Behavior analysis method based on massive system logs

Abstract

The invention discloses a behavior analysis method based on massive system logs. The method comprises the following steps: acquiring coding information in the massive system logs, and enabling the coding information to correspond to a unique analysis target; extracting all log information corresponding to the coding information, and arranging the log information according to time nodes; clustering according to the attribute characteristics of the log information, wherein the clustered log information is still arranged according to time nodes; and carrying out time iteration analysis on the clustered log information to obtain an analysis result. The purposes of monitoring the log fault information and predicting the risk and trend, solving the technical problem that in the prior art, the log analysis cannot accurately and efficiently carry out diversified log result analysis, and improving the log analysis efficiency are achieved. The behavior information and the approximate behavior information are determined at the same time, so that an accurate fault judgment result, a risk assessment result and a trend prediction result can be obtained, and a diversified analysis result is output through log analysis.

Description

technical field [0001] The invention belongs to the field of big data and relates to behavior analysis technology, in particular to a behavior analysis method based on massive system logs. Background technique [0002] With the rise and development of cloud computing, mobile Internet, and Internet of Things, the era of big data has come. Logs of various systems, programs, operation and maintenance, transactions, etc. are becoming more and more important as an important basis for system recovery, error tracking, security testing and other operations. Therefore, it becomes very important to quickly find useful information in massive logs; [0003] For example, systems such as intrusion monitoring, vulnerability scanning, and auditing, as a security monitoring system, can complete an alarm for any behavior that poses a threat to security, that is, generate an operation log; when a certain operation continues, the same operation log will be issued; The administrator looks at t...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a behavior analysis method based on massive system logs, which is used to solve the problem that when analyzing logs, the terminal usually uses the inherent log analysis program to perform log analysis on the locally stored data and obtain the log analysis results. The result data, the log analysis results of such a process are very one-sided, the analysis speed and efficiency are not high, and the technical purpose of outputting diversified analysis results through log analysis cannot be achieved.

Images