Abnormal log detection method, device, electronic device and readable medium

Abstract

The present disclosure provides an abnormal log detection method, device, electronic device and readable medium, wherein the abnormal log detection method comprises: converting the collected log sequence into multiple log vectors; inputting the log vectors into a constructed bidirectional T-LSTM network, introducing an attention mechanism into the output layer of the bidirectional T-LSTM network to assign weights to log events, and the weights are determined by the time interval between time series; classifying and processing the log events with assigned weights to determine abnormal logs in the log events. Through the embodiments of the present disclosure, the reliability, accuracy and efficiency of abnormal log detection are improved.

Description

Background Art

[0002] At present, the Java exception mechanism is to capture known errors that may occur in the program and handle them accordingly. Such exceptions are caused by low-level exceptions in the system itself, such as database connection failure, memory overflow, null pointer exception, etc. Such exceptions do not need to appear in the foreground, because users cannot understand and do not need to see these exception information. Such exceptions need to be fully recorded in the log data for developers to view and analyze in the future. However, static data statistical features are extracted from the log data, and the features are input into the initial model and the training model, but only static statistical data features are extracted without considering contextual information, and the detection performance of abnormal logs is low.

[0003] In related technologies, LSTM (Long Short-Term Memory) is a long short-term memory network, a time recursive neural network, suitable for processing and predicting important events with relatively long intervals and delays in time series. Therefore, LSTM can be used to enhance the contextual relevance of logs, thereby improving the reliability of abnormal log detection.

[0004] However, the following problems still exist when LSTM is used to detect log anomalies:

[0005] Long short-term memory network (LSTM) is the mainstream method for time series prediction. However, the standard LSTM does not consider the time characteristics of events. For example, if the system performance is degraded due to insufficient network and CPU resources, the time interval of log events will change. The existing LSTM cannot accurately detect the above anomalies due to the lack of time characteristics.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present disclosure is to provide an abnormal log detection method, device, electronic device and readable medium, which are used to overcome the problem of poor log detection accuracy caused by the limitations and defects of related technologies to at least a certain extent.

[0008] According to a first aspect of an embodiment of the present disclosure, a method for detecting abnormal logs is provided, comprising: converting a collected log sequence into multiple log vectors; inputting the log vectors into a constructed bidirectional T-LSTM network, wherein an output layer of the bidirectional T-LSTM network introduces an attention mechanism to assign weights to log events, wherein the weights are determined by the time interval between the time series; and classifying the log events to which the weights are assigned to determine abnormal logs in the log events.

[0009] In an exemplary embodiment of the present disclosure, converting the collected logs into multiple log vectors includes: storing the collected log sequence in segments according to application identifiers; and vectorizing the log sequence stored in segments through a preset event template to obtain the log vectors.

[0010] In an exemplary embodiment of the present disclosure, inputting the log vector into the constructed bidirectional T-LSTM network includes: inputting the first n-1 log sequences into the forward T-LSTM network in the bidirectional T-LSTM network, and the output of the forward T-LSTM network is the nth log sequence; inputting the last n-1 log sequences into the reverse T-LSTM network in the bidirectional T-LSTM network, and the output of the reverse T-LSTM network is the first log sequence; and merging the hidden layer vector of the forward T-LSTM network with the hidden layer vector of the reverse T-LSTM network to obtain a merged vector.

[0011] In an exemplary embodiment of the present disclosure, the bidirectional T-LSTM network constructed by inputting the log vector also includes: inputting the merged vector into the fully connected layer, the fully connected layer is the output layer of the bidirectional T-LSTM network, and the fully connected layer trains network parameters through a stochastic gradient descent algorithm.

[0012] In an exemplary embodiment of the present disclosure, it also includes: determining the short-term memory of the previous time step; and adjusting the short-term memory through a non-increasing function, a non-decreasing function and the time series.

[0013] In an exemplary embodiment of the present disclosure, it also includes: determining the complementary subspace of the short-term memory as the long-term memory; combining the adjusted short-term memory with the long-term memory to obtain the adjusted memory of the previous time step.

