a storage medium, the method comprises the following steps: collecting and preprocessing original log data to obtain standardized log data, and performing adaptive multi-modal feature extraction to obtain comprehensive feature representation; inputting a heterogeneous graph neural network to carry out anomaly detection and multi-level root cause analysis to obtain a hierarchical anomaly event; executing task scheduling and resource allocation of reinforcement learning to obtain a task allocation scheme; performing deep learning enhanced root cause reasoning and knowledge graph construction on the task allocation scheme to obtain a system state diagram and a causal relationship; and generating a multi-dimensional task data analysis report. According to the method, comprehensive analysis, anomaly detection, root cause reasoning and intelligent scheduling of log data are realized. The reliability and performance of the system can be improved, and more intuitive and accurate decision support can be provided for operation and maintenance personnel.

The invention provides a data security analysis method and an intelligent calculation data security workstation, and the method comprises the steps that the intelligent calculation data security workstation obtains data of different data sources, and the data comprises a user operation log and a data access and transmission log; classifying and grading the data based on a preset rule base and a machine learning model, and marking sensitive data; analyzing a user behavior mode based on the user operation log, and identifying an abnormal behavior; and based on the data access and transmission log, evaluating a data leakage risk, and generating a risk report.

The invention relates to the technical field of network security, in particular to a computer network information security monitoring method, system and device and a medium, and the method comprises the steps: obtaining encrypted traffic data and application log data in a network environment, and constructing a space-time associated original data set based on the encrypted traffic data and the application log data; performing protocol analysis on the original data set with the time-space association to generate a protocol fingerprint feature vector; inputting the protocol fingerprint feature vector and the application log data into a preset heterogeneous multi-modal analysis model, and obtaining a multi-dimensional security situation assessment result containing a threat level and an attack path; and based on the multi-dimensional security situation assessment result, generating a dynamic defense strategy instruction set through a reinforcement learning algorithm, and issuing a strategy instruction to a network execution node in real time. The method and the device have the effects of realizing real-time accurate detection of encryption threats and constructing a dynamic defense system with balanced security and efficiency.

Analyzing log data from multiple sources across computing environments, including: re receiving log data from multiple sources; identifying, by an anomaly detection framework, an anomaly based on the log data; and providing an alert for the anomaly.

Activity monitoring of a cloud compute environment based on container orchestration data may be performed by a data platform. For example, the data platform may obtain audit log data generated by a container orchestrator within a cloud compute environment, generate a data model based on the audit log data, and use the data model to monitor the activity for a security issue. The data model may be indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment and the monitored activity may be activity with respect to the one or more containerized applications. Corresponding methods, systems, and products are also disclosed.

The invention provides an instrument log recording and intelligent analysis method in a medical instrument software system, and the method comprises the steps: carrying out the preprocessing of operation log data of medical instrument equipment, carrying out the unified conversion of the log data of different sources and different formats, and obtaining the operation log data of the medical instrument equipment after the standardization processing; mining operation state change rules and abnormal modes of the medical equipment in different diagnosis and treatment stages through a time sequence mode according to the extracted log data semantic features in combination with the diagnosis and treatment workflow of the medical equipment; and analyzing the actual process of the equipment participating in the diagnosis and treatment activity from the equipment log data, and comparing and analyzing the actual process with a standard diagnosis and treatment work process to determine the information of the diagnosis and treatment work process, including a key path, a bottleneck link and an abnormal deviation.

The invention relates to the technical field of server load management and dynamic resource scheduling, and discloses a server load state evaluation method based on a dynamic evaluation algorithm, which comprises the following steps: data acquisition: acquiring performance index data, log data and network flow data from a multi-modal data source of a server; data preprocessing: performing time alignment, data cleaning, feature extraction and normalization processing on the acquired data; and self-supervised learning modeling: extracting feature representation from the multi-modal data through a self-supervised pre-training task, wherein the self-supervised pre-training task comprises a time sequence covering prediction task. Through multi-modal data fusion and self-supervised learning, the dynamic characteristics of the server load are accurately extracted, real-time load classification, anomaly detection and trend prediction are realized, the evaluation precision and real-time performance are significantly improved, and at the same time, a resource scheduling strategy of rule driving and reinforcement learning is combined, the server resource allocation efficiency is optimized, and the overload risk is reduced.

