299 results about "Syslog" patented technology

The invention discloses a self-adaptive operation and maintenance root cause positioning method and system based on deep learning. The method comprises the steps that firstly, multi-source data such as system logs, performance indexes, alarm events and configuration changes are collected, and time sequence features, text features and associated features are extracted; performing anomaly detection in combination with a 3-sigma criterion and an auto-encoder; when an exception is found, reasoning diagnosis is carried out by utilizing the fault knowledge graph, and fault diagnosis is realized by combining an XGBoost classification algorithm; and then fault propagation analysis and root cause positioning are carried out, and a fault processing flow is continuously optimized. The problems of incomplete fault features, low detection accuracy, limited diagnosis capability and the like in an existing operation and maintenance system are solved, more accurate fault detection and root cause positioning are realized through a mode of combining multi-source data fusion, deep learning detection and knowledge graph reasoning, and meanwhile, the method has adaptive optimization capability and is suitable for large-scale popularization and application. And the operation and maintenance fault processing efficiency is obviously improved.

The invention discloses an AI data warehouse full-link blood relationship tracking method and device, and relates to the technical field of data processing. The method comprises the following steps: obtaining structured log data with business terms and entity tags; establishing a knowledge graph according to the structured log data and the business document; generating blood relationship metadata according to the knowledge graph and the data job execution log; constructing a blood relationship cognition map according to the blood relationship metadata, the data operation log and the business document; generating a governance strategy vector according to the blood relationship cognitive map, the system real-time index and the service SLO, and sending the governance strategy vector to an execution engine, so that the execution engine carries out processing according to the governance strategy vector; and obtaining a governance strategy execution result, user feedback information of the governance strategy execution result and a system log generated in a governance process. According to the method, complex semantics and causal relationships behind data operation can be captured.

The present invention relates to the technical field of computers, and provides a log processing method and system, a log management platform, and an electronic device. The method comprises: acquiring real-time log data of each service system, and storing the log data in a message queue; according to a preset time window, writing the log data in the message queue into a target file of a specified storage directory; and in response to completion of data writing of a current time window, on the basis of the storage directory of the target file, calling a log analysis interface of a log analysis service to perform log analysis on the target file. The log processing method in the present invention reduces the risk incident rate of service systems, and improves the localization accuracy of an anomaly condition of a service log.

The invention relates to the technical field of information security, and discloses a network information security monitoring system, which comprises the following modules: a data collection module used for collecting data from network traffic, system logs and user behaviors in real time; the data processing module adopts a Z-score standardized processing technology to unify different features to the same scale so as to ensure that the mean value of the features is 0 and the standard deviation is 1, thereby improving the comparability between the features; and the threat detection module analyzes the processed data based on a machine learning algorithm and identifies possible network security threats. Through cooperative work of all the modules, comprehensive real-time data collection, accurate threat detection, practical response execution and continuous feedback optimization are realized, the network security threat handling capacity is integrally improved, and network information security monitoring work is stably and efficiently carried out for a long time. The problem that a response strategy of a traditional network information security monitoring system lacks pertinence and timeliness is solved.

A centralized network traffic monitoring and intrusion detection system (1) comprising a system log aggregation module (110) including a means for receiving (111), a means for decoding (112) the user's syslog, a means for comparing (113) the data from the means for decoding, and a means for indexing (114) the tagged data and storing the indexed data. The system (1) also comprises an analysis and alert module (120) including a means for fetching (121) the indexed data, a means for checking and correlating (122) the retrieved indexed data, a means for analysing (123) the checked and correlated data, a means for compiling (124) the analysed and prioritized data and generating a report, and a means for alerting (124). The system (1) further includes a Bad IP Feed module (130) including a means for generating (131) updated lists of bad IP addresses and hostnames and automatically updating a user's network devices.

