450 results about "Syslog" patented technology

The invention discloses a self-adaptive operation and maintenance root cause positioning method and system based on deep learning. The method comprises the steps that firstly, multi-source data such as system logs, performance indexes, alarm events and configuration changes are collected, and time sequence features, text features and associated features are extracted; performing anomaly detection in combination with a 3-sigma criterion and an auto-encoder; when an exception is found, reasoning diagnosis is carried out by utilizing the fault knowledge graph, and fault diagnosis is realized by combining an XGBoost classification algorithm; and then fault propagation analysis and root cause positioning are carried out, and a fault processing flow is continuously optimized. The problems of incomplete fault features, low detection accuracy, limited diagnosis capability and the like in an existing operation and maintenance system are solved, more accurate fault detection and root cause positioning are realized through a mode of combining multi-source data fusion, deep learning detection and knowledge graph reasoning, and meanwhile, the method has adaptive optimization capability and is suitable for large-scale popularization and application. And the operation and maintenance fault processing efficiency is obviously improved.

The invention belongs to the field of safety research of advanced persistent threat detection, and particularly relates to an APT detection method based on semantic enhancement and an attention mechanism. The method comprises the following steps: collecting and analyzing a system log, and constructing a traceability graph according to the analyzed system log; obtaining a summary sentence of each node according to attributes of the nodes of the traceability graph and types of edges, inputting the summary sentences into a BERT model, and extracting attribute semantic feature vector representation of the nodes in the traceability graph; generating a sub-graph of each node according to the nodes in the traceability graph, extracting a feature matrix of each sub-graph by using the self-attention graph convolutional network, and taking the feature matrix as a node feature vector representation of each sub-graph; and inputting the node feature vector representation of the to-be-detected node into the lightweight classifier, and carrying out anomaly detection. According to the method, the semantic information of the log is deeply mined and understood, the coding structure and causal information of the traceability graph are deeply mined, and the accuracy and efficiency of APT attack detection are improved.

Systems and methods are provided for determining a root cause of an incident that occurred in a 5G / 6G multi-access edge computing and core network system. In particular, the disclosed technology is directed to using a pre-trained generative model to determine the root cause for an incident as recorded in event data of a system log. The present disclosure generates a prompt for the generative model to determine the root cause for an incident as recorded in the system log. The prompt comprises a combination including event data from a system log, function hierarchy graph data, and function information as grounding information in a prefix of the prompt. The prompt further includes a question that requests determining a root cause of an incident as recorded in the event data. An answer as generated by the pre-trained generative model indicates of the root cause and a function call associated with the incident.

The invention discloses an AI data warehouse full-link blood relationship tracking method and device, and relates to the technical field of data processing. The method comprises the following steps: obtaining structured log data with business terms and entity tags; establishing a knowledge graph according to the structured log data and the business document; generating blood relationship metadata according to the knowledge graph and the data job execution log; constructing a blood relationship cognition map according to the blood relationship metadata, the data operation log and the business document; generating a governance strategy vector according to the blood relationship cognitive map, the system real-time index and the service SLO, and sending the governance strategy vector to an execution engine, so that the execution engine carries out processing according to the governance strategy vector; and obtaining a governance strategy execution result, user feedback information of the governance strategy execution result and a system log generated in a governance process. According to the method, complex semantics and causal relationships behind data operation can be captured.

The invention discloses a computer network security analysis system and method based on big data. The system comprises a data acquisition module, a data preprocessing module, a feature extraction module, a risk assessment module, a security early warning module, a protection strategy generation module and an intelligent cooperation module. The data acquisition module is used for collecting network flow data, system log data and user behavior data, the data acquisition module has an external threat intelligence data acquisition function, and latest threat intelligence data is acquired from a public security information source by using a web crawler technology; an intelligent early warning strategy algorithm can automatically adjust the early warning frequency and mode according to a risk assessment result and historical early warning data, and it is ensured that an alarm can be timely and effectively sent to related personnel when a safety event occurs. Meanwhile, differentiated early warning is carried out according to the severity degree and the emergency degree of the risk, so that the pertinence and the effectiveness of early warning are improved.

