Abnormity detection method based on log event graph and association relationship mining

Abstract

The invention relates to an abnormity detection method based on a log event graph and association relationship mining. The method comprises the following steps: collecting an original log of a system to obtain log events; segmenting the log events into different groups according to a set time span or a task number, wherein the log events in each group form a log event sequence according to the generated time; according to association relationship mining, mining system log events having association relationships with each abnormity, and removing log events irrelevant to the abnormities in the log event sequence; extracting a semantic vector of each log event as a feature vector of the log event; generating a bidirectional full-connection log event graph according to the log event sequence, updating a feature vector of each node by using a gating graph neural network, performing weighted summation on the updated feature vectors of all the nodes by using an attention network, calculating a global feature vector of the log event graph, finally performing classification detection through a full-connection network, and obtaining the normal or abnormal type of the system.

Description

technical field [0001] The invention relates to the field of computer technology, and relates to an abnormality detection method based on log event graph and association relationship mining. Background technique [0002] Modern computer systems are often complex large-scale distributed software-intensive systems, such as large cloud service systems or centralized data processing and storage systems. These systems can often provide a variety of online services for millions of users at the same time, but once an exception occurs, it may lead to the collapse of system services, resulting in huge economic losses. Therefore, when an exception occurs, a fast and accurate anomaly detection mechanism is essential for system maintenance personnel to quickly discover and resolve the anomaly and restore the system to normal as soon as possible. As an important part of modern systems, logs are semi-structured text information that records system status and various events during operati...

AI Technical Summary

Problems solved by technology

[0018] The technology of the present invention solves the problem: overcomes the deficiencies of the prior art, and provides an anomaly detection method based on log event graph and association relationship mining, which ignores the input sequence of logs and considers the frequency of log events, effectively solving the problem of log sequence Out-of-order, duplication, loss, overlapping of multiple exceptions, etc., and can well deal with the loss of a small amount of logs that retain key log information, and has high robustness to the instability of log information and overlapping of multiple exceptions; at the same time, it can effectively Use log information to accurately identify system anomalies

Images