Time sequence and convolution combined computing power weblog anomaly detection method and system

Abstract

The invention relates to a time sequence and convolution combined computing power weblog anomaly detection method and system. According to the method, template classification of massive network calculation logs is accelerated by utilizing a hash optimized log template analysis algorithm based on an analysis tree. And meanwhile, the log variables can effectively construct spatial features by utilizing Hash-based spatial coordinate mapping. In addition, the log sequence features based on semantic information and the original sequence features of the logs are considered by combining the sequential network and the convolutional network, and the variable space features on the time sequence are also fully considered, so that the neural network model in the method has higher detection accuracy and robustness.

Description

Technical Field

[0001] The present invention relates to the technical field of log anomaly detection of computing power networks, and in particular to a log anomaly detection method and system based on a time series deep learning neural network and a convolutional neural network based on hash mapping. Background Art

[0002] In order to support business and meet computing power needs, the scale of current supercomputing centers, intelligent computing centers, and clusters is also getting larger and larger, showing characteristics such as large scale and many components, and the probability of system anomalies and failures has increased dramatically. At the same time, as the scale of computing systems increases, the scale of logs increases, the search space for anomaly detection becomes larger, and processing logs faces challenges such as large data volume, multiple abnormal patterns, fast log increase speed, and low log processing efficiency. Especially in computing power networks, the scale of system logs is larger and more complex. At the same time, intensive computing power scheduling and data distribution will generate more related logs, which are difficult to effectively summarize and detect, and have disadvantages such as low anomaly detection efficiency and poor accuracy.

[0003] Log anomalies usually refer to the phenomenon that the system operation reflected in the log deviates from the normal behavior pattern, such as a specific indicator exceeding the normal range, an abnormal interruption during the system operation, a program response timeout, etc. Or there is no abnormality in a single log, but there is an abnormal phenomenon in the log sequence composed of several logs, such as a process trying to call a resource repeatedly. When the process repeatedly tries to call the resource but fails, it may mean that the system is deadlocked or related services are suspended or blocked. In recent years, some methods for system log anomaly detection suitable for data centers, supercomputing centers, and distributed clusters have been proposed for log data. These studies usually divide the process of log anomaly detection into four stages: log collection and cleaning, log template parsing, feature extraction from logs, and log anomaly detection.

[0004] In the log collection and cleaning phase, the collection phase is based on the output of pre-written scripts or log frameworks. This phase is used to obtain logs in the computing network, which usually include printing time, log level, specific content, etc.

[0005] In the log template parsing stage, there are various template parsing algorithms based on code analysis, machine learning, and classical algorithms. These template parsing algorithms are both online and offline. Among them, the algorithms based on code analysis have disadvantages such as difficulty in obtaining source code and complex operations; while deep learning algorithms need to go through training and other stages. As the number of code templates continues to increase, the model needs to be retrained. If it is not retrained, the generalization performance will be weak. The accuracy will be greatly reduced for the later log migration. Therefore, the current mainstream parsing algorithms are based on classical algorithms. The mainstream classical algorithms include the longest common subsequence (LCS) and the parse tree algorithm. However, as the speed of log parsing driven by business becomes higher and higher, the above classical algorithms also have their limitations. For example, in the parse tree algorithm, there will be processes such as node classification and log similarity calculation. In the longest common subsequence, the length of the longest common subsequence between logs will be calculated, accompanied by a large number of repeated calculations, which all take a lot of time. Therefore, the slow parsing speed has become the main constraint.

