A method for detecting abnormal points in disaster recovery systems based on NLP

Abstract

The present invention discloses a method for detecting abnormal points in a disaster recovery system based on NLP, comprising: obtaining a log text data set, extracting a key-value pair structure based on NLP semantic analysis, establishing a multidimensional word vector matrix for each word in the dictionary, and constructing a word vector matrix for each log text data; inputting the log text data at the current moment and the abnormal risk confidence at the previous moment into a long short-term memory network to obtain the abnormal risk confidence, and comparing it with the abnormal risk threshold to obtain a risk log text data sequence; inputting the risk log text data sequence into a Markov chain to obtain a transition probability, and when the transition probability reaches the abnormal transition probability threshold, the current log text data is used as an abnormal point of the risk log text data sequence, and the abnormal workstation in the production process is determined based on the abnormal point. The method for detecting abnormal points in a disaster recovery system can accurately detect abnormal points in log texts.

Description

Technical Field

[0001] The present invention belongs to the field of disaster recovery and backup of computer application systems, and in particular relates to an abnormal point detection method for a disaster recovery system based on NLP. Background Art

[0002] As the tobacco industry's business relies more and more on information systems, the stability, high availability and rapid recovery capabilities of information systems are also increasingly required. This places higher demands on information center administrators, who need to quickly locate and handle problems in hardware devices, operating systems, databases, middleware and even business systems, which greatly increases the workload and difficulty of administrators. At present, the State Tobacco Administration and provincial companies have established corresponding local or remote disaster recovery systems for core business systems, which can basically perform manual disaster recovery switching according to the disaster level, so the switching efficiency is low. When a real disaster occurs, the manpower and material resources invested in disaster recovery switching are huge, and the issuance of disaster recovery switching instructions is basically based on the judgment of system managers on system failures, and the accuracy of the instructions needs to be improved. Especially after the introduction of some semi-automatic and automatic switching methods, how to accurately grasp the timing of issuing automatic switching instructions has become a difficult problem that needs to be solved urgently.

[0003] At present, in the direction of disaster recovery switching big data analysis, the method of using business indicators and machine indicators for anomaly analysis is relatively mature, but the method of analysis through system logs is still at a relatively primary stage. The existing log-based anomaly detection methods are mainly divided into three types, namely using PCA for anomaly detection, analyzing the correlation of different log categories for anomaly detection, and using workflow models for anomaly detection. Although these anomaly detection methods can be effectively applied in specific fields, they are not a general online anomaly detection method. Therefore, it is very necessary to perform automated anomaly detection through system logs. However, the application of system log abnormal pattern detection is relatively complex, and the main challenges are as follows:

[0004] First, unstructured logs, their formats and semantics vary greatly between different systems. Some existing methods use rule-based methods to solve this problem, but the design of rules relies on domain knowledge, such as regular expressions commonly used in the industry. More importantly, rule-based methods are not applicable to general anomaly detection because it is almost impossible to know in advance what the focus is in different types of logs.

[0005] Second, timeliness. In order for users to be able to promptly discover anomalies in the system, anomaly detection must be timely. Log data is input in the form of data streams, which means that the method of analyzing the entire log data is not applicable.

[0006] 3. There are many types of anomalies. Systems and applications may generate many types of anomalies. We hope that the anomaly detection system can not only target specific anomaly types, but also detect unknown anomalies. At the same time, log messages also contain rich information, such as log keys, parameter values, timestamps, etc. Most existing anomaly detection methods only analyze specific parts of log messages (such as log keys), which limits the types of anomalies they can detect.

