Log-based system anomaly detection methods, devices, media, and electronic equipment

Abstract

This application discloses a system anomaly detection method, apparatus, medium, and electronic device based on logs. The method includes: acquiring the current logs of the system to be detected as logs to be analyzed; performing time-slicing processing on the logs at set time intervals based on time information in the logs to be analyzed, and counting the number of logs to be analyzed within each time slice as a log quantity feature; extracting log content features from the logs to be analyzed using a preset content feature extraction algorithm; and determining the anomaly detection result of the system to be detected based on the log content features and the log quantity features. Implementing this application embodiment can improve the accuracy of system anomaly detection.

Description

Technical Field

[0001] This application relates to the field of computer application technology, and in particular to a log-based system anomaly detection method, apparatus, medium, and electronic device. Background Technology

[0002] An application system typically consists of computer hardware, system software, and application software. Application system logs record information about hardware, software, and application system problems. By analyzing application system logs, anomalies within the application system and their causes can be identified promptly. Summary of the Invention

[0003] This application provides a log-based system anomaly detection method, apparatus, medium, and electronic device. By performing feature analysis on the logs to be analyzed from two aspects—log quantity and log content—the accuracy of system anomaly detection can be improved.

[0004] In a first aspect, embodiments of this application provide a log-based system anomaly detection method, the method comprising:

[0005] Obtain the current logs of the system under test as the logs to be analyzed;

[0006] Based on the time information in the log to be analyzed, the log to be analyzed is sliced ​​at a set time interval, and the number of logs to be analyzed in each time slice is counted as the log quantity feature of the log to be analyzed.

[0007] The log content features of the log to be analyzed are extracted using a preset content feature extraction algorithm.

[0008] Based on the log content characteristics and the log quantity characteristics, the anomaly detection result of the system to be detected is determined.

[0009] Secondly, embodiments of this application provide a log-based system anomaly detection device, the device comprising:

[0010] The current log acquisition module is used to acquire the current logs of the system under test as logs to be analyzed.

[0011] The log quantity feature determination module is used to perform time slicing on the log to be analyzed at a set time interval based on the time information in the log to be analyzed, and count the number of logs to be analyzed in each time slice as the log quantity feature of the log to be analyzed.

[0012] The log content feature determination module is used to extract log content features of the log to be analyzed using a preset content feature extraction algorithm.

[0013] The system detection result determination module is used to determine the anomaly detection result of the system to be detected based on the log content characteristics and the log quantity characteristics.

[0014] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the log-based system anomaly detection method as described in embodiments of this application.

[0015] Fourthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the log-based system anomaly detection method as described in embodiments of this application.

[0016] The technical solution provided in this application involves acquiring the current logs of the system under test as the logs to be analyzed; based on the time information in the logs, performing time-slicing processing on the logs at set time intervals, and counting the number of logs to be analyzed within each time slice as the log quantity feature; using a preset content feature extraction algorithm, extracting the log content features of the logs to be analyzed; and determining the anomaly detection result of the system under test based on the log content features and log quantity features. This application embodiment achieves anomaly detection of the system under test by performing feature analysis on the logs to be analyzed from two aspects: log quantity and log content. It considers the situation where anomalies in the log quantity cause anomalies in the system under test, thus improving the accuracy of system anomaly detection. Attached Figure Description

[0017] Figure 1 This is a flowchart of a log-based system anomaly detection method provided in Embodiment 1 of this application;

[0018] Figure 2 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 2 of this application;

[0019] Figure 3 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 3 of this application;

[0020] Figure 4 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 4 of this application;

[0021] Figure 5 This is a schematic diagram of the structure of a log-based system anomaly detection device provided in Embodiment 5 of this application;

[0022] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 7 of this application. Detailed Implementation

[0023] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present application, not the entire structure.

[0024] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of these steps can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the steps can be rearranged. The process can be terminated when its operation is complete, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0025] Example 1

[0026] Figure 1 This is a flowchart of a log-based system anomaly detection method provided in Embodiment 1 of this application. This embodiment is applicable to situations where anomaly detection of application systems is performed based on logs. This method can be executed by the log-based system anomaly detection device provided in this embodiment. This device can be implemented in software and / or hardware and can be integrated into the electronic device running the system.