[0006] In the anomaly detection stage of logs, there are traditional machine learning algorithms, such as clustering algorithms, principal component analysis algorithms (PCA), etc., and there are deep learning algorithms based on neural networks, such as long short-term memory artificial neural networks (LSTM) based on recursive neural networks, graph neural networks (GNN), generative adversarial neural networks (GAN), convolutional neural networks (CNN), etc. Among them, traditional machine learning solutions such as clustering algorithms and principal component analysis algorithms have difficulties in dealing with noise and outliers, and clustering algorithms are sensitive to noise and outliers; the principal component analysis rule is based on the linear assumption that data is linearly separable, and it is believed that there is a direct proportional relationship between the variables in the logs, but in the actual computing network logs, the relationship between logs will be more complex, which will cause PCA to be unable to capture the complex relationship of abnormalities, resulting in the shortcomings of low prediction and classification accuracy and coarse granularity of traditional machine learning algorithms. In terms of using neural networks for anomaly detection, neural networks can fully learn the relationship between features, but at the same time they depend on the selection of features, and the advantages and characteristics of different network models are also different. For example, the time series neural network (RNN) focuses on the understanding of time series features; CNN and GNN focus more on feature learning in the spatial dimension, and GAN focuses on the generalization ability and robustness of the model. Most existing studies only use one of the above network models, which cannot well mine the feature information in the log, resulting in low accuracy and stability of model detection. Therefore, how to improve the robustness and accuracy of the detection model is also a key challenge for computing network log anomaly detection.

[0007] In summary, the current technical bottlenecks for anomaly detection in computing network logs are mainly concentrated in the log template parsing stage and the anomaly detection stage. The main bottleneck in the template parsing stage is that the parsing speed is not fast enough and the parsing accuracy is low. This is because most parsing algorithms involve log preprocessing and similarity calculation, and this process is often accompanied by a large number of repeated comparisons and calculations. The main bottleneck in the anomaly detection stage is that the learned features are one-sided and it is difficult to use the variables in the log for effective prediction. This is usually caused by the difficulty in constructing effective feature inputs and the inability to coordinate multiple models. Summary of the invention

[0008] The objective of the present invention is to realize a method and system for detecting anomalies in system logs under a computing network combining a time series neural network and a convolutional neural network. The innovative part includes forming a dual-path model with a time series neural network and a convolutional neural network, which includes a time series branch and a spatial convolution branch to fully extract feature information; performing hash optimization on a fixed-layer template parsing tree to accelerate the template classification process of structured logs; using hash coordinate mapping to convert the structured placeholders of a structured log within a time window into a two-dimensional matrix, constructing spatial features under time series to achieve convolution, so that the neural network part can fully learn the time series information and spatial information of the log, improve the stability and accuracy of anomaly detection, and solve the shortcomings of slow log template parsing speed and low anomaly detection accuracy.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is:

[0010] In a first aspect, the present invention provides a computing power network log anomaly detection method combining time series and convolution, the method comprising the following steps:

[0011] Step 1: Use regular expressions to separate variables and structured information in the computing power network system log, replace the variable position of the computing power network system log with a structured placeholder to obtain a structured log, and determine the time window and stride to obtain a log sequence;

[0012] Step 2: The structured logs are quickly classified into log templates through a hash-optimized fixed-layer parse tree, all structured logs are mapped to corresponding log templates, and the log templates are marked with corresponding serial numbers to form log template numbers, and sequence features are generated through the log template numbers; semantic features are generated from the structured logs through the AL-Bert model;

[0013] Step 3: Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization, and a two-dimensional variable matrix on the time series is constructed to obtain the spatial features;

[0014] Step 4: Using the sequence features, semantic features, and spatial features as input, a two-way model is used for prediction. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures. The output vector is judged whether it is abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0015] In a second aspect, the present invention provides a computing power network log anomaly detection system combining time series and convolution, comprising:

[0016] The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log by using regular expressions, replace the variable positions of the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain a log sequence;

[0017] The template parsing module is used to quickly classify the structured logs into log templates through a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features through the log template numbers; generate semantic features from the structured logs through the AL-Bert model;

[0018] The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and to construct a two-dimensional variable matrix on the time series to obtain spatial features;