The invention provides a cloud computing analysis method, device and equipment for a SaaS system and a storage medium, and the method comprises the steps: carrying out distributed log collection and preprocessing on cloud computing nodes, generating standardized log data, building a centralized log aggregation index, and obtaining a full-amount system log. And inputting a full-amount system log to the real-time analysis model, generating an abnormal behavior report, and performing hierarchical storage strategy planning on the log and the report to form a query structure. And determining a data blood relationship graph based on the structure, and generating a user portrait. And according to the abnormal behavior report and the user portrait, carrying out allocation planning of computing resources, constructing a multi-cloud collaborative elastic computing cluster, carrying out real-time monitoring and fault detection on the multi-cloud collaborative elastic computing cluster, and generating a cluster health state report. And analyzing and evaluating the system through a multi-dimensional index system. According to the method, through distributed log collection, multi-dimensional real-time analysis, dynamic resource scheduling and construction of a multi-dimensional index system, the performance and efficiency of the system are improved.

The present invention relates to the technical field of computers, and provides a log processing method and system, a log management platform, and an electronic device. The method comprises: acquiring real-time log data of each service system, and storing the log data in a message queue; according to a preset time window, writing the log data in the message queue into a target file of a specified storage directory; and in response to completion of data writing of a current time window, on the basis of the storage directory of the target file, calling a log analysis interface of a log analysis service to perform log analysis on the target file. The log processing method in the present invention reduces the risk incident rate of service systems, and improves the localization accuracy of an anomaly condition of a service log.

The invention discloses a log anomaly detection method, system and device and a medium, and relates to the field of security technology early warning, and the method comprises the steps: obtaining to-be-detected log sequence data of an electric power mobile micro-service system, inputting the to-be-detected log data into a trained anomaly detection model, and obtaining an anomaly detection result; the anomaly detection model is constructed based on a log data set and comprises a data processing module and a local attention processing module; the data processing module is used for converting input log sequence data into semantic feature vectors; and the local attention processing module is used for performing semantic feature representation according to the semantic feature vector, performing anomaly detection on each semantic feature to obtain an anomaly detection result, and the method can accurately detect the log anomaly condition of the micro-service system.

The invention relates to the technical field of information security, and discloses a network information security monitoring system, which comprises the following modules: a data collection module used for collecting data from network traffic, system logs and user behaviors in real time; the data processing module adopts a Z-score standardized processing technology to unify different features to the same scale so as to ensure that the mean value of the features is 0 and the standard deviation is 1, thereby improving the comparability between the features; and the threat detection module analyzes the processed data based on a machine learning algorithm and identifies possible network security threats. Through cooperative work of all the modules, comprehensive real-time data collection, accurate threat detection, practical response execution and continuous feedback optimization are realized, the network security threat handling capacity is integrally improved, and network information security monitoring work is stably and efficiently carried out for a long time. The problem that a response strategy of a traditional network information security monitoring system lacks pertinence and timeliness is solved.

The invention discloses a data security policy automatic adjustment system and method. The system comprises a data acquisition module (DCM), a data analysis module (DAE), a security policy adjustment module (SPAM), a monitoring feedback module (MFM) and a training data module (TDR). The DCM collects key data such as user access records, network traffic and system logs. The DAE analyzes these data and generates security event alerts and risk assessments in combination with a risk knowledge base. And the SPAM formulates or updates security parameters according to the evaluation result, and generates and pushes a new security policy to the cloud environment. And the MFM monitors network flow and user behaviors, compares the network flow and the user behaviors with a preset baseline, and feeds back when abnormity is found. The TDR uses historical data to carry out scene simulation training, a data analysis model is optimized, and the safety performance of the system is improved.