The invention, which relates to the technical field of network awareness anomaly detection, discloses a network awareness anomaly detection system based on big data, comprising a data acquisition module, a feature fusion module, a map construction module, a model calculation module, a root cause reasoning module, a threshold decision module and a response control module. The data acquisition module receives network flow data, equipment state data and system log data and outputs a standardized feature set; the feature fusion module is connected with the data acquisition module, dynamically calculates a weight coefficient of each data source based on information entropy, performs feature aggregation of privacy protection through a federated learning framework, and outputs a fusion feature vector; the atlas construction module is connected with the feature fusion module, maintains a network equipment node set and a communication edge set in real time, and updates a space-time association atlas according to a topology change event; and the model calculation module is connected with the atlas construction module, extracts topological features through a space-time diagram convolutional network, and updates a detection model based on an incremental learning mechanism.

The invention provides a network security protection method and system based on information fusion, and the method comprises the steps: firstly obtaining a multi-source heterogeneous data set, which comprises a traffic interaction data unit, an equipment log data unit and a protocol analysis data unit, of a target network, then carrying out the time sequence correlation analysis of the traffic interaction data unit, and generating a traffic behavior feature set; and executing state mode analysis on the equipment log data unit to generate an equipment operation feature set, and executing semantic recognition on the protocol analysis data unit to generate a protocol analysis feature set. Then, on the basis of a multi-dimensional feature fusion rule, cross-dimensional feature fusion processing is carried out on the feature set, and a network situation feature set is generated; and calling a threat identification model to carry out threat identification on the set, generating a threat identification result set containing threat type identifiers and influence range parameters, and finally generating a security response strategy set according to the threat identification result and issuing the security response strategy set to a security control node to execute protection operation, thereby effectively improving the network security protection capability.

The invention discloses a log abnormal behavior analysis method and system based on sorting learning and an attention mechanism, and relates to the technical field of system operation and maintenance. The method comprises the following steps: performing structured analysis on original log data and constructing a log sequence; extracting a periodic component, a trend component and a residual component through periodic neural decomposition; generating a running phase label based on the service calling relation and labeling a log sequence; modeling an association structure between log events by using a multi-head attention mechanism of phase perception, and outputting an abnormal score in combination with a sorting learning strategy; fusing the periodic stability index and the abnormal score to construct a health measurement value, and executing abnormal judgment and alarm strategy control based on a joint result; a structure-limited confrontation sample mechanism and structure deviation detection are introduced in the training and reasoning process, and the robustness of the model to structure disturbance is enhanced. The method has the technical advantages of being high in periodic modeling adaptability, high in anomaly detection precision, excellent in structure defense capability and the like.

The invention relates to a power log intelligent analysis system based on a knowledge graph and a large language model. The power log intelligent analysis system comprises a data collection and preprocessing module, a knowledge graph construction and management module, a context understanding and correlation analysis module, a personalized report generation module and a multi-modal data integration module. According to the method, information such as equipment, events and operations in the power logs is structured through the knowledge graph and is associated with domain knowledge, so that deep understanding and association analysis of log contents are realized, and the problem of insufficient context understanding in a traditional method is solved. By utilizing the strong generation capability of a large language model and based on context information provided by a knowledge graph, a personalized report meeting roles and requirements of a user can be automatically generated, and the user experience and practicability of log analysis are improved; log data in various formats are integrated into the knowledge graph, a comprehensive summary report containing information such as charts and timelines is generated through a large language model, and the problem that heterogeneous data are difficult to integrate is solved.

The invention discloses a network security threat intelligent identification and defense method based on artificial intelligence, and the method comprises the steps: S1, collecting network flow data, user behavior data and system log data from a network security system, and outputting a finally converged network feature data set; s2, performing global optimization search on the network feature data set by applying a hyper-entropy differential evolution algorithm to generate network feature data optimized by hyper-entropy differential evolution; s3, constructing a network traffic anomaly detection probability model based on variational Bayesian reasoning by using the network feature data after hyper-entropy differential evolution optimization; s4, inputting the network feature data set into the network traffic anomaly detection probability model, and evaluating the risk probability of an abnormal behavior; and S5, generating a self-adaptive defense strategy based on a detection result, and forming defense strategy data. According to the invention, the overall stability and defense capability of the network security system are improved.