[0019] The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as inputs and use a two-way model for prediction. The two-way model specifically includes two branches, a time series branch and a spatial convolution branch, wherein the time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures; the output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0020] The beneficial effects of the present invention are:

[0021] 1. The speed of log template parsing is accelerated through hash optimization:

[0022] Currently, there is a pain point that log template parsing is too slow. The computing power network system logs that need to be detected may be as high as millions or tens of millions, but there may be only a few hundred types of log templates, which means that most logs are finally classified into existing templates through layer-by-layer classification, wasting a lot of time in layer-by-layer selection and traversal. Therefore, a hash map (cache) is used to first ask whether the log template to which the computing power network system (original) log to be classified belongs already exists. If it has already appeared, the log template of the structured log is directly recorded as the corresponding log template number in H; if it has not appeared, the structured log enters the fixed-layer parsing tree to continue to build until the corresponding log template number is generated. This greatly speeds up the classification of log templates.

[0023] 2. The hash-based log structured placeholder coordinate mapping method can effectively utilize the variables of the log (original):

[0024] Usually, the variables of the original log have rich feature information, but the previous technologies cannot make good use of this part of the variable information. The present invention constructs a spatial feature matrix M on the time series scale based on the time window. The implementation principle is to map the structured placeholders in space, so that the structured placeholders can be better mapped to the corresponding positions in the matrix. The advantage of this is that adjacent structured placeholders can be avoided from being covered when mapped to M.

[0025] 3. The dual-path model of neural network integrating time series and convolution can better capture the time series and spatial information of logs:

[0026] Past technologies often only focus on local feature information, such as time series information, statistical feature information, and semantic information. The present invention fully considers semantic information and time series information through the time series branch to obtain the tensor output after the time series branch prediction; at the same time, the powerful feature extraction ability of the convolutional neural network is used to fully extract the feature information contained in the structured placeholders in the structured log. The entire model fully mines the log from three dimensions: semantic features, time series features, and spatial features to solve the problem that a single feature cannot accurately detect anomalies, making the model's anomaly detection more accurate and stable. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is the overall architecture diagram of the system log anomaly detection system under the computing power network of an embodiment of the present application.

[0028] Figure 2 This is a flow chart of the log template parsing method based on hash-optimized parsing tree.

[0029] Figure 3 This is a schematic diagram of the hash-based log variable coordinate mapping method. DETAILED DESCRIPTION

[0030] The present invention is further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0031] like Figure 1 As shown, the embodiment of the present application provides a computing power network log anomaly detection method combining time series and convolution, including the following steps:

[0032] S1. Computing network log preprocessing stage: Use regular expressions to separate variables and structured information in the computing network system log, replace the variable positions of the computing network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain log sequences;

[0033] In one example of this application, the computing network log preprocessing stage includes:

[0034] S11. Usually, the logs of the computing network will involve time, message level, and strings describing the system operation status. They will also involve variables such as numbers, IP addresses, port numbers, and task time intervals.

[0035] First, the collected computing network logs are regularized, and the above variable parts are assigned the same regular number (starting from 1 and increasing in number) through a hash function. At the same time, the structured part of the original log is separated and replaced with the regular number in the position of the original variable, which is recorded as a structured placeholder. For example, the regular number of a number is mapped to 1, the regular number of an IP address type variable is mapped to 2, and so on.

[0036] S12. Set a time window of length W, set the moving step to S, and call all structured logs in a time window a log sequence L seq , the length of the log sequence is W.

[0037] S2, template parsing stage: quickly classify the structured logs into log templates through a hash-optimized fixed-layer parsing tree, map all structured logs to corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features through log template numbers; generate semantic features from structured logs through the AL-Bert model.

