Log anomaly detection method and device

Abstract

The invention belongs to the technical field of log anomaly detection, and particularly relates to a log anomaly detection method and device. The method comprises the steps: analyzing a log into a log event; and inputting the log event into the log detection model to obtain an anomaly detection result of the log, wherein the log detection model comprises a log vector conversion module and a result classification module, and the log vector conversion module is used for converting log events to obtain vector representation. The conversion processing comprises the following steps: converting each word in the log event into a word vector to obtain a vector sequence of the log event, and generating a region matrix of each word; inputting the vector sequence into a convolutional layer to obtain an adaptive context unit; multiplying the region matrix of all words in the log event by each element in the self-adaptive context to obtain mapping embedding; and performing maximum pooling operation and summation on the mapping embedding to obtain vector representation of the log event. According to the method, the log can be understood more easily, the adverse effect caused by log data imbalance can be effectively solved, and the detection precision is high.

Description

technical field [0001] The invention belongs to the technical field of log anomaly detection, and in particular relates to a log anomaly detection method and device. Background technique [0002] In recent years, logs have been used to detect anomalies in systems. According to statistics, in Microsoft's two open source projects, one code out of every 58 lines of source code is used to record logs. Once errors occur, reviewing logs is a routine operation. Therefore, logs play an important role in abnormal detection of software service systems, but as the system scale expands, the speed at which logs are generated by the system increases, and manual review of logs becomes impossible, and it is very time-consuming and costly. Error-prone, so it is very important to automate log-based anomaly detection. [0003] Tobacco big data cloud platform includes Openstack-based cloud platform management system and cloud-based big data processing system hadoop, hdfs and other business sy...

AI Technical Summary

Problems solved by technology

[0006] The present invention provides a log anomaly detection method and device, which are used to solve the problem that the methods in the prior art cannot solve the adverse effects caused by the unbalanced log data

Images