The invention belongs to the technical field of network security, and particularly relates to a network security detection method based on artificial intelligence, which comprises the following steps of: acquiring network flow data, system log data, user behavior data and external threat intelligence data, generating a multi-source heterogeneous data set, preprocessing the multi-source heterogeneous data set, and acquiring a multi-source heterogeneous data set; comprising the steps of data normalization, missing value filling and noise filtering, feature extraction is conducted on preprocessed data through a multi-modal fusion model, extracted multi-modal features are input into a mixed detection engine, the detection rate of zero-day attacks can be increased to a high level through multi-modal data fusion, and compared with the prior art, the detection rate of zero-day attacks is increased. The detection rate of a traditional method has obvious advantages in the aspect of coping with novel threats, and meanwhile, the false alarm rate can be reduced below a normal value in the aspect of false alarm rate control, so that the burden of safety personnel for handling invalid alarms is greatly reduced, and the situation that a large number of false alarms cause waste of manpower and material resources and possibly cause the fact that real safety threats are neglected is avoided.

The invention relates to the technical field of network security monitoring scheme design based on computing power, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: collecting network traffic, system logs and user behavior data; dynamically distributing CPU / GPU computing power according to network flow, attack frequency and the like; performing cleaning and format conversion on the data; intrusion detection, vulnerability scanning and traffic anomaly analysis are executed through multi-task parallel processing; a potential attack mode is mined in combination with deep learning model and rule engine association analysis; and judging threats according to a preset rule base and triggering early warning. According to the method, the resource utilization rate is improved through intelligent computing power scheduling, the threat recognition capability is enhanced in combination with deep learning and rule double engines, the method can adapt to a complex network environment, the threat detection accuracy is 98.7% according to actual measurement display, the resource occupation is reduced by 30%, and the method is suitable for high-concurrency scenes such as a cloud platform and the Internet of Things.

The invention relates to the technical field of network flow detection, in particular to a real-time network flow anomaly detection method based on deep learning, and the system comprises the following steps: S1, carrying out the real-time collection and preprocessing of multi-modal data; s2, performing dynamic feature engineering and sliding window statistics; s3, carrying out online adaptive threshold initialization; s4, multi-modal deep learning model reasoning is carried out; s5, updating the adaptive threshold in real time; s6, abnormal decision making and confidence coefficient calibration; s7, generating interpretability analysis; and S8, performing real-time feedback and online learning. According to the scheme, the capability of detecting hidden and complex attacks is remarkably improved through multi-modal data fusion and dynamic feature engineering, network traffic, system logs, user behavior data and external threat intelligence are synchronously collected, and traffic statistical features, time sequence change features, frequency domain features and distribution features are extracted in real time by using a sliding window mechanism.

The invention discloses a module identification method and device based on a hybrid detection mechanism, and a storage medium, relates to the technical field of device management, and discloses a module identification method based on the hybrid detection mechanism, and the method comprises the steps: scanning a preset interface to obtain current equipment node information after a system is powered on, analyzing the system log to extract equipment event information; generating an initial module list based on the equipment node information and the equipment event information; in response to the hot plug event, executing the same scanning and system log analysis operation when the system is powered on, and obtaining a compensation scanning result; and generating an updated module list according to the initial module list and the compensation scanning result. Through a hybrid detection mechanism combining static scanning and dynamic event driving, the accuracy and real-time performance of module identification are effectively improved, system start initialization and operation period hot plug scenes are considered, and the problem of state inconsistency caused by event loss or equipment residue is avoided.

The invention relates to the technical field of software development, and discloses an automatic UI function test method and system, electronic equipment and a storage medium. The method comprises the steps of receiving a natural language test requirement; intercepting an interface image in real time and transmitting the interface image to a multi-modal analysis module through an API; interface element layout is identified based on computer vision (CV), demand semantics are analyzed in combination with natural language processing (NLP), and a dynamic operation instruction set is generated; driving the automatic tool to execute clicking, sliding and input operations through the API; dynamically adjusting a test path according to execution feedback, and covering a multi-scene case; interface element states, system logs and performance data are monitored in real time, and automatic verification is achieved through multi-dimensional data comparison. According to the method, multi-modal recognition and AI intention understanding technologies are fused, the problems that a traditional UI test script is high in maintenance cost and low in scene coverage rate are solved, non-intrusive self-adaptive full-process testing is achieved, and the testing efficiency is improved by 40% or above.

