A Behavior Analysis Method Based on Massive System Logs

Abstract

The invention discloses a behavior analysis method based on massive system logs, comprising: acquiring coding information in the massive system logs, and corresponding the coding information to a unique analysis target; Arrangement; clustering according to the attribute characteristics of log information, wherein the clustered log information is still arranged according to time nodes; time iterative analysis of the clustered log information is performed to obtain the analysis result, which can monitor log faults The purpose of information, predicting risks and trends, thus solving the technical problem that log analysis cannot accurately and efficiently analyze diversified log results in the existing technology, and at the same time determining behavior information and approximate behavior information can obtain accurate fault judgment results, risk Evaluation results, trend prediction results, and diversified analysis results are output through log analysis.

Description

technical field [0001] The invention belongs to the field of big data and relates to behavior analysis technology, in particular to a behavior analysis method based on massive system logs. Background technique [0002] With the rise and development of cloud computing, mobile Internet, and the Internet of Things, the era of big data has arrived. Logs of various systems, programs, operation and maintenance, transactions, etc. are becoming more and more important as an important basis for system recovery, error tracking, security detection and other operations. Therefore, it is very important to quickly find useful information in massive logs; [0003] For example, as a security monitoring system, systems such as intrusion monitoring, vulnerability scanning, and auditing can complete an alarm for any behavior that poses a threat to security, that is, generate an operation log; when a certain operation continues, the same operation log will be issued; Administrators repeatedly...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a behavior analysis method based on massive system logs, which is used to solve the problem that when analyzing logs, the terminal usually uses the inherent log analysis program to perform log analysis on the locally stored data and obtain the log analysis results. The result data, the log analysis results of such a process are very one-sided, the analysis speed and efficiency are not high, and the technical purpose of outputting diversified analysis results through log analysis cannot be achieved.

Images