[0038] In one example of this application, the template parsing phase includes:

[0039] S21. First, a hash table H is preset that can dynamically parse and record whether the log template has been parsed, where H is presented in the form of a key-value pair. Before the structured log enters the fixed-layer parsing tree construction, a query is first performed on the hash table H: H is asked whether the structured log has been mapped. If it has been mapped, the log template of the structured log is directly recorded as the corresponding log template number in H; the log template corresponding to the structured log is the key in H, marked as L, and the value is the log template number, marked as L num The initial value of the value is null. If it has not been mapped, the structured log of the computing network log preprocessing stage is taken and entered into the fixed-layer parsing tree optimized by hashing, see Figure 2 .

[0040] Furthermore, the number of layers of the parse tree is preset to D layers, and the first layer is used for initial classification of the length of the structured log, and classifies structured logs of different lengths into different branches. In the second layer to the D-1 layer, the structured logs are classified into different branches according to the complete match of the string (separated by spaces). For example, the length of the structured log "Received blockreplica with id 1from unexpected source:2" is 10, that is, it is divided into a branch with a length of 10 in the first layer, into the "Received" branch in the second layer, and into the "block" branch in the third layer, and so on. Until the leaf node corresponding to the last layer of the log parse tree is matched.

[0041] Match the structured log with each log template in the log template set of the leaf node through the log similarity function T, and take the log template with the highest similarity from the set U of all log template sets whose similarities exceed the preset threshold Z as Template max , and the structured log L num Mark as Template max The corresponding log template number. The structured log itself is recorded as a new log template in the leaf node, its log template number is recorded, and H is updated.

[0042] In the above process, when the hash table H is directly hit, the time complexity is the complexity of querying H O(1); if there is no hit, the execution process is to first access H, and then access the parse tree being built. It is necessary to traverse the leaf nodes of the parse tree and calculate the similarity, that is, first traverse from the first layer to the leaf node, the traversal path length is D, and then assume that each leaf node has an average of k log templates, the average length of each log template is p, and the length of the structured log used for template parsing is q, so the average time complexity is O(D+k*max(len(p),len(q))), where the formula for calculating the similarity function is:

[0043]

[0044] Where T represents the similarity between the structured log that needs template parsing and the log template, T∈[0,1], Sim is a similarity function, which is specifically described as 1 if the values ​​at corresponding positions are equal, otherwise 0, and len is a function for calculating the number of structured log strings.

[0045] In actual situations, the number of original logs is much larger than the number of templates, which means that in actual computing network logs, the regularized structured logs belong to the same template. For these structured logs, the time complexity of searching for log templates based on the hash optimization strategy is reduced from O(D+k*max(len(p),len(q))) to O(1). This shows that this method can significantly improve the time efficiency of log template classification.

[0046] S22, L seq As input, we first use the language model AL-Bert to embed each string in the structured log. Then, we add up all the strings after word embedding in the same log and divide them by the number of strings in the structured log to obtain a fixed-length one-dimensional tensor D1, where D1 = {v0, v1, …, v n-2 ,v n-1}, n is the length of the tensor; then according to the continuous W value set in the first stage, take an L seq After the above operations, the W structured logs in the matrix form a two-dimensional tensor matrix, represented by V Sem , V Sem ={D 1(0) ,D 1(1) ,…,D 1(W-2) ,D 1(W-1)} represents the semantic features of a certain time window.

[0047] At the same time, take the log template serial number in the same time window to construct the sequence feature V Seq , specifically, L seqEach structured log is replaced by the corresponding log template number L num , where V Seq ={d0,d1,…,d W-2 ,d W-1}, W is the length of the sliding window, d is the log template number, that is, the log template number L to which each structured log belongs num The above operation is performed for each time window. So far, all semantic features and sequence features have been obtained.

[0048] S3, Log two-dimensional variable matrix construction phase: Based on the hash function, the structured placeholder part of the variables of the computing power network (original) log after regularization is mapped to coordinates, and a two-dimensional variable matrix on the time series is constructed to obtain spatial features, see Figure 3 .

[0049] In one example of the present application, the log two-dimensional variable matrix construction phase includes:

[0050] S31. Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization, and a two-dimensional variable matrix M on the time series is constructed.