The invention discloses an AI data warehouse full-link blood relationship tracking method and device, and relates to the technical field of data processing. The method comprises the following steps: obtaining structured log data with business terms and entity tags; establishing a knowledge graph according to the structured log data and the business document; generating blood relationship metadata according to the knowledge graph and the data job execution log; constructing a blood relationship cognition map according to the blood relationship metadata, the data operation log and the business document; generating a governance strategy vector according to the blood relationship cognitive map, the system real-time index and the service SLO, and sending the governance strategy vector to an execution engine, so that the execution engine carries out processing according to the governance strategy vector; and obtaining a governance strategy execution result, user feedback information of the governance strategy execution result and a system log generated in a governance process. According to the method, complex semantics and causal relationships behind data operation can be captured.

The invention provides an AI-based laboratory equipment scheduling optimization method and system, and the method comprises the steps: firstly obtaining a state monitoring data set containing the characteristics of equipment operation power consumption, idle time length, environment interference factors and the like in real time, and then carrying out the multi-dimensional analysis of the state monitoring data set; generating an availability evaluation index set containing characteristics of equipment load fluctuation, maintenance period prediction, compatibility matching and the like, and an experiment task priority queue, performing cross decision analysis on the availability evaluation index set and the experiment task priority queue based on a preset dynamic resource allocation model, and obtaining a scheduling strategy set containing a task allocation path, a cooperative operation rule and a conflict resolution mechanism; scheduling strategy parameters are calibrated according to experimental task operation log data, an optimized execution instruction set is generated, instructions are fed back to an equipment control system to adjust the equipment state, a dynamic resource allocation model is iteratively updated according to execution feedback data, and efficient scheduling optimization of laboratory equipment is achieved.

The invention discloses a log-based APT attack detection and tracing method, and belongs to the technical field of attack detection. In order to solve the problems of high efficiency, fine granularity and accuracy of APT attack detection, the method comprises the following steps: acquiring original system log data, and then preprocessing the original system log data to obtain a data set; and constructing a traceability graph based on the four operation types. The four operation types comprise file operation, process operation, authority operation and network operation; performing node anomaly detection by using a BERT model and a VAE model to obtain a threat node set; and based on the obtained threat node set and the traceability graph, obtaining an attack path comprising all threat nodes by using a Steiner tree algorithm. The method is suitable for learning under the condition that a large number of labeled samples and priori knowledge do not exist, the problem that a traditional algorithm cannot detect zero-day attacks can be solved, and a simple APT attack path traceability graph can be extracted from a large number of system logs.

The invention relates to the technical field of cloud storage, in particular to an alpine region logging data cloud storage system which comprises a network quality monitoring module, a data grading module, a dynamic bandwidth management module and an intelligent data migration module. According to the invention, by collecting the historical data of the network indexes and calculating the score of the current network state, the network condition is effectively evaluated, the data transmission strategy is optimized, the reliability and efficiency of data transmission are enhanced, priority rating is carried out according to the importance and emergency degree of the data, key data can be transmitted preferentially, the network congestion is effectively reduced, and the data transmission efficiency is improved. The data transmission efficiency is improved, the accuracy and the response speed of data management are optimized, the data access speed is improved by predicting the access frequency of the data and dynamically adjusting the storage medium, the storage cost is reduced, the overall data processing capacity and the cost effectiveness are improved, and the method is suitable for popularization and application. And the security and the quick accessibility of the key data in a severe environment are ensured.

The invention provides an emergency command converged communication system resource dynamic scheduling method based on artificial intelligence. The method comprises the following steps: S1, acquiring a plurality of sensors and log data of an emergency command system; constructing a dynamic graph neural network optimization communication topology, and selecting an optimal communication path; combining resource prediction and the optimized communication topology to formulate a global optimal resource scheduling strategy, and generating an optimal resource allocation scheme for each task; the resource pool comprises available computing resources and communication bandwidth; dynamically adjusting resource allocation and a communication path in a task execution process, and generating task execution feedback of a corresponding task; the system state is monitored in real time, and resource prediction, topology adjustment and scheduling strategies are optimized based on execution error feedback of task execution feedback. According to the method, efficient and intelligent dynamic resource scheduling is realized in an emergency command converged communication system through resource prediction of self-supervised learning, self-adaptive topological optimization of a variable topological graph neural network and global scheduling of reinforcement learning driving.