The invention discloses a multi-source data fusion IT operation and maintenance fault root cause analysis method, which comprises the following steps: data acquisition: acquiring data in real time from a plurality of data sources in an IT system, the data sources specifically being system logs, performance index data and network topology data, and the data sources being data of the IT system; the data acquisition is carried out according to a preset time interval or an event triggering mechanism; data preprocessing: preprocessing the multi-source data collected in the step S10, specifically comprising: a data cleaning step: removing noise, repeated data and incomplete data in the data; in the data conversion step, data in different formats are converted into data in a unified structured format, and in the data normalization step, a minimum-maximum normalization method is adopted. The multi-source data fusion IT operation and maintenance fault root cause analysis method and system aim to realize rapid and accurate identification of IT operation and maintenance fault root causes by fusing multiple data sources and utilizing an advanced data analysis technology.

It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to receive data from a remote entity for handling by a computing system. The machine-readable instructions further include instructions to instantiate a first TEE and a second TEE. The machine-readable instructions further include instructions to generate log data corresponding to predefined activities of the computing system and to generate system record data of a system log of the computing system at predetermined times. The machine-readable instructions further include instructions to generate first audit data by the first TEE and second audit data by the second TEE. The machine-readable instructions further include instructions to transmit the first and the second audit data to a detection system for data aggregation and anomaly detection.

Systems, apparatuses, and methods for analyzing log data are described. A processing unit ingests data blocks multiple data sources associated with a network-connected device. Each data block is associated with contextual meta tags identified from the ingested data. Further, one or more entities associated with the network-connected device are identified and for each entity a taxonomy is created. The taxonomy comprises a plurality of categories, each category comprising at least one contextual meta tag. Dashboards for presentation of processed log data are generated based at least in part on the taxonomy.

AI-powered data breach detection and prevention system that includes: a threat monitoring module for continuous analysis of network traffic, system logs and user activities; an AI-powered anomaly detection module that uses machine learning to detect threats, including zero-day attacks and insider threats; a behavioral analysis module that tracks user authentication, access patterns, and privilege escalations; an automated incident response module that isolates threats, blocks unauthorized access, and alerts security teams; a threat intelligence module that integrates global cybersecurity databases for proactive risk mitigation; a multi-layered security system with endpoint protection, encryption and role-based access control; a privacy-preserving mechanism that uses homomorphic encryption and federated learning to protect sensitive data; a compliance and audit module that ensures compliance with cybersecurity regulations.

The invention relates to the technical field of cloud computing and server hosting technology, and discloses a single machine room fault recovery laas cluster processing system, comprising a fault detection module which is responsible for monitoring the health state of each node in a cluster in real time, analyzing system logs and performance indexes, and quickly identifying potential faults; the fault evaluation module is used for receiving the output of the fault detection module, evaluating a fault influence range and severity and providing a basis for a fault recovery strategy; the resource scheduling module is used for dynamically adjusting resource allocation according to a fault assessment result and selecting an optimal healthy node for service migration; and the service migration module is responsible for smoothly migrating the service on the fault node to the healthy node, and reducing the service interruption time by adopting a live migration technology. The invention provides a single-computer-room fault recovery laas cluster processing system, and solves the problems that a cluster processing system in the prior art is high in single-point fault risk, delayed in fault detection response, inflexible in resource scheduling and insufficient in cross-computer-room cooperative capability.