[0014] In an exemplary embodiment of the present disclosure, the subspace decomposition stage of the T-LSTM is performed according to the standard gating structure of LSTM.

[0015] According to a second aspect of an embodiment of the present disclosure, an abnormal log detection device is provided, including: a conversion module, configured to convert a collected log sequence into multiple log vectors; a calculation module, configured to input the log vectors into a constructed bidirectional T-LSTM network, the output layer of the bidirectional T-LSTM network introduces an attention mechanism to assign weights to log events, and the weights are determined by the time interval between the time series; a classification module, configured to classify the log events with assigned weights to determine the abnormal logs in the log events.

[0016] According to a third aspect of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the methods described above based on instructions stored in the memory.

[0017] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a program is stored, and when the program is executed by a processor, the abnormal log detection method as described in any one of the above items is implemented.

[0018] The disclosed embodiment converts the collected log sequence into multiple log vectors, inputs the log vectors into a constructed bidirectional T-LSTM network, detects the correlation between log contexts, introduces an attention mechanism in the output layer of the bidirectional T-LSTM network to assign weights to log events, and classifies the log events with assigned weights, so as to timely detect abnormal logs in log events, thereby improving the reliability, accuracy and efficiency of abnormal log detection.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0021] Figure 1 is a flow chart of an abnormal log detection method in an exemplary embodiment of the present disclosure;

[0022] Figure 2 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0023] Figure 3 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0024] Figure 4 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0025] Figure 5 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0026] Figure 6 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0027] Figure 7 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0028] Figure 8 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0029] Fig. 9 is a flow chart of another abnormal log detection method in an exemplary embodiment of the present disclosure;

[0030] Fig.10 is a block diagram of an abnormal log detection device in an exemplary embodiment of the present disclosure;

[0031] Fig.11 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0033] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0034] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0035] Figure 1 is a flow chart of an abnormal log detection method in an exemplary embodiment of the present disclosure.

[0036] refer to Figure 1 , the abnormal log detection method may include:

[0037] Step S102: converting the collected log sequence into multiple log vectors.

[0038] Step S104: input the log vector into the constructed bidirectional T-LSTM network, and introduce an attention mechanism into the output layer of the bidirectional T-LSTM network to assign weights to log events, where the weights are determined by the time intervals between the time series.

[0039] Step S106: Classify the log events with assigned weights to determine abnormal logs in the log events.

[0040] The disclosed embodiment converts the collected log sequence into multiple log vectors, inputs the log vectors into a constructed bidirectional T-LSTM network, detects the correlation between log contexts, introduces an attention mechanism in the output layer of the bidirectional T-LSTM network to assign weights to log events, and classifies the log events with assigned weights, so as to timely detect abnormal logs in log events, thereby improving the reliability, accuracy and efficiency of abnormal log detection.

[0041] Combine the following Figures 2 to 9 , each step of the abnormal log detection method is explained in detail.

[0042] In an exemplary embodiment of the present disclosure, Figure 2 As shown, converting the collected logs into multiple log vectors includes:

[0043] Step S202: The collected log sequence is stored in segments according to the application identifier.

[0044] Step S204: vectorize the log sequence stored in the shard using a preset event template to obtain the log vector.

[0045] In an exemplary embodiment of the present disclosure, Figure 3 As shown, the bidirectional T-LSTM network constructed by inputting the log vector includes:

[0046] Step S302: input the first n-1 log sequences to the forward T-LSTM network in the bidirectional T-LSTM network, and the output of the forward T-LSTM network is the nth log sequence.

[0047] Step S304: input the next n-1 log sequences to the reverse T-LSTM network in the bidirectional T-LSTM network, and the output of the reverse T-LSTM network is the first log sequence.

[0048] Step S306, merging the hidden layer vector of the forward T-LSTM network with the hidden layer vector of the reverse T-LSTM network to obtain a merged vector.