[0027] like Figure 1 As shown, the log-based system anomaly detection method includes:

[0028] S110. Obtain the current log of the system to be tested as the log to be analyzed.

[0029] The system to be tested refers to the application system that requires anomaly detection. For example, the system to be tested could be a commercial bank's business processing system. The log to be analyzed corresponds to the system to be tested; it refers to the current log of the system to be tested. The current log records the operational information of the hardware and software of the system to be tested within the current time period. The current log is the data foundation for anomaly detection of the system to be tested. By analyzing the current log of the system to be tested, anomalies within the system can be detected in a timely manner.

[0030] S120. Based on the time information in the log to be analyzed, the log to be analyzed is processed by time slicing at a set time interval, and the number of logs to be analyzed in each time slice is counted as the log quantity feature of the log to be analyzed.

[0031] Generally, the logs to be analyzed record event information that occurs in the system under test, which may include event identifiers, event times, and event categories. Log quantity characteristics refer to the quantity characteristics of the logs to be analyzed. It is known that, under normal circumstances, the number of events occurring in the system under test remains within a certain range, and correspondingly, the number of logs in the system under test will also remain stable within a certain range. Log quantity characteristics can, to some extent, reflect whether there are anomalies in the system under test. For example, during periods when the system under test experiences downtime, or when the system experiences request backlogs, the number of logs to be analyzed will exceed a reasonable range.

[0032] Starting from the current time, the logs to be analyzed are sorted according to their time information, either in ascending or descending order. Then, the logs are sliced ​​at set time intervals, and the number of log entries falling within each time slice is counted. The number of log entries is used as the log quantity feature of the log analysis.

[0033] The time interval is not limited here and can be determined based on the actual situation. For example, the time interval could be 5 minutes. It is understood that, given a certain number of logs to be analyzed, a smaller time interval will yield more log quantity characteristics.

[0034] S130. Using a preset content feature extraction algorithm, extract the log content features of the log to be analyzed.

[0035] The log content features are used to reflect the characteristics of events occurring in the system under test, as recorded in the logs to be analyzed. The logs to be analyzed are generally stored as text files in the system under test. As mentioned above, the logs to be analyzed record event information occurring in the system under test, which may specifically include event identifiers, event times, event descriptions, and event categories.

[0036] The event type describes the impact of events occurring in the system under test on the system being tested. For example, event types can include: errors, warnings, and information. Error events correspond to significant problems, such as data loss or malfunction. Examples include system service loading failures during startup or disk detection errors. Warning events correspond to less critical events that may cause future problems, such as low disk space or a printer not being installed. Information events describe the successful operation of applications, drivers, or services, such as loading a network driver or successfully establishing a network connection.

[0037] Log content features can be obtained by processing the logs to be analyzed using a preset content feature extraction algorithm. The preset content feature extraction algorithm is used to extract content features from the logs to be analyzed. Optionally, it can be used to extract word frequencies or keywords from the logs to be analyzed. The preset content feature extraction algorithm is not the focus of this application, and its specific content is not limited here; any text feature extraction algorithm can be used.

[0038] The method utilizes a preset content feature extraction algorithm to extract log content features from the logs to be analyzed. Specifically, the algorithm performs word segmentation on the logs to be analyzed, removes stop words, and decomposes the logs into individual words based on spaces. Each word is treated as a word set, resulting in the word set of the logs to be analyzed. This word set is then vectorized to obtain the log content features. Each log entry to be analyzed has corresponding log content features.

[0039] S140. Determine the anomaly detection result of the system to be detected based on the log content characteristics and the log quantity characteristics.