The invention relates to the technical field of network security intelligent monitoring scheme design, in particular to a network security intelligent monitoring method and system and electronic equipment. Comprising the steps that firstly, data are collected from multiple data sources of a network, network flow data, system log data, application program log data and the like are covered, and deep features are extracted through a deep learning algorithm; and then, an integrated learning behavior analysis model based on machine learning is adopted to analyze the preprocessed data, and by monitoring an analysis result in real time, decision making is carried out according to the type and severity of the abnormal behavior in combination with a predefined strategy, such as alarming, connection blocking or access permission adjustment. In addition, the system can continuously monitor network environment changes and automatically adjust parameters of the behavior analysis model. Through multi-aspect improvement, the false alarm rate is remarkably reduced, the data processing efficiency is improved, the monitoring system can adapt to the network environment change, and the accuracy and reliability of network security monitoring are effectively improved.

The invention relates to the technical field of electric digital data processing, and provides a transmission data compression method and system based on cloud computing, and the method comprises the steps: collecting system log data, obtaining a to-be-compressed character string and a to-be-compressed character string set, obtaining a high-frequency code according to the to-be-compressed character string set, and calculating the global redundancy high frequency of the to-be-compressed character string; according to the global redundancy high frequency and the high frequency code of the to-be-compressed character string, the redundancy matching density and the global compression gain degree of the to-be-compressed character string are obtained, then the to-be-compressed character string is subjected to global compression according to the global compression gain degree of the to-be-compressed character string, and then the global compression character string is compressed by using an LZ77 compression algorithm. And then transmission of the system log data is completed. The method aims at solving the problems that an existing LZ77 compression algorithm only considers local similarity, and the compression efficiency of system log data with high global repeatability is not high enough.

The invention provides a server fault prediction method, device and equipment based on multiple modes, which are applied to the technical field of fault prediction, and the method comprises the following steps: collecting multi-mode data of a node server; the multi-modal data includes at least two of thermograms, system logs, GPU utilization, power consumption, temperature, fan speed and fan audio. And respectively extracting a modal feature corresponding to each modal from the multi-modal data. And fusing modal features of all modals in the multi-modal data, and predicting fault information of the node server. And mapping the fault information to the thermogram to obtain a fault risk map of the node server. The fault risk map is used for displaying the fault information in the thermogram in an overlapping manner. The problem that a traditional fault prediction method based on a single data source is difficult to discover hidden problems generated by a server, so that the fault of the server cannot be predicted in time can be solved.

The embodiment of the invention belongs to the field of data processing, and relates to a risk judgment method and device, computer equipment and a storage medium, and the method comprises the following steps: carrying out risk vocabulary recognition on system log information according to a preset risk vocabulary library to obtain risk vocabulary information; performing abnormal sequence identification according to the user operation log and the standard operation sequence template to obtain an abnormal sequence result; performing association analysis on the risk vocabulary information and the abnormal sequence result to obtain association degree information; clustering the risk vocabulary information and the abnormal sequence result according to the association degree information to obtain a risk abnormal cluster; constructing a risk judgment decision-making tree according to the risk anomaly clustering cluster, and generating a risk judgment knowledge base according to a risk judgment rule of the risk judgment decision-making tree; and performing risk judgment on the real-time system log and the real-time operation log according to the risk judgment knowledge base to obtain a risk judgment result. According to the method, effective risk judgment can be carried out on the operation log of the user on the system.

The invention provides a malicious attack behavior detection method based on Transform and GNN, and the method comprises the steps: obtaining to-be-detected system log data, and carrying out the construction of a traceability graph based on the system log data, so as to obtain the traceability graph; performing word embedding generation processing on the traceability graph to obtain word embedding; inputting the traceability graph and the word embedding into a pre-trained hostile attack behavior detection model to obtain a detection result; wherein the malicious attack behavior detection model is a model based on a Transform and a GNN (Global Navigation Network). According to the method, the local features and the global graph features in the traceability graph can be captured, the accuracy and the real-time performance of APT attack detection are effectively improved, the adaptability and the expandability of the system are enhanced, and the practical value is remarkable.