[0049] In an exemplary embodiment of the present disclosure, Figure 4 As shown, the bidirectional T-LSTM network constructed by inputting the log vector also includes:

[0050] Step S402: input the merged vector into the fully connected layer, which is the output layer of the bidirectional T-LSTM network. The fully connected layer trains network parameters by a stochastic gradient descent algorithm.

[0051] In an exemplary embodiment of the present disclosure, Figure 5 As shown, the abnormal log detection method also includes:

[0052] Step S502, determining the short-term memory of the previous time step.

[0053] Step S504, adjusting the short-term memory by using a non-increasing function, a non-decreasing function and the time series.

[0054] In an exemplary embodiment of the present disclosure, Figure 6 As shown, the abnormal log detection method also includes:

[0055] Step S602, determining that the supplementary subspace of the short-term memory is a long-term memory.

[0056] Step S604, combining the adjusted short-term memory with the long-term memory to obtain the adjusted memory of the previous time step.

[0057] In an exemplary embodiment of the present disclosure, the subspace decomposition stage of the T-LSTM is performed according to the standard gating structure of LSTM.

[0058] In an exemplary embodiment of the present disclosure, Figure 7 As shown, the abnormal log detection method also includes:

[0059] Step S702: Collect original log sequence data of a specified application.

[0060] Step S704, obtaining N log templates.

[0061] Step S706: pre-process the log sequence data according to the log template.

[0062] Step S708, input the log sequence data into the log anomaly detection module, including log module vectorization, bidirectional T-LSTM, and classification layer based on attention mechanism.

[0063] Step S710, determining the probability that the next log is an abnormal log.

[0064] In an exemplary embodiment of the present disclosure, Figure 8 As shown in the figure, the abnormal log detection scheme can be summarized into the following processing stages:

[0065] The first stage: inputting the collected log sequence data into N log templates for preprocessing 802, and inputting the preprocessed log sequence data into an embedding layer to obtain a plurality of corresponding log vectors.

[0066] The second stage: that is, the core network processing process 804 of the present invention, multiple log vectors V1, V2, ... Vn are input into the T-LSTM cell body of the bidirectional T-LSTM, and the dependency between the log vectors, that is, the contextual relevance, is captured through the bidirectional T-LSTM, thereby improving the efficiency of anomaly detection.

[0067] In addition, the hidden layer vectors of the two T-LSTM networks are merged and combined as the input of the fully connected layer, and the attention mechanism is introduced in the fully connected layer to assign different weights to log events.

[0068] The third stage: The softmax layer calculates the probability that the next log is abnormal.

[0069] For example, α is the calculated weight of various log events. The α corresponding to all hidden states is summed up, that is, a softmax layer is constructed to output the classification result, the cross entropy is used as the loss function, and the stochastic gradient descent algorithm is used to train the parameters.

[0070] Specifically, the T-LSTM autoencoder has T-LSTM encoder and T-LSTM decoder units with different parameters, which minimize the reconstruction error through joint learning. The T-LSTM autoencoder can capture long-term and short-term dependencies by incorporating the elapsed time into the system and learn a single representation for reconstructing the input sequence. Therefore, the mapping learned by the T-LSTM autoencoder maintains the temporal dynamics of the original sequence over time.

[0071] like Fig. 9 As shown, the T-LSTM network of the present invention has made the following improvements:

[0072] The T-LSTM (Time-Aware LSTM) model takes into account the time interval between time series, divides the memory state into short-term memory and long-term memory, and adjusts the influence of short-term memory according to the time interval between inputs. The longer the time interval, the smaller the influence of short-term memory. The adjusted short-term memory and long-term memory are then reorganized into a new memory state.

[0073] In the present disclosure, T-LSTM is mainly used to process the temporal irregularity of sequences, especially the irregularity of intervals.

[0074] 1. Decay short-term memory based on time intervals:

[0075] T-LSTM has the forget, input, and output gates of the standard LSTM, but the memory unit is adjusted so that the longer the time is, the less influence the previous memory has on the current output. To achieve this, the elapsed time is converted into weights using a time decay function (a non-increasing function of the interval time), which includes a non-increasing function of the interval time and a non-decreasing function of the interval time.