[0007] Therefore, anomaly detection is an important task in building a secure and reliable computer system. As tobacco business systems become more and more complex, they face more and more vulnerabilities and defects. Therefore, anomaly detection is becoming more and more challenging, and many traditional anomaly detection methods based on standard mining algorithms are no longer effective. System logs record system status and signal events at different points to help solve performance problems and failures. System logs in the disaster recovery system of the tobacco core business system are even more helpful in determining whether disaster recovery switching instructions are issued and what kind of disaster recovery switching instructions are issued. Disaster recovery system logs record some key events that occur during the operation of the system, so they are a valuable resource for understanding the system status and an excellent source of information for online monitoring and anomaly detection. System logs record the status and important events of the system at various time periods, and are an important data source for anomaly detection, which is a key step in building an efficient disaster recovery system. Based on the above reasons, a necessary condition for improving the accuracy of automatic disaster recovery switching instructions is to improve the accuracy of anomaly detection. Summary of the invention

[0008] The present invention provides a method for detecting abnormal points in a disaster recovery system based on NLP, which can accurately detect abnormal points in a log text.

[0009] A method for detecting abnormal points in a disaster recovery system based on NLP, comprising:

[0010] (1) Obtain a log text data set, extract each log text data based on NLP semantic analysis to obtain a key-value pair structure, perform word frequency screening on multiple key-value pair structures to construct a dictionary of the log text data set, use the word2vec algorithm to establish a multidimensional word vector matrix for each word in the dictionary, and use multiple multidimensional word vector matrices to construct a word vector matrix for each log text data;

[0011] (2) Based on the time sequence, the log text data at the current moment and the abnormal risk confidence at the previous moment are input into the long short-term memory (LSTM) network to obtain the abnormal risk confidence at the current moment. When the abnormal risk confidence at the current moment reaches the abnormal risk threshold, the log text data at the current moment is used as the risk log text data, and the log text data before the current moment and the risk log text data are used to construct a risk log text data sequence;

[0012] (3) Each log text data in the risk log text data sequence is input into the Markov chain in chronological order to obtain the transition probability of each log text data to the log text data at the next moment. When the transition probability reaches the abnormal transition probability threshold, the current log text data is used as the abnormal point of the risk log text data sequence, and the abnormal workstation in the production process is determined based on the abnormal point.

[0013] Based on NLP semantic analysis, each log text data is extracted to obtain a key-value pair structure, including:

[0014] Based on NLP semantic analysis, the event type and the time content text data corresponding to the event type in each log text data are extracted to construct a key-value pair structure, where the event type is the key and the corresponding time content text data is the value.

[0015] Natural Language Processing (NLP) is an important field in the fields of computer science and artificial intelligence. It studies the theories and methods of effective communication between humans and computers using natural language. It is a science that integrates linguistics, computer science, mathematics, etc. It aims to extract information from text data. The purpose is to allow computers to process or "understand" natural language in order to perform automatic translation, text classification, sentiment analysis, etc.

[0016] The event type of each log text data and the time content text data corresponding to the event type are screened for each word frequency to construct a dictionary.

[0017] Based on the time sequence, the log text data at the current moment and the abnormal risk confidence at the previous moment are input into the long short-term memory network to obtain the abnormal risk confidence at the current moment, including:

[0018] Each log text data is sorted, and the word vector matrix of each log text data and the abnormal risk confidence of the previous moment are spliced, and the splicing result is input into the long short-term memory network to obtain the abnormal risk confidence of the current moment.

[0019] The risk log text data is determined based on the abnormal risk confidence output by the long short-term memory network. The abnormal risk confidence is a floating point number between 0 and 1. The larger the value, the higher the abnormal risk. The abnormal risk threshold is set. When the abnormal risk confidence reaches the abnormal risk threshold, the risk log text data is located.

[0020] Concatenate the word vector matrix of each log text data and the abnormal risk confidence of the previous moment, including:

[0021] The abnormal risk confidence is converted into a multidimensional one-hot code, the multidimensional one-hot code is concatenated with the multidimensional word vector matrix of each log text data, and the concatenated result is used as the input of the long short-term memory network.

[0022] The abnormal risk confidence is converted into a multidimensional one-hot encoding t:

[0023] t = round(p × n)

[0024] Among them, p is a floating point number of abnormal risk confidence, and n is the word vector dimension of each log text data.