[0051] When processing the kth time window: first, obtain all the structured placeholder information of the structured log corresponding to the kth time window in the preprocessing stage, and then obtain the position of each structured placeholder x. For a structured placeholder x, its position information is recorded as a tuple E = [i, J(j)], where i represents the i-th log in the window, and its row in M ​​is consistent with the position of the structured log in W; j represents the j-th structured placeholder in the sentence, and J(j) indicates the column to which the structured placeholder belongs in the two-dimensional variable matrix.

[0052] The value range of J(j) is set to an upper limit C to prevent individual structured logs from being too long and causing a lot of space waste. The expression of J is:

[0053]

[0054] j is the jth structured placeholder in the original log. The column position mapped to the two-dimensional variable matrix M is to first round down j, and if there is a remainder modulo 2, move one column backward. The advantage of this is that it avoids the situation where adjacent structured placeholders are mapped to M and the structured placeholders overlap.

[0055] S32, obtaining the value of the structured placeholder (regular number 1), specifically expressed as:

[0056] Hash(x)=l

[0057] Where Hash(x)=l represents the hash function used to generate the regular number (completed in S11). The mapped number is l. That is, the value l is the value of the structured placeholder and needs to be mapped to the corresponding position in the two-dimensional variable matrix in the subsequent steps. x represents the variable in the original log. So far, a single structured placeholder is represented as a tuple G kq =[E,l], where E=[i,J(j)], indicating that the qth structured placeholder value of the kth window is l, which is in the i-th row and the J(j)-th column of the k-th two-dimensional variable matrix.

[0058] At the same time, a structured log is represented as a one-dimensional tensor D2 = {g0, g1, ..., g C-2 ,g C-1}, C is the maximum value of the set two-dimensional variable matrix column length, that is, no matter whether the J of the structured placeholder in the structured log is less than or equal to C or greater than C, its length is C. If the mapped column subscript J is less than or equal to C, it is directly mapped; otherwise, it is directly discarded.

[0059] For each g i If the corresponding subscript is mapped by a structured placeholder in the mapping phase, then the g i The value of is the value of the structured placeholder l, otherwise it is 0. Taking W consecutive structured logs, all structured placeholder information in a time window is abstracted into a two-dimensional variable matrix, which is represented as V Space (M matrix), V Space ={D 2(0) ,D 2(1) ,…,D 2(W-2) ,D 2(W-1)}. Perform the above operations (S31, S32) on all time windows to obtain all two-dimensional variable matrices.

[0060] S4, log anomaly detection stage: using sequence features, semantic features, and spatial features as input, the dual-path model designed by this method is used for prediction. The dual-path model specifically includes two branches, a time series branch and a spatial convolution branch, wherein the time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures; the output tensor is judged whether it is abnormal through steps such as splicing, attention mechanism, changing tensor dimension, and regression prediction.

[0061] This application extracts three features in S2 and S3: time series feature V Seq , semantic feature V Sem And the spatial feature V in time series Space . Next, we enter the log anomaly detection stage based on machine learning and deep learning.

[0062] In one example of the present application, the log anomaly detection stage includes:

[0063] S41, taking a single time window W as an input, taking the semantic features V of the template parsing stage Sem And the timing characteristics V Seq , are respectively used as inputs for training and prediction through a bidirectional long short-term artificial memory model (Bi-LSTM) model. Although the semantic feature V Sem It also contains certain temporal features, but due to the semantic processing of AL-Bert, the feature dimension increases, which may cause the original temporal features to be disturbed. Therefore, for a single temporal feature V Seq The output tensors F1 and F2 of the two networks are horizontally spliced ​​to obtain the tensor V a .