[0040] Log content characteristics reflect the features of events occurring in the system under test, as recorded in the logs being analyzed. These characteristics can be used to determine if the system under test exhibits any anomalies. Specifically, log content characteristics reflect the quantity of logs generated by the system under test within a set time interval, thus indicating the presence of anomalies from the perspective of log quantity. Detecting anomalies in the system under test based on log quantity characteristics can compensate for inaccurate anomaly detection caused by log loss or insufficient log content information due to anomalies in the system under test.

[0041] Optionally, an anomaly detection algorithm based on regular expressions can be used to process the log content features and log quantity features to achieve anomaly detection of the system under test; alternatively, a corresponding machine learning model can be used to process the log content features and log quantity features to achieve anomaly detection of the system under test.

[0042] The technical solution provided in this application involves acquiring the current logs of the system under test as the logs to be analyzed; based on the time information in the logs, performing time-slicing processing on the logs at set time intervals, and counting the number of logs to be analyzed within each time slice as the log quantity feature; using a preset content feature extraction algorithm, extracting the log content features of the logs to be analyzed; and determining the anomaly detection result of the system under test based on the log content features and log quantity features. This application embodiment achieves anomaly detection of the system under test by performing feature analysis on the logs to be analyzed from two aspects: log quantity and log content. It considers the situation where anomalies in the log quantity cause anomalies in the system under test, thus improving the accuracy of system anomaly detection.

[0043] Example 2

[0044] Figure 2 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 2 of this application. This embodiment further optimizes the above embodiment. The specific operation "determining the anomaly detection result of the system to be detected based on the log content characteristics and the log quantity characteristics" is refined.

[0045] like Figure 2 As shown, the log-based system anomaly detection method includes:

[0046] S210. Obtain the current log of the system to be tested as the log to be analyzed.

[0047] S220. Based on the time information in the log to be analyzed, the log to be analyzed is processed by time slicing at a set time interval, and the number of logs to be analyzed in each time slice is counted as the log quantity feature of the log to be analyzed.

[0048] S230. Using a preset content feature extraction algorithm, extract the log content features of the log to be analyzed.

[0049] S240. Input the log content features into a pre-trained text classification model so that the text classification model can output the content classification result of the log to be analyzed.

[0050] The text classification model is used to categorize the logs to be analyzed based on their content features. The log content features are input into a pre-trained text classification model, which then outputs the content classification results. These results include anomaly and normal categories. The anomaly category corresponds to logs containing records of abnormal events, while the normal category corresponds to logs without such records. Abnormal events refer to unusual events occurring in the system being monitored, such as database anomalies.

[0051] The pre-trained text classification model is trained using log content features with labeled data. The labeled data indicates whether the log to be analyzed contains any abnormal events. The pre-trained text classification model achieves content classification accuracy that meets actual business requirements.

[0052] In an optional embodiment, the text classification model is a fasttext model. The fasttext model is a machine learning model with high training speed, suitable for processing large datasets. Compared to other text classification models such as SVM, Logistic Regression, and neural network models, the fastText model significantly reduces training time while maintaining classification performance.

[0053] The fastText model also incorporates N-gram features, overcoming the limitation of the bag-of-words model in not considering word order. By taking local word order into account, it improves text classification performance. For example, the bag-of-words model features in the sentence "I love her" are "I", "love", and "her". These features are the same as those in the sentence "She loves me". By adding 2-Ngram features, the first sentence also includes "I love" and "love her", thus distinguishing "I love her" from "She loves me".

[0054] S250. Input the log quantity features into a pre-trained quantity prediction model so that the quantity prediction model can output the quantity confidence interval of the logs to be analyzed.

[0055] The quantity prediction model is used to predict the trend of log quantity changes based on log quantity characteristics. The log quantity characteristics of the logs to be analyzed are input into a pre-trained quantity prediction model, which outputs the confidence interval for the log quantity and the quantity change trend curve. The confidence interval is determined by an upper and lower limit. The confidence interval represents the range of log quantity values ​​that the system under test should fall within if no anomalies occur. By comparing the actual number of logs to be analyzed within each time slice with the confidence interval, it can be determined whether any anomalies exist in the system under test during the corresponding time slice.