[0076] Specifically, T-LSTM decomposes cellular memory into short-term memory and long-term memory. Before combining with long-term memory, the short-term memory is converted into a weight to discount the influence of the short-term memory using the time (Δt) between two consecutive records.

[0077] 2. Perform subspace decomposition only on the previous time step:

[0078] The subspace decomposition method of T-LSTM does not change the impact of the current input on the current output, but changes the impact of the previous memory on the current output.

[0079] T-LSTM accepts two inputs, the current record and the time elapsed since the current time step. The main change in the T-LSTM architecture is the subspace decomposition of the memory of the previous time step. Although the amount of information contained in the memory of the previous time step needs to be adjusted, it is not desirable to lose the global information of the input log.

[0080] Therefore, the T-LSTM model does not completely discard the long-term effect, but adjusts the short-term memory according to the time span between the records of time steps t to t-1. If the gap between time t and t-1 is large, it means that there is no new information recorded in the log for a long time. Therefore, the reliance on short-term memory should not play an important role in the prediction of the current output.

[0081] The mathematical expression of the subspace decomposition process of T-LSTM is given below:

[0082] Short-term memory: through the memory C of the previous time step t-1 Acquire short-term memory There is no specific requirement for the activation function type of the decomposition network. In the embodiment of the present disclosure, the prediction performance of the tanh activation function is slightly better. The expression of is as follows:

[0083]

[0084] Among them, W d and b d are preset parameters.

[0085] Discounted short-term memory: obtained through the time feature processing process 902, in short-term memory After obtaining it, it is weighted and adjusted by the elapsed time to obtain the short-term memory after discount The expression of is as follows:

[0086]

[0087] Among them, g(Δt) is a non-increasing function 9024, g ′ (Δt) is a non-decreasing function 9022.

[0088] Long-term memory: The complementary subspace of short-term memory is long-term memory The expression of is as follows:

[0089]

[0090] Adjusted previous memory: Combine the short-term memory and long-term memory after the discoun to obtain the adjusted memory of the previous time step The expression of is as follows:

[0091]

[0092] Further, based on the above memory, the T-LSTM of the embodiment of the present disclosure constructs three gates, namely, the forget gate 906, the input gate 904 and the output gate 908. The specific principle and mathematical expression are as follows:

[0093] (1) Forget gate 906: The information of the previous hidden state and the current input information are simultaneously input into the Sigmoid function. The output value is between 0 and 1. The closer to 0, the more data should be forgotten, and the closer to 1, the more data should be retained. The forget gate can be used to control which data is forgotten. The output result of the forget gate 906 is expressed as formula (5):

[0094] f t =σ(W f × t +U f ×h t-1 +b f ), formula (5).

[0095] Among them, W f , U f and b f are preset parameters.

[0096] (2) Input gate 904 is used to update the unit state. The previous hidden state information and the current input information are first input into the Sigmoid function, and the output value is adjusted between 0 and 1 to determine which information to update. 0 means unimportant, and 1 means important. The hidden state and the current input can also be transmitted to the Tanh function, and the value is compressed between -1 and 1 to adjust the network. Then, the Tanh output and the Sigmoid output are multiplied. The Sigmoid output will determine which information in the Tanh output is important and needs to be retained. The output result of input gate 904 is expressed as formula (6):

[0097] i t =σ(W i × t +U i ×h t-1 +b i ), formula (6).

[0098] Among them, W i , U i and b iare preset parameters.

[0099] (3) Output gate 908: It can determine the value of the next hidden state. The hidden state contains relevant information about the previous input. Of course, the hidden state can also be used for prediction. First, the previous hidden state and the current input are passed to the Sigmoid function; then the newly obtained unit state is passed to the Tanh function; then the Tanh output and the Sigmoid output are multiplied to determine the information that the hidden state should carry; finally, the hidden state is used as the current unit output, and the new unit state and the new hidden state are transmitted to the next time step. The output result of the output gate 908 is expressed as formula (7):

[0100] o t =σ(W o × t +U o ×h t-1 +b o ), formula (7).