A centralized network traffic monitoring and intrusion detection system (1) comprising a system log aggregation module (110) including a means for receiving (111), a means for decoding (112) the user's syslog, a means for comparing (113) the data from the means for decoding, and a means for indexing (114) the tagged data and storing the indexed data. The system (1) also comprises an analysis and alert module (120) including a means for fetching (121) the indexed data, a means for checking and correlating (122) the retrieved indexed data, a means for analysing (123) the checked and correlated data, a means for compiling (124) the analysed and prioritized data and generating a report, and a means for alerting (124). The system (1) further includes a Bad IP Feed module (130) including a means for generating (131) updated lists of bad IP addresses and hostnames and automatically updating a user's network devices.

The invention belongs to the technical field of network security, and particularly relates to a network security detection method based on artificial intelligence, which comprises the following steps of: acquiring network flow data, system log data, user behavior data and external threat intelligence data, generating a multi-source heterogeneous data set, preprocessing the multi-source heterogeneous data set, and acquiring a multi-source heterogeneous data set; comprising the steps of data normalization, missing value filling and noise filtering, feature extraction is conducted on preprocessed data through a multi-modal fusion model, extracted multi-modal features are input into a mixed detection engine, the detection rate of zero-day attacks can be increased to a high level through multi-modal data fusion, and compared with the prior art, the detection rate of zero-day attacks is increased. The detection rate of a traditional method has obvious advantages in the aspect of coping with novel threats, and meanwhile, the false alarm rate can be reduced below a normal value in the aspect of false alarm rate control, so that the burden of safety personnel for handling invalid alarms is greatly reduced, and the situation that a large number of false alarms cause waste of manpower and material resources and possibly cause the fact that real safety threats are neglected is avoided.

The invention relates to the technical field of network security monitoring scheme design based on computing power, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: collecting network traffic, system logs and user behavior data; dynamically distributing CPU / GPU computing power according to network flow, attack frequency and the like; performing cleaning and format conversion on the data; intrusion detection, vulnerability scanning and traffic anomaly analysis are executed through multi-task parallel processing; a potential attack mode is mined in combination with deep learning model and rule engine association analysis; and judging threats according to a preset rule base and triggering early warning. According to the method, the resource utilization rate is improved through intelligent computing power scheduling, the threat recognition capability is enhanced in combination with deep learning and rule double engines, the method can adapt to a complex network environment, the threat detection accuracy is 98.7% according to actual measurement display, the resource occupation is reduced by 30%, and the method is suitable for high-concurrency scenes such as a cloud platform and the Internet of Things.

The invention relates to the technical field of network flow detection, in particular to a real-time network flow anomaly detection method based on deep learning, and the system comprises the following steps: S1, carrying out the real-time collection and preprocessing of multi-modal data; s2, performing dynamic feature engineering and sliding window statistics; s3, carrying out online adaptive threshold initialization; s4, multi-modal deep learning model reasoning is carried out; s5, updating the adaptive threshold in real time; s6, abnormal decision making and confidence coefficient calibration; s7, generating interpretability analysis; and S8, performing real-time feedback and online learning. According to the scheme, the capability of detecting hidden and complex attacks is remarkably improved through multi-modal data fusion and dynamic feature engineering, network traffic, system logs, user behavior data and external threat intelligence are synchronously collected, and traffic statistical features, time sequence change features, frequency domain features and distribution features are extracted in real time by using a sliding window mechanism.

The invention discloses a module identification method and device based on a hybrid detection mechanism, and a storage medium, relates to the technical field of device management, and discloses a module identification method based on the hybrid detection mechanism, and the method comprises the steps: scanning a preset interface to obtain current equipment node information after a system is powered on, analyzing the system log to extract equipment event information; generating an initial module list based on the equipment node information and the equipment event information; in response to the hot plug event, executing the same scanning and system log analysis operation when the system is powered on, and obtaining a compensation scanning result; and generating an updated module list according to the initial module list and the compensation scanning result. Through a hybrid detection mechanism combining static scanning and dynamic event driving, the accuracy and real-time performance of module identification are effectively improved, system start initialization and operation period hot plug scenes are considered, and the problem of state inconsistency caused by event loss or equipment residue is avoided.