[0056] The pre-trained quantity prediction model is trained using log quantity features with time-series annotations. These annotations indicate the time period to which the log quantity features belong. The pre-trained quantity prediction model achieves the required accuracy for actual business operations.

[0057] In an optional embodiment, the quantity prediction model is a Prophet model. The Prophet model is used to predict time series data. It is highly robust to missing values, trend shifts, and a large number of outliers.

[0058] In this embodiment, the Prophet model decomposes the time series into four parts: a seasonal term, a trend term, a residual term, and a holiday term. The trend term represents the non-periodic trend of the time series; the periodic term represents the seasonal cycle, such as weekly or yearly; the holiday term reflects the impact of holidays on the number of logs to be analyzed, indicating whether holidays currently exist; and the residual term, or error term, is used to reduce fitting error. The Prophet model fits these four terms and uses the sum of the four terms as the predicted value of the time series.

[0059] S260. Based on the content classification results and the quantity confidence interval, determine the abnormal detection results of the system to be detected.

[0060] If there are abnormal categories in the content classification results of the logs to be analyzed, the anomaly detection result of the system to be tested is determined to be abnormal; if the number of logs to be analyzed in any time segment is outside the quantity confidence interval, the anomaly detection result of the system to be tested is determined to be abnormal; only when all the content classification results of the logs to be analyzed are normal, and the number of logs to be analyzed in any time segment is within the quantity confidence interval, the anomaly detection result of the system to be tested is determined to be normal.

[0061] The technical solution provided in this application improves the analysis efficiency of logs by using pre-trained text classification and quantity prediction models to process log content features and log quantity features respectively, thereby shortening the detection time of system anomalies and enabling timely detection of system anomalies.

[0062] Example 3

[0063] Figure 3 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 3 of this application. This embodiment further optimizes the above embodiments. In the case of using a text classification model and a quantity prediction model to perform feature analysis on the logs to be analyzed to achieve system anomaly detection, a training process for the text classification model is provided.

[0064] like Figure 3 As shown, the training process of the text classification model includes:

[0065] S310. Obtain the historical logs of the system to be detected and use them as training samples for the text classification model.

[0066] Historical logs record the operational information of the hardware and software of the system under test within a historical period. These logs serve as the data foundation for training the text classification model. Training samples for the text classification model can be obtained from these logs. One log entry can correspond to one training sample. The number of training samples is not limited here, but it is known that the number of training samples affects the accuracy of the text classification model. To a certain extent, the more training samples, the higher the accuracy of the text classification model.

[0067] S320. Perform frequent itemset mining on the training samples to obtain the frequent itemsets of the training samples, and determine the labeled data of the training samples based on the frequent itemsets.

[0068] As we know, text classification models are machine learning models based on supervised learning. Therefore, the training samples for text classification models generally need to include two parts: log content features and labeled data.

[0069] The log content features can be extracted from the training samples using a pre-defined content feature extraction algorithm. As for the labeled data of the training samples, this application obtains the frequent itemsets of the training samples by performing frequent itemset mining on the training samples, and determines the labeling based on the frequent itemsets.

[0070] Specifically, this application employs frequent item mining algorithms, such as the FP-Tree algorithm, to mine frequent itemsets from the training samples, obtaining frequent itemsets for each training sample. A frequent itemset refers to an itemset that appears frequently in the training samples, corresponding to words within the training samples. Each training sample has a corresponding frequent itemset, which is an extraction of the main content of the training sample. The labeled data for the training samples can be determined based on the frequent itemsets. The labeled data includes anomaly classes and normal classes.

[0071] While labeled training samples can be obtained manually, training text classification models often requires a large number of samples, making manual labeling both labor-intensive and time-consuming, and inefficient. Therefore, to improve the efficiency of training sample labeling, an automated method for determining training sample data is preferred.

[0072] However, it is known that the logs of the system under test are often semi-structured and heterogeneous. To improve the annotation efficiency of training samples, in an optional embodiment, the annotation data of the training samples is determined based on the frequent itemsets, including: classifying the training samples based on the similarity between the frequent itemsets, and determining the log templates corresponding to each type of training sample based on the frequent itemsets; determining the annotation data of each type of log template based on the annotation data of the log templates in the operation and maintenance knowledge base; and determining the annotation data of the training samples based on the annotation data of each type of template.