The invention relates to the technical field of database operation and maintenance, in particular to a database operation and maintenance decision-making method and device based on a large language model.The method comprises the steps that real-time operation indexes and historical log data of a database are collected, and multi-dimensional time sequence features are extracted; and analyzing the characteristics by using a large language model, judging whether a performance bottleneck or an abnormal risk exists or not, and determining the relevance between the performance bottleneck or the abnormal risk and a database performance problem. If the risk exists, acquiring a system load sudden change trend and a resource request rate, quantifying a system pressure degree, and inputting a performance optimization model to generate an adaptive tuning strategy; calculating statement complexity through an SQL audit log, and selecting an index adjustment strategy in combination with an index optimization model; evaluating the influence of the tuning strategy and the index strategy on the throughput, the response delay and the resource utilization rate, and determining a target high-performance strategy; according to the scheme, accurate optimization and efficient operation and maintenance of database performance are realized through intelligent analysis and dynamic adjustment and optimization.

The invention discloses a cloud platform auditing method based on multi-modal data processing, and relates to the technical field of cloud platform auditing. Independent features of text, image, audio, video and log data are extracted, each piece of modal information can be subjected to refined analysis in a corresponding feature space, and in a cross-modal feature fusion stage, a multi-modal feature fusion model is obtained. The correlation between different modal data is calculated by using a cross-modal consistency comparison network CMCN, and feature alignment is optimized through an attention mechanism, so that multi-modal information can be mutually verified, and misjudgment and missed judgment caused by independent auditing are reduced; in the auditing decision-making link, an auditing model based on deep learning is constructed, and end-to-end illegal content judgment is realized in combination with anomaly detection and a self-adaptive risk control threshold value, so that the intelligent level of an auditing system is improved; in addition, the suspicious areas of the image and the video are visually marked, and an auditing conclusion is generated by utilizing a natural language to generate an NLG model, so that the auditing result is more transparent.

The invention discloses a hierarchical use method based on sensitive data, and belongs to the technical field of data information security, and the method comprises the steps: basic data collection: obtaining overall data information which needs to be used by a demand side to the inside or the outside; identifying and preprocessing data; sensitive data storage processing: for sensitive data, storing the sensitive data in a private cloud or configuring a secret-related server; a data sensitivity evaluation model, which is used for formulating a sensitive data evaluation model according to the use route of the sensitive data through different policies; sensitive data classification processing: performing label processing on the data according to a result output by model evaluation, and providing corresponding limitation when the data is provided outwards; grading use of sensitive data; sensitive data use logs; a centralized management and control platform is used for data. According to the invention, through intelligent classification, authority control and dynamic adjustment of the access strategy, the security and compliance of the sensitive information in different use scenes are ensured.

The invention relates to the technical field of financial data sharing, and discloses a financial data sharing system and method based on a block chain and federated learning, and the system comprises a block chain layer which records an operation log, a data access record and authority management information in a data sharing process through a distributed ledger technology, executes a data sharing protocol through a smart contract, and stores the operation log, the data access record and the authority management information in the data sharing process; a credible cooperation basis is provided for the federated learning layer; and a multi-chain architecture module in the block chain layer is used for supporting multi-source data interaction and realizing consistency of data sharing and intelligent contract execution among different block chain networks through a cross-chain communication protocol. The block chain technology and the federated learning technology are adopted, and distributed model training and data sharing are carried out on the premise that original data are not shared. The block chain layer records all data operation logs and authority management information, and ensures the security and compliance of data access through an intelligent contract.

