Network anomaly detection method and device

Abstract

The embodiment of the invention provides a network anomaly detection method and device, relates to the technical field of the Internet, the method and the device are used for anomaly detection of a network system, and can improve the accuracy of anomaly detection. The method comprises the steps of obtaining multiple pieces of first log information of a target system in a first time period; whereinthe first log information is used for indicating the running state of the system; determining a target category corresponding to the first log information according to a classification algorithm; wherein the classification algorithm is used for classifying according to the distance and part-of-speech sequence of the first log information; if the different numbers of the target categories and theprediction categories are greater than a threshold value, determining that the target system is abnormal; wherein the prediction category is determined according to a prediction algorithm and a targetcategory corresponding to the first log information. The method is used for anomaly detection of the network system.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a network anomaly detection method and device. Background technique [0002] With the development of communication networks, the network system architecture and application service system are becoming increasingly large, and a huge amount of log information will be generated during the operation of the network system and application services. These log information records information such as the operating status of the network system and application services. The anomaly detection of log information is an important means to maintain the normal operation of network systems and application services. Timely anomaly detection can effectively prevent the occurrence of faults and reduce the impact of faults. The current anomaly detection method is usually to detect the point anomaly of the log information, that is, to detect one or a piece of log information alone. Due to the huge...

AI Technical Summary

Problems solved by technology

The current anomaly detection method is usually to detect the point anomaly of the log information, that is, to detect one or a piece of log information alone. Due to the huge base of log information, the log information formats of various systems or applications may be different, so this The detection accuracy of this anomaly detection method is low, and the efficiency is low

Images