[0073] Given a set of frequent itemsets for each training sample, the similarity between any two frequent itemsets is calculated. This similarity is then compared to a preset similarity threshold. Training samples corresponding to frequent itemsets with similarities greater than the threshold are grouped into one category. The similarity between frequent itemsets measures the degree of similarity between any two frequent itemsets. Training samples with similar main content are clustered based on the similarity of their frequent itemsets. Log templates, called sample log templates, are generated based on the frequent itemsets of the same category of training samples.

[0074] The operations and maintenance knowledge base is pre-built by relevant technical personnel and includes various types of log models, called reference log templates. Each reference log template has corresponding annotation data to indicate the content category of that reference log template, that is, whether the reference log template records any abnormal events.

[0075] Understandably, the operations and maintenance (O&M) knowledge base can cover commonly used log templates of the system under test, and it can provide strong data support for the annotation process of training samples. Based on the annotation data of log templates in the O&M knowledge base, the annotation data for various log templates is determined. Specifically, the sample log template corresponding to the training sample is matched with the reference log template in the O&M knowledge base. If the match is successful, the annotation data corresponding to the reference log template in the O&M knowledge base is used as the annotation data for the sample log template.

[0076] Given that the labeled data of the sample log template is determined, the training samples are matched with the log template respectively. If the match is successful, the labeled data of the sample log template is used as the labeled data of the training sample.

[0077] This application classifies training samples based on the similarity of each training sample, extracts log templates corresponding to each type of training sample, determines the annotation data of the log model by combining the operation and maintenance knowledge base, and then determines the annotation data of each training sample based on the annotation data of the log model, thereby improving the annotation efficiency of training samples and reducing the preparation cost of training text classification models.

[0078] S330. The training samples are sampled according to the labeled data to obtain the sampling results.

[0079] Training samples labeled as normal are used as positive samples, and samples labeled as abnormal are used as negative samples. Generally, the number of normal operating conditions in the system being tested far exceeds the number of abnormal situations. Therefore, the number of negative training samples is much smaller than the number of positive samples, resulting in an imbalanced distribution of positive and negative samples. Understandably, using an imbalanced distribution of positive and negative samples to train a text classification model will make it difficult for the model to fully learn the log content features of both positive and negative samples, affecting the accuracy of the text classification model. To further improve the accuracy of the text classification model, this embodiment samples the training samples based on the labeled data, ensuring that the number of positive and negative samples is similar to balance the positive and negative samples.

[0080] S340. The text classification model is trained using the log content features and labeled data of the sampling results.

[0081] The sampling results show a balanced distribution of positive and negative samples. These samples are then used to train the text classification model. Specifically, the log content features and labeled data from the training samples are used as input to the text classification model for training.

[0082] Optionally, to ensure that the text classification accuracy of the text training model meets business requirements, the classification performance of the text classification model is evaluated during the training process. For example, an F1 score is calculated based on a combination of accuracy and recall using the following formula, and the classification performance of the text classification model is evaluated based on the F1 score.

[0083]

[0084] In the formula, precision and recall represent accuracy and recall, respectively.

[0085] The F1 score is compared with the business metrics. If the F1 score meets the business metrics, the text classification model training is complete. Conversely, if the F1 score does not meet the business metrics, the hyperparameters of the text classification model are adjusted, and training continues until the F1 score of the text classification model meets the business metrics. Adjusting the hyperparameters of the text classification model can specifically involve adjusting parameters such as the number of training samples and the learning rate.

[0086] This application embodiment provides a training process for the text classification model when performing feature analysis on the logs to be analyzed using a text classification model and a quantity prediction model to achieve system anomaly detection. This application embodiment improves the annotation efficiency of training samples and reduces the preparation cost of training the text classification model by extracting log templates corresponding to various training samples, combining them with an operation and maintenance knowledge base to determine the labeled data for the log model, and then determining the labeled data for each training sample based on the labeled data of the log model.