The invention discloses a log processing method and device, a medium and a product, relates to the technical field of distributed system log management, and can be applied to the field of financial science and technology. The method comprises the following steps: sending a receiving node query request to a policy service, so that the policy service determines a target receiving node according to the receiving node query request; obtaining a target receiving node fed back by the policy service; based on the local system portrait model, processing the current system index data to obtain a business trough period window; determining an estimated transmission time length and a recommended transmission time period according to the data volume and the current available bandwidth of the to-be-transmitted log file and the service trough period window; sending a transmission decision request to a policy service; obtaining a target transmission time period and a fragment sequence fed back by the policy service; and transmitting a fragment sequence to the server through the target receiving node based on the target transmission time period, the fragment sequence comprising at least one log fragment. Through the technical scheme, the log processing efficiency can be improved.

The invention discloses a method for realizing exception control and real-time monitoring based on a probe technology, relates to the technical field of computer network and system monitoring, and aims to overcome the defects of a traditional system in the aspects of real-time performance, accuracy, resource consumption, deployment and maintenance complexity, expansion flexibility, data security privacy and the like. Firstly, a probe is deployed in a key system component, performance and service data are collected, a machine learning algorithm is applied to automatically identify and early warn potential abnormity, and an instant response mechanism is triggered. And data sources such as video monitoring, network traffic and system logs are accessed, and deep potential safety hazards are revealed by using a multi-modal data fusion algorithm. An edge computing technology is introduced, local data preprocessing is realized, transmission delay and load of a central server are reduced, finally, differential privacy is applied to protect information security, a federal learning technology is combined, data privacy is guaranteed, meanwhile, cross-data-source collaborative learning is promoted, and model training efficiency and accuracy are enhanced.

The invention belongs to the technical field of distributed system management and maintenance, and discloses a system log detection method and device based on a spiking neural network and a storage medium, and the method comprises the steps: achieving the semantic embedding of each log in a log sequence through a pre-training T5 model, and obtaining a word embedding sequence of context semantic association; then, pulse feature coding is carried out on the log semantic information to capture semantic information and time dynamic in the embedded words, and therefore effective packaging of log semantics and time information can be achieved, and a space-time pulse sequence is obtained; and finally, inputting the pulse sequence into the trained pulse neural network model to obtain a log anomaly detection result. Therefore, the time and semantic information of the logs can be effectively packaged, and meanwhile, the association relationship between the logs is captured by virtue of the T5 model and the spiking neural network model, so that the anomaly detection of the logs based on log association and time sensitivity is realized; in this way, the effectiveness and accuracy of log anomaly detection are improved.

Systems, apparatuses, and methods for analyzing log data are described. A processing unit ingests data blocks multiple data sources associated with a network-connected device. Each data block is associated with contextual meta tags identified from the ingested data. Further, one or more entities associated with the network-connected device are identified and for each entity a taxonomy is created. The taxonomy comprises a plurality of categories, each category comprising at least one contextual meta tag. Dashboards for presentation of processed log data are generated based at least in part on the taxonomy.

The invention relates to the technical field of network information security, in particular to a network information security early warning system based on big data analysis, which comprises a data acquisition and processing module used for acquiring network flow data, system log data and user behavior data in real time and performing cleaning, normalization and feature extraction on the acquired data; and the big data intelligent analysis module is used for detecting logic bombs in the system through a big data analysis technology, blocking a remote control bypass in the system, identifying illegal communication behaviors in the system and defending a greedy program in the system, and generating a report. Through omnibearing acquisition and deep analysis of mass data generated by system operation, hidden logic bombs are accurately recognized, hidden dangers are eliminated in advance, once remote control bypass communication is found, blocking measures are immediately taken, it is ensured that the system control right is not illegally captured, illegal behaviors hidden in normal communication can be accurately recognized, and the safety of remote control bypass communication is ensured. And the security of sensitive information is effectively protected.