[0101] Among them, W o , U o and b o are preset parameters.

[0102] Based on the outputs of the above three gates, the T-LSTM of the embodiment of the present disclosure can calculate and determine the expression of the candidate memory as shown in formula (8):

[0103]

[0104] Among them, W c , U c and b c are preset parameters.

[0105] Among them, h t-1 is the output of the previous T-LSTM core, h t is the output of the current T-LSTM cell core, C t is the memory of the current T-LSTM core.

[0106] Corresponding to the above method embodiment, the present disclosure also provides an abnormal log detection device, which can be used to execute the above method embodiment.

[0107] Fig.10 It is a block diagram of an abnormal log detection device in an exemplary embodiment of the present disclosure.

[0108] refer to Fig.10 , the abnormal log detection device 1000 may include:

[0109] The conversion module 1002 is configured to convert the collected log sequence into multiple log vectors.

[0110] The calculation module 1004 is configured to input the log vector into a constructed bidirectional T-LSTM network, and the output layer of the bidirectional T-LSTM network introduces an attention mechanism to assign weights to log events, where the weights are determined by the time intervals between the time series.

[0111] The classification module 1006 is configured to classify the log events with assigned weights to determine abnormal logs in the log events.

[0112] In an exemplary embodiment of the present disclosure, the conversion module 1002 is further used to: store the collected log sequence in segments according to the application identifier; and vectorize the log sequence stored in segments through a preset event template to obtain the log vector.

[0113] In an exemplary embodiment of the present disclosure, the computing module 1004 is further used to: input the first n-1 log sequences into the forward T-LSTM network in the bidirectional T-LSTM network, and the output of the forward T-LSTM network is the nth log sequence; input the last n-1 log sequences into the reverse T-LSTM network in the bidirectional T-LSTM network, and the output of the reverse T-LSTM network is the first log sequence; merge the hidden layer vector of the forward T-LSTM network with the hidden layer vector of the reverse T-LSTM network to obtain a merged vector.

[0114] In an exemplary embodiment of the present disclosure, the computing module 1004 is further used to: input the merged vector into the fully connected layer, and the fully connected layer is the output layer of the bidirectional T-LSTM network.

[0115] In an exemplary embodiment of the present disclosure, the abnormal log detection device 1000 is further used to: determine the short-term memory of the previous time step; and adjust the short-term memory through a non-increasing function, a non-decreasing function and the time series.

[0116] In an exemplary embodiment of the present disclosure, the abnormal log detection device 1000 is also used to: determine that the supplementary subspace of the short-term memory is the long-term memory; and combine the adjusted short-term memory with the long-term memory to obtain the adjusted memory of the previous time step.

[0117] In an exemplary embodiment of the present disclosure, the subspace decomposition stage of the T-LSTM is performed according to the standard gating structure of LSTM.

[0118] Since the functions of the abnormal log detection device 1000 have been described in detail in the corresponding method embodiments, the present disclosure will not elaborate on them here.

[0119] In summary, compared with the prior art, the main creativity of the present disclosure lies in:

[0120] 1. The embodiments of the present disclosure utilize a time monotonic function to integrate event time characteristics into a long short-term memory network, so that the model can better reflect the characteristics of the log sequence and improve the efficiency of anomaly detection.

[0121] 2. The embodiment of the present disclosure adds an attention mechanism, fully considering the importance of different log templates, and at the same time converts the template output into the probability of abnormal log occurrence, reducing subjectivity and increasing the accuracy of detecting abnormal logs.

[0122] 3. The embodiment of the present disclosure also considers the semantics of the words constituting the log template and maintains the semantics of the log template through the embedding method.

[0123] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0124] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0125] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0126] Refer to the following Fig.11 The electronic device 1100 according to this embodiment of the present invention is described. Fig.11 The electronic device 1100 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0127] like Fig.11 As shown, the electronic device 1100 is in the form of a general computing device. The components of the electronic device 1100 may include but are not limited to: at least one processing unit 1110, at least one storage unit 1120, and a bus 1130 connecting different system components (including the storage unit 1120 and the processing unit 1110).