[0025] Transition probability λ ij for:

[0026]

[0027] Among them, N ij is the number of log text data at the i-th moment transferred to the log text data at the j-th moment within the unit time interval ΔS, is the number of log text data at the i-th moment in the log text data set within time T, and ΔS is the unit time interval between two adjacent log text data.

[0028] Each log text data in the risk log text data sequence is transferred to the next moment log text data through the Markov chain to determine the transfer probability, wherein the Markov chain is a multi-dimensional asymmetric sparse matrix, and the diagonal elements in the asymmetric sparse matrix are:

[0029] λ ii =-∑ i≠j λ ij

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] (1) The log text of the current disaster recovery system in the tobacco industry is analyzed through the natural semantic analysis algorithm of the NLP class. Each word in the log text is analyzed to improve the accuracy of anomaly detection, thereby providing strong data support for the issuance of automatic switching instructions and providing ideas for subsequent fully automatic disaster recovery switching.

[0032] (2) First, the long short-term memory network is used to locate the risk log text, so as to quickly locate the abnormal text. The log text related to the risk log text is extracted in chronological order to obtain the risk log text sequence of the workflow. The Markov chain is used to accurately and quickly obtain the abnormal points in the risk log text sequence. The above two steps narrow the search range of abnormal points, effectively improving the efficiency and hit rate of abnormal point detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flowchart of an abnormal point detection method for a disaster recovery system based on NLP provided in a specific embodiment of the present invention;

[0034] Figure 2 The present invention is a flowchart of an abnormal point detection method for a disaster recovery system based on NLP provided in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0035] like Figure 1 Therefore, the present invention provides a method for detecting abnormal points in a disaster recovery system based on NLP, and the specific steps are as follows:

[0036] (1) Text log preprocessing, the specific steps are as follows:

[0037] Obtain the original log data, that is, the log text data set, and use NLP semantic analysis to divide each log text data into a key-value pair structure of event type-time content text data. The log text data set contains multiple key-value pair structures. Each word in the multiple key-value pair structures is filtered for word frequency to build a dictionary of the log text data set. Use the word2vec algorithm to build a multidimensional word vector matrix for each word in the dictionary. Multiple multidimensional word vector matrices are used to build a word vector matrix for each log text data. By converting the log text data into multiple multidimensional word vector matrices, the log text semantic data is converted into multidimensional word vector data, which can more accurately detect abnormal data, thereby obtaining abnormal log text data;

[0038] (2) Perform path anomaly detection. The specific steps are as follows:

[0039] According to the time sequence, each log text data is sorted at each moment, the current log text data is spliced ​​with the abnormal risk confidence obtained by the long short-term memory network at the previous moment, and the splicing result is input into the long short-term memory network again to obtain the abnormal risk confidence at the current moment, and the log text data is continuously input according to the time sequence, and the abnormal risk of the input log text data is continuously superimposed. When the abnormal risk at the current moment reaches the abnormal risk threshold, the current log text data is used as the risk log text data, and the log text data before the current moment related to the risk log text data is used to construct a risk log text data sequence;

[0040] Among them, the abnormal risk confidence is a floating point number between 0 and 1. The larger the value, the higher the abnormal risk. The abnormal risk threshold is set. When the abnormal risk confidence reaches the abnormal risk threshold, the risk log text data is located, and the abnormal risk confidence is converted into a multidimensional one-hot code. The multidimensional one-hot code is concatenated with the multidimensional word vector matrix of each log text data, and the concatenated result is used as the input of the long short-term memory network. The multidimensional one-hot code t is:

[0041] t = round(p × n)

[0042] Among them, p is a floating point number of abnormal risk confidence, and n is the word vector dimension of each log text data;

[0043] (3) Workflow anomaly detection. The specific steps are as follows:

[0044] The abnormal probability of the current log text data output by the LSTM-based algorithm can be regarded as the accumulation of abnormal confidence of the previous log text data. In actual production, when the abnormal risk exceeds the threshold, the error may have occurred before. In order to further accurately troubleshoot and locate, the present invention uses a workflow model, i.e., a Markov chain model, to quantify the possibility of the next log record by calculating the transition probability matrix;

[0045] A workflow model is constructed based on the transfer process of log text data, and the transfer probability matrix is ​​calculated. The workflow model is a multi-dimensional asymmetric sparse matrix, and the diagonal elements in the asymmetric sparse matrix are:

[0046] λ ii =-∑ i≠j λ ij

[0047]

[0048] Among them, λ ij is the transition probability, N ijis the number of log text data at the i-th moment transferred to the log text data at the j-th moment within the unit time interval ΔS, is the number of log text data at the i-th moment in the log text data set within time T, ΔS is the unit time interval between two adjacent log text data;

[0049] The logs with higher abnormal risk probability at the current moment t and the logs before moment t are combined into a subsequence, namely, a risk log text data sequence. The risk log text data sequence is input into the workflow model to obtain the transfer probability of each log text data to the log text data at the next moment. When the transfer probability reaches the abnormal transfer probability threshold, the current log text data is taken as the abnormal point of the risk log text data sequence, and the abnormal workstation in the production process is determined based on the abnormal point.

[0050] Example

[0051] like Figure 2 As shown, the present invention selects part of the log sequence, and detects abnormal points by using the NLP-based disaster recovery system abnormal point detection method provided by the present invention. The specific steps are:

[0052] Select the original log data:

[0053] l1: instance: Terminating instance

[0054] l2: instance: Instance destroyed successfully

[0055] l3: instance: Deleting instance files*

[0056] l4:instance:Permission Denied

[0057] l7: instance: Took 5s to destroy the instance

[0058] l6: instance: Termination of instance complete

[0059] S1, log data l i , i = 1...6, processed as a key-value pair type, the key is the log type, the value is the log text content, and then processed by the word2vec model into a (k+1)×n dimensional matrix, where k is the log l i The value text length is used to convert the log sequence into a three-dimensional array of 6×(k+1)×n.

[0060] S2. Input the matrix of the log sequence into LSTM in sequence to perform path anomaly detection. Specifically, initialize the log risk probability to 0, convert it into an n-dimensional 0 vector, and concatenate it with the matrix of log l1 to form a (k+2)×n-dimensional matrix input to LSTM, and output its abnormal risk probability p1. If the p1 value is less than the risk probability threshold σ, continue to analyze the probability p1×n and round it off, process it into an n-dimensional one-hot encoding, concatenate it with the input matrix of log l2 to form a (k+2)×n input to LSTM, output the abnormal risk probability p2 of log l2, and determine that the p2 value is less than the risk probability threshold σ. And so on, until it is found that the risk probability p4 of log l4 is greater than the threshold σ. Select the log subsequence {l2, l3, l4} forward and enter S3.

[0061] S3. The workflow model analyzes the subsequence {l2, l3, l4} to accurately locate the specific location where the exception occurs. Specifically, the log state starting point is set to l2. Through the transition probability matrix of the workflow model, the log content with the highest transition probability of l2 should be "Deleting instance files*", which is the same as l3, and It is a normal transfer. Taking l3 as the starting point, the log with the highest transfer probability should be "Deletion of files*complete". The transfer probability from l3 to l4 is Therefore, the exception occurred in the system process corresponding to log l4, and the exception was accurately located.

[0062] The above-mentioned embodiments are only preferred embodiments of the present invention and cannot be used to limit the scope of protection of the present invention. Any non-substantial changes and substitutions made by technicians in this field on the basis of the present invention shall fall within the scope of protection required by the present invention.