[0064] S42, take the spatial characteristics V of the variables in the two-dimensional variable matrix construction stage in time series Space (i.e., two-dimensional variable matrix M), convolution is performed through an n*n* convolution kernel to extract spatial information in the matrix. To further reduce the sparsity of the matrix, the maximum value of each pooling window is retained through the maximum pooling layer to retain useful feature information. Since there may be values ​​less than 0 in the matrix, in order to prevent the problem of neuron death, the output tensor V is obtained after changing its shape through the fully connected layer and then through the Leaky_Relu activation function. b .

[0065] S43. The tensor V a and V b Horizontal concatenation to obtain the resulting tensor V ab , which contains the abstract features of semantic information, temporal information, and variable space information. After passing through the attention layer Att, the weight of the more valuable part is increased, while the weight of the irrelevant part is reduced. The output is recorded as V att ; Finally, a fully connected layer is used to change the shape of the tensor and reduce the feature dimension to obtain the output tensor V res The output tensor is then input into the random forest regression test to determine whether the log sequence is abnormal by voting with decision trees. The classification output of each decision tree is either 1 or 0, where 0 is a normal vote and 1 is an abnormal vote. This application sets the number of decision trees in the random forest to T. N , after all decision trees have voted, the number of decision trees that cast abnormal votes is TA, when TA / T N When ≥0.5, the log sequence is considered abnormal, otherwise it is normal. The specific expression is:

[0066]

[0067]

[0068] In the above formula, TA is the number of abnormal voting results of all decision trees, and function f t Voting result for the tth decision tree.

[0069] After all the original computing power network logs are processed through steps S1, S2 and S3, the above S4 operation is performed to obtain the final anomaly detection results, and an alarm is issued for the logs with detected anomalies.

[0070] The embodiment of the present application also provides a computing power network log anomaly detection system combining time series and convolution, including:

[0071] The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log by using regular expressions, replace the variable positions of the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain a log sequence;

[0072] The template parsing module is used to quickly classify the structured logs into log templates through a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features through the log template numbers; generate semantic features from the structured logs through the AL-Bert model;

[0073] The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and to construct a two-dimensional variable matrix on the time series to obtain spatial features;

[0074] The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as inputs and use a two-way model for prediction. The two-way model specifically includes two branches, a time series branch and a spatial convolution branch, wherein the time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures; the output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0075] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A computing network log anomaly detection method combining time series and convolution, characterized in that The method comprises the following steps: Step 1: Use regular expressions to separate variables and structured information in the computing power network system log, replace the variable position of the computing power network system log with a structured placeholder to obtain a structured log, and determine the time window and stride to obtain a log sequence; Step 2: The structured logs are quickly classified into log templates through a hash-optimized fixed-layer parse tree, all structured logs are mapped to corresponding log templates, and the log templates are marked with corresponding serial numbers to form log template numbers, and sequence features are generated through the log template numbers; semantic features are generated from the structured logs through the AL-Bert model; Step 3: Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization, and a two-dimensional variable matrix on the time series is constructed to obtain the spatial features; Step 4: Using the sequence features, semantic features, and spatial features as input, a two-way model is used for prediction. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures. The output vector is judged whether it is abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

2. According to claim 1, the method for detecting anomalies in computing network logs by combining time series and convolution is characterized in that: In step 1, a hash function is used to assign the same regular number to the variables separated by the same regular expression, and the variable position in the computing network system log is replaced by the corresponding regular number. The replaced value is recorded as a structured placeholder, and the log after this operation is recorded as a structured log.

3. According to claim 1, the method for detecting anomalies in computing network logs by combining time series and convolution is characterized in that: Step 2 is specifically: Setting a hash table for dynamically recording whether a log template has been parsed, wherein the hash table is presented in the form of a key-value pair, where the key is the log template and the value is the log template number; Before the structured log enters the fixed-layer parse tree construction, the hash table is queried to determine whether the log template corresponding to the structured log has been mapped. If it has been mapped, the log template of the structured log is directly recorded as the corresponding log template number in the hash table; If it has not been mapped, take the structured log of the computing network log preprocessing stage and enter the fixed-layer parsing tree optimized by hashing until it matches the leaf node corresponding to the last layer of the log parsing tree; Each structured log in the log sequence is replaced with the corresponding log template number, and the replaced vector forms the sequence feature.