[0128] The storage unit stores program codes, which can be executed by the processing unit 1110, so that the processing unit 1110 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1110 can perform the method shown in the embodiment of the present disclosure.

[0129] The storage unit 1120 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 11201 and / or a cache storage unit 11202 , and may further include a read-only storage unit (ROM) 11203 .

[0130] The storage unit 1120 may also include a program / utility 11204 having a set (at least one) of program modules 11205, such program modules 11205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0131] Bus 1130 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0132] The electronic device 1100 may also communicate with one or more external devices 1140 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1100, and / or communicate with any device that enables the electronic device 1100 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1150. Furthermore, the electronic device 1100 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1160. As shown, the network adapter 1160 communicates with other modules of the electronic device 1100 via a bus 1130. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0133] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0134] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0135] The program product for implementing the above method according to an embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0136] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0137] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0138] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0139] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0140] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0141] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A method for detecting abnormal logs, characterized in that: include: Convert the collected log sequence into multiple log vectors; Input the log vector into the constructed bidirectional T-LSTM network, and introduce an attention mechanism into the output layer of the bidirectional T-LSTM network to assign weights to log events, where the weights are determined by the time intervals between time series; Determining a short-term memory of a previous time step in the bidirectional T-LSTM network; adjusting the short-term memory by a non-increasing function, a non-decreasing function, and the time series; Determining the complementary subspace of the short-term memory as the long-term memory; Combining the adjusted short-term memory with the long-term memory to obtain an adjusted memory of the previous time step; The log events to which the weights are assigned are classified to determine abnormal logs among the log events.

2. The abnormal log detection method according to claim 1, characterized in that: Converting the collected logs into multiple log vectors includes: The collected log sequences are stored in shards according to the application ID; The log sequence stored in the shard is vectorized using a preset event template to obtain the log vector.

3. The abnormal log detection method according to claim 1, characterized in that: The bidirectional T-LSTM network constructed by inputting the log vector includes: Inputting the first n-1 log sequences into the forward T-LSTM network in the bidirectional T-LSTM network, the output of the forward T-LSTM network being the nth log sequence; Inputting the next n-1 log sequences into the reverse T-LSTM network in the bidirectional T-LSTM network, the output of the reverse T-LSTM network being the first log sequence; The hidden layer vector of the forward T-LSTM network is merged with the hidden layer vector of the reverse T-LSTM network to obtain a merged vector.

4. The abnormal log detection method according to claim 1, characterized in that: The bidirectional T-LSTM network constructed by inputting the log vector also includes: The merged vector is input to a fully connected layer, which is the output layer of the bidirectional T-LSTM network. The fully connected layer trains network parameters through a stochastic gradient descent algorithm.

5. The abnormal log detection method according to any one of claims 1 to 3, characterized in that: The subspace decomposition stage of the T-LSTM is performed according to the standard gating structure of LSTM.

6. An abnormal log detection device, characterized in that: include: A conversion module, configured to convert the collected log sequence into multiple log vectors; A computing module is configured to input the log vector into a constructed bidirectional T-LSTM network, wherein an output layer of the bidirectional T-LSTM network introduces an attention mechanism to assign weights to log events, wherein the weights are determined by the time interval between time series; determining the short-term memory of the previous time step in the bidirectional T-LSTM network; adjusting the short-term memory by a non-increasing function, a non-decreasing function, and the time series; determining a complementary subspace of the short-term memory as a long-term memory; combining the adjusted short-term memory with the long-term memory to obtain an adjusted memory of the previous time step The classification module is configured to classify the log events with assigned weights to determine abnormal logs in the log events.

7. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the abnormal log detection method according to any one of claims 1 to 5 based on instructions stored in the memory.

8. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the abnormal log detection method according to any one of claims 1 to 5 is implemented.

Images