The invention relates to the technical field of computers, in particular to a block chain power abnormal data tracing method. The method comprises the following steps: acquiring operation data and system logs of a power system, extracting model input, identifying exceptions and completing event source classification; for the abnormal generation differential change records, timestamps are extracted to construct chain records, and the chain records are serialized into traceable paths; performing cross-source alignment and sequence correction to form a consistent event sequence, classifying and sorting to obtain an event sequence structure, and verifying to generate a cross-system traceability path; and finally verifying a conclusion through a consensus mechanism, extracting a traceability report, and updating the anomaly detection model according to the traceability report. According to the method, the cross-source time sequence consistency and the evidence playback performance are improved, the conclusion credibility and the closed-loop iteration capability are enhanced, and the method is suitable for scenes such as data metering and equipment monitoring.

The invention provides a system log processing method and device, a readable storage medium and electronic equipment. The method comprises the steps that address information of a code of a log recording function in a system source code in the system source code is determined according to a compiled code, parameters in the log recording function comprise an identifier and a feature value, the identifier is used for identifying a class of objects, and the feature value is a feature parameter identifying a certain object in the class of objects; the compiled code is obtained by compiling a system source code; storing the address information and the characteristic value in a system log file; and generating a problem pointing file according to the system log file and the mapping relation file, so as to position the vulnerability in the system source code by adopting the problem pointing file. Problem positioning is achieved through logs under the condition that system source codes are not changed, and the space of the system log file is saved by storing the address information and the feature values which occupy small space in the system log file. The method is especially suitable for an embedded system.

The invention discloses a controller Level 2 layer function safety monitoring design fused with information safety, and the design comprises the steps: dividing a complete task into a plurality of function modules, and enabling a Level 1 and a Level 2 to run in different cores; plaintext data is directly used as input in the Level1 layer, plaintext and MAC are used as input in the Level2 layer, and due to time delay caused by message authentication of the Level2 layer, asynchronism exists when the Level1 and the Level2 execute the same function program; a timing mechanism is introduced when the HSM module is used for carrying out message authentication, so that the problem of stagnation of the HSM is prevented; in addition, a shared storage area is established to store an intermediate result executed by the Level1 layer function module; and the safety state of the system is recovered when a fault occurs by recording a system log. The problem of common cause failure is solved, it can be ensured that the message comes from a correct sender and is not tampered halfway, and the time delay problem caused by stagnation of the HSM is prevented.

The embodiment of the invention provides a system evaluation method, electronic equipment, a storage medium and a program product. The method comprises the steps of obtaining configuration information and a system log in a target system, determining a static index score of the target system based on the configuration information and a set static index type, determining a dynamic index score of the target system based on the system log and a set dynamic index type, and determining a dynamic index score of the target system based on the static index score and the dynamic index score. And determining and outputting the health state of the target system. According to the method, related personnel can more visually know the overall health condition of the system through a systematic evaluation standard, so that the efficiency of system management is improved, the identification and prevention capabilities for potential problems are enhanced, and powerful support is provided for stable operation of the system.

The invention discloses a log processing method, and the method can obtain an alarm result through processed system log data and related log data, matches an alarm rule based on semantic similarity, effectively reduces the false alarm and missing alarm, and improves the alarm accuracy. And a comprehensive and accurate alarm result is generated in combination with historical logs and context information, so that operation and maintenance personnel are assisted to quickly position faults. The log processing efficiency is greatly improved and the real-time requirement of large-scale data is met by utilizing efficient indexing and searching capability and by means of data vector rapid retrieval; an alarm rule and an embedded model are optimized according to user feedback, the manual maintenance workload is reduced, and the operation and maintenance cost is reduced; complex systems and variable service scenes can be processed, and different types of log data and alarm requirements can be met; different from completely depending on a large-scale pre-training model, the related log data is determined by using the data vector corresponding to the processed system log data, and the alarm rule is judged, so that computing resources are utilized more efficiently, and the system operation cost is reduced.