The invention relates to the technical field of software development, and discloses an automatic UI function test method and system, electronic equipment and a storage medium. The method comprises the steps of receiving a natural language test requirement; intercepting an interface image in real time and transmitting the interface image to a multi-modal analysis module through an API; interface element layout is identified based on computer vision (CV), demand semantics are analyzed in combination with natural language processing (NLP), and a dynamic operation instruction set is generated; driving the automatic tool to execute clicking, sliding and input operations through the API; dynamically adjusting a test path according to execution feedback, and covering a multi-scene case; interface element states, system logs and performance data are monitored in real time, and automatic verification is achieved through multi-dimensional data comparison. According to the method, multi-modal recognition and AI intention understanding technologies are fused, the problems that a traditional UI test script is high in maintenance cost and low in scene coverage rate are solved, non-intrusive self-adaptive full-process testing is achieved, and the testing efficiency is improved by 40% or above.

The invention provides a big data network security protection method and system, and relates to the technical field of network security, and the method comprises the steps: obtaining system log information; acquiring historical system log information; determining a user traffic abnormal coefficient according to the historical user traffic use data and the user traffic use data; determining a user login abnormal coefficient according to the historical user login information and the user login information; determining a user operation abnormal coefficient according to the historical user operation information and the user operation information; determining a user behavior abnormal coefficient according to the user traffic abnormal coefficient, the user login abnormal coefficient and the user operation abnormal coefficient; and determining whether to take safety protection measures or not. According to the big data network security protection method and device, the user behavior condition can be comprehensively evaluated according to the user traffic use condition, the user login condition and the user operation condition, whether security protection measures are taken or not is judged according to the evaluation result, and the accuracy of big data network security protection is improved.

The present invention encompasses systems, computer program products, and methods for machine interpretation of security data. It identifies various data sources providing metrics and parameters, which include system logs, network traffic data, user activity records, and application logs. The system retrieves these metrics and parameters through an application programming interface and transforms them from unstructured to structured data. This structured data is then featured and stored. A dynamic consolidated matrix, known as the Constraint Specification Matrix (CSM), is generated from these features. A machine learning model is trained to discern correlations and patterns within the CSM's features. Lastly, the system transmits instructions to present these correlations and patterns via a user interface on a user device, allowing for user-friendly visualization and interpretation of the analyzed security data.

The invention discloses a multi-source data fusion IT operation and maintenance fault root cause analysis method, which comprises the following steps: data acquisition: acquiring data in real time from a plurality of data sources in an IT system, the data sources specifically being system logs, performance index data and network topology data, and the data sources being data of the IT system; the data acquisition is carried out according to a preset time interval or an event triggering mechanism; data preprocessing: preprocessing the multi-source data collected in the step S10, specifically comprising: a data cleaning step: removing noise, repeated data and incomplete data in the data; in the data conversion step, data in different formats are converted into data in a unified structured format, and in the data normalization step, a minimum-maximum normalization method is adopted. The multi-source data fusion IT operation and maintenance fault root cause analysis method and system aim to realize rapid and accurate identification of IT operation and maintenance fault root causes by fusing multiple data sources and utilizing an advanced data analysis technology.

The technology described herein, which can be incorporated into a bare metal as a service environment, is generally directed towards monitoring retrieving and analyzing security configuration stored on recovery partition storage (e.g., OEM partition drives), which can contain critical logs, error state data, and boot critical security data. A backend security policy engine enforces security context configuration policy data, including to prevent malicious attacks on the backend services. Bare metal in-band compute device health is monitored by an out-of-band network using telemetry data services. When an unrecoverable system state is detected, the out-of-band network activates the recovery partition storage for recording the system sensitive logs, debug data and error states, which is stored as encrypted per security policies. Security policy is enforced, including on system logs, to prevent data tampering and / or malicious attacks. A recovery scenario is performed to restore operation of the compute device.