[0087] Example 4

[0088] Figure 4 This is a flowchart of another log-based system anomaly detection method provided in Embodiment 4 of this application. This embodiment further optimizes the above embodiments. In the case of using a text classification model and a quantity prediction model to perform feature analysis on the logs to be analyzed to achieve system anomaly detection, a training process for the quantity prediction model is provided.

[0089] like Figure 4 As shown, the training process of the quantity prediction model includes:

[0090] S410. Obtain the historical logs of the system to be detected and use them as training samples for the quantity prediction model.

[0091] S420. Based on the time information in the training samples, the training samples are processed by time slicing at the set time interval, and the number of training samples in each time slice is counted as the log quantity feature of the training samples.

[0092] Starting from the current time, the training samples are sorted according to their time information, either in ascending or descending order. Then, the training samples are sliced ​​at set time intervals, and the number of training samples falling within each time slice is counted. The number of training samples is used as the log quantity feature of the training samples.

[0093] It is worth noting that this application performs time slicing on the training samples and the logs to be analyzed based on the same set time interval.

[0094] S430. Determine the time sequence label of the log quantity feature based on the time sequence of the time slice to which the log quantity feature belongs.

[0095] The number of logs in the system under test is related to time. For example, in the case of a commercial bank's business processing system, the number of logs during working hours is much greater than the number of logs during rest hours. By plotting the log number trend curve in chronological order, it can be found that the log number change is related to time, and the log number is predictable in the time dimension.

[0096] Therefore, the temporal sequence of log quantity features is crucial for ensuring the accuracy of log quantity prediction using the quantity prediction model.

[0097] S440. The quantity prediction model is trained using the log quantity features and the time series labels.

[0098] The log quantity prediction model is trained using log quantity features and time-series labels. Specifically, log quantity features with time-series labels are used as input to train the quantity prediction model.

[0099] Optionally, to ensure that the text classification accuracy of the quantity prediction model meets business requirements, the prediction performance of the quantity prediction model is evaluated during the training process. For example, the prediction performance of the quantity prediction model can be evaluated based on the mean absolute error (MAE).

[0100] The mean absolute error (MAE) is compared with the business metrics. If the MAE meets the business metrics, the quantity forecasting model training is complete. Conversely, if the MAE does not meet the business metrics, the quantity forecasting model is trained again after adjusting its hyperparameters until the MAE meets the business metrics. The hyperparameters of the quantity forecasting model can be adjusted, specifically setting parameters such as time intervals, smoothing parameters, trend terms, seasonal terms, and holiday terms.

[0101] This application provides a training process for the quantity prediction model when performing feature analysis on the logs to be analyzed using a text classification model and a quantity prediction model to achieve system anomaly detection. This application considers the situation where log quantity anomalies are caused by anomalies in the system to be detected, thereby improving the accuracy of system anomaly detection.

[0102] Example 5

[0103] Figure 5 This application provides a log-based system anomaly detection device according to Embodiment 5. This embodiment is applicable to situations where anomaly detection of application systems is performed based on logs. The device can be implemented by software and / or hardware and can be integrated into electronic devices such as smart terminals.

[0104] like Figure 5 As shown, the device may include: a current log acquisition module 510, a log quantity feature determination module 520, a log content feature determination module 530, and a system detection result determination module 540.

[0105] The current log acquisition module 510 is used to acquire the current log of the system under test as the log to be analyzed.

[0106] The log quantity feature determination module 520 is used to perform time slicing on the log to be analyzed at a set time interval based on the time information in the log to be analyzed, and count the number of logs to be analyzed in each time slice as the log quantity feature of the log to be analyzed.

[0107] The log content feature determination module 530 is used to extract log content features of the log to be analyzed using a preset content feature extraction algorithm.

[0108] The system detection result determination module 540 is used to determine the anomaly detection result of the system to be detected based on the log content characteristics and the log quantity characteristics.