The invention relates to the technical field of data security analysis, in particular to a data security analysis system and method based on artificial intelligence. The method comprises the following steps: a data processing unit performs parallel cleaning and standardization processing on network flow data, user behavior data and system log data, and integrates the data into a comprehensive feature vector; the anomaly detection unit uses a DBSCAN algorithm to carry out clustering analysis on the comprehensive feature vectors, and a Gaussian mixture model is used to carry out probability modeling to screen abnormal points; the behavior analysis unit determines the type of an abnormal point through mode matching, carries out risk assessment on the abnormal point, and generates a safety analysis report; and the safety response unit adopts an automatic response mechanism based on the abnormal point risk level and generates a safety response report. According to the data security analysis system and method based on artificial intelligence, efficient abnormal point division is realized by dynamically adjusting clustering parameters and a density sensing technology, and abnormal detection and security risk assessment are realized by combining a Gaussian mixture model and a posterior probability screening mechanism.

The invention provides a cloud computing analysis method, device and equipment for a SaaS system and a storage medium, and the method comprises the steps: carrying out distributed log collection and preprocessing on cloud computing nodes, generating standardized log data, building a centralized log aggregation index, and obtaining a full-amount system log. And inputting a full-amount system log to the real-time analysis model, generating an abnormal behavior report, and performing hierarchical storage strategy planning on the log and the report to form a query structure. And determining a data blood relationship graph based on the structure, and generating a user portrait. And according to the abnormal behavior report and the user portrait, carrying out allocation planning of computing resources, constructing a multi-cloud collaborative elastic computing cluster, carrying out real-time monitoring and fault detection on the multi-cloud collaborative elastic computing cluster, and generating a cluster health state report. And analyzing and evaluating the system through a multi-dimensional index system. According to the method, through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling and construction of a multi-dimensional index system, the performance and efficiency of the system are improved.

The invention relates to a network attack tracing method and device based on a threat graph, equipment and a medium. The method comprises the steps of obtaining network security log data from multiple security data sources, and performing standardization processing to obtain a structured network security event data set; extracting threat entities and behavior relationships among the threat entities from the structured network security event data set to obtain an entity set and a relationship set; constructing a threat map according to the entity set and the relationship set, and performing time data slicing according to the timestamp to obtain a map snapshot and map metadata; based on a predefined attack chain template, identifying an attack chain sub-graph conforming to an attack behavior structure in the threat graph to obtain an attack chain set and a path reachability matrix; and according to the attack chain set and the path reachability matrix, attack path inversion is carried out by taking the target node as an end point, and an attack traceability path and a graph evolution process display result are obtained. By adopting the method, the network attack path can be identified and the attack source can be traced.

The invention discloses a method for health evaluation based on intelligent operation and maintenance scenarios, and a device thereof. The method includes: collecting log data and configuration data of the operation and maintenance system; preprocessing the log data and the configuration data to build a business key information database; and training the vector autoregressive model and the LSTM-AE model respectively based on the data and labels of configuration id in each set time interval to obtain the vector autoregressive model anomaly score and the LSTM-AE model anomaly score of each configuration id at the prediction time; obtaining the anomaly score of the configuration id at the prediction time by synthesizing the vector autoregression of the configuration id at the prediction time and the model anomaly score and the LSTM-AE model anomaly score; calculating the health degree of the operation and maintenance system at the prediction time based on the anomaly score of each configuration id at the prediction time. The present invention realizes the health assessment of intelligent operation and maintenance scenarios.

The invention discloses an abnormal behavior detection method and system based on a multi-source log and electronic equipment, and the method comprises the steps: collecting log data, carrying out alignment processing and data preprocessing, and generating normalized log data; carrying out attribute screening on the standardized log data set, and packaging the screened logs into a JSON format; extracting features of the log data, converting the features into data points, clustering the data points, and retaining a log cluster according to a clustering result; mining a hidden association mode between log attribute items in the log cluster by using an improved Apriori algorithm, generating an association rule, and constructing a knowledge graph based on the association rule; and constructing a time sequence of the log data by using a self-adaptive time window, and inputting the time sequence and the tag sequence of the log data into the LSTM neural network by combining context information in the knowledge graph and a tag sequence generated by an association rule to obtain an abnormal behavior detection result. According to the method, the log data format is unified, correlation analysis is enhanced, and the accuracy of an anomaly detection result is obviously improved.