It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to receive data from a remote entity for handling by a computing system. The machine-readable instructions further include instructions to instantiate a first TEE and a second TEE. The machine-readable instructions further include instructions to generate log data corresponding to predefined activities of the computing system and to generate system record data of a system log of the computing system at predetermined times. The machine-readable instructions further include instructions to generate first audit data by the first TEE and second audit data by the second TEE. The machine-readable instructions further include instructions to transmit the first and the second audit data to a detection system for data aggregation and anomaly detection.

Systems, apparatuses, and methods for analyzing log data are described. A processing unit ingests data blocks multiple data sources associated with a network-connected device. Each data block is associated with contextual meta tags identified from the ingested data. Further, one or more entities associated with the network-connected device are identified and for each entity a taxonomy is created. The taxonomy comprises a plurality of categories, each category comprising at least one contextual meta tag. Dashboards for presentation of processed log data are generated based at least in part on the taxonomy.

The invention relates to the technical field of load balancing, in particular to a cluster-based load balancing implementation method, which comprises the following steps of: S1, defining load balancing requirements and targets; s2, selecting a load balancer; s3, deploying a load balancer; s4, configuring a server pool; s5, realizing a load balancing algorithm; s6, realizing a fault-tolerant processing mechanism; s7, a monitoring and alarming system; s8, recording and analyzing logs; s9, performing regular maintenance and optimization; and S10, continuously improving. The cluster internal network topology structure is optimized through the network optimization module, the data transmission efficiency and the response speed are improved, the system performance and the user experience are improved through the load balancer, the safety protection module, the prediction module and the data processing transmission module, and the stability and the performance of the whole system are improved. The higher disaster recovery capability is realized through the load balancing architecture module, the more accurate load distribution is realized through the algorithm processing module, the load balancing strategy is adjusted in advance through the load balancing adjustment module, and the intelligence is improved.

AI-powered data breach detection and prevention system that includes: a threat monitoring module for continuous analysis of network traffic, system logs and user activities; an AI-powered anomaly detection module that uses machine learning to detect threats, including zero-day attacks and insider threats; a behavioral analysis module that tracks user authentication, access patterns, and privilege escalations; an automated incident response module that isolates threats, blocks unauthorized access, and alerts security teams; a threat intelligence module that integrates global cybersecurity databases for proactive risk mitigation; a multi-layered security system with endpoint protection, encryption and role-based access control; a privacy-preserving mechanism that uses homomorphic encryption and federated learning to protect sensitive data; a compliance and audit module that ensures compliance with cybersecurity regulations.

The invention relates to the field of network security, and particularly discloses a network security risk control method and device based on cloud computing and electronic equipment, and the method comprises the steps: firstly obtaining historical network attack alarm information, system log data and user login behavior data collected by a cloud computing platform, and then employing a deep learning technology to obtain a network security risk control result; the method comprises the following steps: carrying out feature extraction and correlation analysis on the three, and finally obtaining a classification result through a classifier so as to obtain a network security risk level label, thereby identifying potential security threats, reducing low-risk alarms and false alarms, optimizing alarm processing efficiency, enhancing interpretability and transparency of a system, and improving real-time performance and expandability of the system.