Claims

1. A method for detecting abnormal points in a disaster recovery system based on NLP, characterized in that: include: (1) Obtain a log text data set, extract each log text data based on NLP semantic analysis to obtain a key-value pair structure, perform word frequency screening on multiple key-value pair structures to construct a dictionary of the log text data set, use the word2vec algorithm to establish a multidimensional word vector matrix for each word in the dictionary, and use multiple multidimensional word vector matrices to construct a word vector matrix for each log text data; (2) Based on the time sequence, the log text data at the current moment and the abnormal risk confidence at the previous moment are input into the long short-term memory network to obtain the abnormal risk confidence at the current moment. When the abnormal risk confidence at the current moment reaches the abnormal risk threshold, the log text data at the current moment is used as the risk log text data, and the log text data before the current moment and the risk log text data are used to construct a risk log text data sequence; (3) Each log text data in the risk log text data sequence is input into the Markov chain in chronological order to obtain the transition probability of each log text data to the log text data at the next moment. When the transition probability reaches the abnormal transition probability threshold, the current log text data is used as the abnormal point of the risk log text data sequence, and the abnormal workstation in the production process is determined based on the abnormal point.

2. The NLP-based disaster recovery system abnormality detection method according to claim 1 is characterized in that: Based on NLP semantic analysis, each log text data is extracted to obtain a key-value pair structure, including: Based on NLP semantic analysis, the event type and the time content text data corresponding to the event type in each log text data are extracted to construct a key-value pair structure, where the event type is the key and the corresponding time content text data is the value.

3. The NLP-based disaster recovery system abnormal point detection method according to claim 2 is characterized in that: The event type of each log text data and the time content text data corresponding to the event type are screened for each word frequency to construct a dictionary.

4. The NLP-based disaster recovery system abnormal point detection method according to claim 1 is characterized in that: Based on the time sequence, the log text data at the current moment and the abnormal risk confidence at the previous moment are input into the long short-term memory network to obtain the abnormal risk confidence at the current moment, including: Each log text data is sorted, and the word vector matrix of each log text data and the abnormal risk confidence of the previous moment are spliced, and the splicing result is input into the long short-term memory network to obtain the abnormal risk confidence of the current moment.

5. The NLP-based disaster recovery system abnormal point detection method according to claim 1 or 4, characterized in that: The risk log text data is determined based on the abnormal risk confidence output by the long short-term memory network. The abnormal risk confidence is a floating point number between 0 and 1. The larger the value, the higher the abnormal risk. The abnormal risk threshold is set. When the abnormal risk confidence reaches the abnormal risk threshold, the risk log text data is located.

6. The NLP-based disaster recovery system abnormal point detection method according to claim 5 is characterized in that: Concatenate the word vector matrix of each log text data and the abnormal risk confidence of the previous moment, including: The abnormal risk confidence is converted into a multidimensional one-hot code, the multidimensional one-hot code is concatenated with the multidimensional word vector matrix of each log text data, and the concatenated result is used as the input of the long short-term memory network.

7. The NLP-based disaster recovery system abnormal point detection method according to claim 6 is characterized in that: The abnormal risk confidence is converted into a multidimensional one-hot encoding t: t = round(p × n) Among them, p is a floating point number of abnormal risk confidence, and n is the word vector dimension of each log text data.

8. The NLP-based disaster recovery system abnormal point detection method according to claim 1, characterized in that: Transition probability λ ij for: Among them, N ij is the number of log text data at the i-th moment transferred to the log text data at the j-th moment within the unit time interval Δs, is the number of log text data at the i-th moment in the log text data set within time T, and Δs is the unit time interval between two adjacent log text data.

9. The NLP-based disaster recovery system abnormality detection method according to claim 8, characterized in that: Each log text data in the risk log text data sequence is transferred to the next moment log text data through the Markov chain to determine the transfer probability, wherein the Markov chain is a multi-dimensional asymmetric sparse matrix, and the diagonal elements in the asymmetric sparse matrix are: l ii =-∑ i≠j l ij 。

Images