4. According to claim 3, the method for detecting anomalies in computing network logs by combining time series and convolution is characterized in that: The parse tree has a total of D layers; among which: The first layer is used to initially classify the length of structured logs and classify structured logs of different lengths into different branches. In the second to D-1 layers, structured logs are classified into different branches based on the complete matching of strings.

5. According to claim 4, a computing power network log anomaly detection method combining time series and convolution is characterized in that: Match the structured log and each log template in the log template set of the leaf node through the log similarity function, and take the log template with the highest similarity from all the log template sets whose similarity exceeds the preset threshold as Template max , and mark the log template number of the structured log as Template max The corresponding log template number; if the set is an empty set, the structured log itself is recorded as a new log template in the leaf node, its log template number is recorded, and the hash table is updated.

6. According to claim 1, a computing power network log anomaly detection method combining time series and convolution is characterized by: The semantic feature generation described in step 2 is specifically: Take the log sequence as input and embed each string in the structured log using the encoder-based language representation model AL-Bert. Add up the strings after embedding all words in the same log and divide by the number of strings in the structured log to get a vector of fixed length; The tensor obtained after the above operation on several consecutive structured logs is taken as the semantic feature.

7. According to claim 1, a computing power network log anomaly detection method combining time series and convolution is characterized by: Step 3 specifically is: Take the structured placeholder mapped by the hash function in step 1, and determine the position mapped to the two-dimensional variable matrix by the position of the structured log where the structured placeholder is located in a time window and the position of the structured log where the structured placeholder is located.

8. According to claim 7, a computing power network log anomaly detection method combining time series and convolution is characterized in that: The row of the structured placeholder in the two-dimensional variable matrix is ​​consistent with the position of the corresponding structured log in the time window, and the column in the two-dimensional variable matrix is ​​mapped to the corresponding position J of the two-dimensional variable matrix. The mapping rule is: j represents the jth structured placeholder in the log.

9. According to claim 1, a computing power network log anomaly detection method combining time series and convolution is characterized by: Step 4 is as follows: The semantic features and sequence features obtained in step 3 are predicted by the bidirectional long short-term memory models L1 and L2 respectively to obtain the output tensors F1 and F2, and the output tensors F1 and F2 are horizontally spliced ​​successively to generate the output vector V a ; The spatial features obtained in step 3 are input into the convolutional neural network, and convolution calculation is performed to extract spatial information. The maximum value of each pooling window is retained through the preset pooling layer maximum pooling to reduce the dimension of the feature map and reduce the sparsity of the two-dimensional variable matrix; the output shape is changed through the fully connected layer to make it a one-dimensional vector, and then delinearized through the activation function to improve the expression ability of the neural network to the model. The output vector is recorded as V b ; The output vector V a and V b After horizontal splicing, we get vector V ab , the vector V ab The attention layer enables the two-way model to focus on the key parts of the input data, and the output tensor is recorded as V att ; Change the shape of the tensor through the fully connected layer to reduce the feature dimension to obtain the output vector V res , and finally the output vector V res Input into the random forest regression model to determine whether the log sequence is abnormal.

10. A computing power network log anomaly detection system combining time series and convolution, characterized in that: include: The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log by using regular expressions, replace the variable positions of the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain a log sequence; The template parsing module is used to quickly classify the structured logs into log templates through a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features through the log template numbers; Generate semantic features from structured logs through the AL-Bert model; The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and to construct a two-dimensional variable matrix on the time series to obtain spatial features; The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as inputs and use a two-way model for prediction. The two-way model specifically includes two branches, a time series branch and a spatial convolution branch, wherein the time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network, and the two branches are parallel structures; the output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

Images