The invention relates to the technical field of cloud computing and server hosting technology, and discloses a single machine room fault recovery laas cluster processing system, comprising a fault detection module which is responsible for monitoring the health state of each node in a cluster in real time, analyzing system logs and performance indexes, and quickly identifying potential faults; the fault evaluation module is used for receiving the output of the fault detection module, evaluating a fault influence range and severity and providing a basis for a fault recovery strategy; the resource scheduling module is used for dynamically adjusting resource allocation according to a fault assessment result and selecting an optimal healthy node for service migration; and the service migration module is responsible for smoothly migrating the service on the fault node to the healthy node, and reducing the service interruption time by adopting a live migration technology. The invention provides a single-computer-room fault recovery laas cluster processing system, and solves the problems that a cluster processing system in the prior art is high in single-point fault risk, delayed in fault detection response, inflexible in resource scheduling and insufficient in cross-computer-room cooperative capability.

The invention relates to the technical field of network security intelligent monitoring scheme design, in particular to a network security intelligent monitoring method and system and electronic equipment. Comprising the steps that firstly, data are collected from multiple data sources of a network, network flow data, system log data, application program log data and the like are covered, and deep features are extracted through a deep learning algorithm; and then, an integrated learning behavior analysis model based on machine learning is adopted to analyze the preprocessed data, and by monitoring an analysis result in real time, decision making is carried out according to the type and severity of the abnormal behavior in combination with a predefined strategy, such as alarming, connection blocking or access permission adjustment. In addition, the system can continuously monitor network environment changes and automatically adjust parameters of the behavior analysis model. Through multi-aspect improvement, the false alarm rate is remarkably reduced, the data processing efficiency is improved, the monitoring system can adapt to the network environment change, and the accuracy and reliability of network security monitoring are effectively improved.

The invention discloses a server security monitoring method and system, and relates to the technical field of server security monitoring. The server security monitoring method comprises the following steps: acquiring a network performance data set in a monitoring computer system log, and analyzing the network performance data set to obtain a network performance evaluation value; and obtaining a server anti-intrusion data set in the log of the monitoring computer system. By analyzing network performance data and server anti-intrusion data in computer system logs, server security assessment is more comprehensive, potential security risks can be identified, the monitoring frequency is dynamically adjusted according to the security level of the server, the monitoring frequency can be increased in a high-risk period, the monitoring burden can be reduced in a low-risk period, and the safety of the server is improved. Therefore, the resource utilization efficiency is improved, and the problems that according to a traditional server monitoring method, dynamic changes of a network environment and security threats are inconvenient to fully consider, the capability of deeply analyzing data is lacked, and potential complex security risks are difficult to recognize and respond are solved.

The invention provides a fault detection method and device for a GPU (Graphic Processing Unit), electronic equipment, a computer readable storage medium, a computer program product, an automatic driving system and a vehicle, and relates to the technical field of computers, in particular to the technical field of automatic driving. The fault detection method comprises the following steps: acquiring system log information related to a plurality of GPUs; at least according to the system log information, whether GPU hardware type faults exist in one or more GPUs in the multiple GPUs or not is determined, and the GPU hardware type faults are faults related to GPU hardware; and in response to determining that the GPU hardware fault exists, at least outputting prompt information indicating the GPU hardware fault. According to the method, GPU hardware faults can be detected and identified in time, and corresponding prompt information is provided, so that problems can be quickly responded and solved, and the reliability and the stability of a system are improved.

The invention relates to the technical field of electric digital data processing, and provides a transmission data compression method and system based on cloud computing, and the method comprises the steps: collecting system log data, obtaining a to-be-compressed character string and a to-be-compressed character string set, obtaining a high-frequency code according to the to-be-compressed character string set, and calculating the global redundancy high frequency of the to-be-compressed character string; according to the global redundancy high frequency and the high frequency code of the to-be-compressed character string, the redundancy matching density and the global compression gain degree of the to-be-compressed character string are obtained, then the to-be-compressed character string is subjected to global compression according to the global compression gain degree of the to-be-compressed character string, and then the global compression character string is compressed by using an LZ77 compression algorithm. And then transmission of the system log data is completed. The method aims at solving the problems that an existing LZ77 compression algorithm only considers local similarity, and the compression efficiency of system log data with high global repeatability is not high enough.