[0109] The technical solution provided in this application involves acquiring the current logs of the system under test as the logs to be analyzed; based on the time information in the logs, performing time-slicing processing on the logs at set time intervals, and counting the number of logs to be analyzed within each time slice as the log quantity feature; using a preset content feature extraction algorithm, extracting the log content features of the logs to be analyzed; and determining the anomaly detection result of the system under test based on the log content features and log quantity features. This application embodiment achieves anomaly detection of the system under test by performing feature analysis on the logs to be analyzed from two aspects: log quantity and log content. It considers the situation where anomalies in the log quantity cause anomalies in the system under test, thus improving the accuracy of system anomaly detection.

[0110] Optionally, the system detection result determination module 540 includes: a content classification result determination submodule, used to input the log content features into a pre-trained text classification model, so that the text classification model outputs the content classification result of the log to be analyzed; a quantity confidence interval determination submodule, used to input the log quantity features into a pre-trained quantity prediction model, so that the quantity prediction model outputs the quantity confidence interval of the log to be analyzed; and an anomaly detection result determination submodule, used to determine the anomaly detection result of the system to be detected based on the content classification result and the quantity confidence interval.

[0111] Optionally, the apparatus further includes: a text classification model training module, used to train the text classification model before inputting the log content features into a pre-trained text classification model. The text classification model training module includes a first training sample acquisition submodule, used to acquire historical logs of the system to be detected as training samples for the text classification model; a frequent itemset mining submodule, used to perform frequent itemset mining on the training samples to obtain frequent itemsets of the training samples, and determine the labeled data of the training samples based on the frequent itemsets; a training sample sampling submodule, used to sample the training samples based on the labeled data to obtain sampling results; and a text classification model training submodule, used to train the text classification model using the log content features of the sampling results and the labeled data.

[0112] Optionally, the training data determination submodule includes: a log template determination unit, used to classify the training samples based on the similarity between the frequent itemsets, and determine the log templates corresponding to each type of training sample based on the frequent itemsets; a template annotation data determination unit, used to determine the annotation data of each type of log template based on the annotation data of the log templates in the operation and maintenance knowledge base; and a sample annotation data determination unit, used to determine the annotation data of the training samples based on the annotation data of each type of template.

[0113] Optionally, the apparatus further includes a quantity prediction model training module, used to train the quantity prediction model before inputting the log quantity features into the pre-trained quantity prediction model.

[0114] The quantity prediction model training module includes: a second training sample acquisition submodule, used to acquire historical logs of the system to be detected as training samples for the quantity prediction model; a log quantity feature determination submodule, used to perform time slicing processing on the training samples at a set time interval based on the time information in the training samples, and count the number of training samples in each time slice as the log quantity feature of the training samples; a time sequence label determination submodule, used to determine the time sequence label of the log quantity feature according to the time order of the time slice to which the log quantity feature belongs; and a quantity prediction model training submodule, used to train the quantity prediction model using the log quantity feature and the time sequence label.

[0115] Optionally, the text classification model is the FastText model; the quantity prediction model is the Prophet model.

[0116] The log-based system anomaly detection device provided in this embodiment of the invention can execute a log-based system anomaly detection method provided in any embodiment of the invention, and has the corresponding performance modules and beneficial effects for executing a log-based system anomaly detection method.

[0117] Example 6

[0118] Embodiment Six of this application also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform a log-based system anomaly detection method, the method comprising:

[0119] Obtain the current logs of the system under test as the logs to be analyzed;

[0120] Based on the time information in the log to be analyzed, the log to be analyzed is sliced ​​at a set time interval, and the number of logs to be analyzed in each time slice is counted as the log quantity feature of the log to be analyzed.

[0121] The log content features of the log to be analyzed are extracted using a preset content feature extraction algorithm.

[0122] Based on the log content characteristics and the log quantity characteristics, the anomaly detection result of the system to be detected is determined.

[0123] Storage medium refers to any type of memory electronic device or storage electronic device. The term "storage medium" is intended to include: mounting media, such as CD-ROMs, floppy disks, or magnetic tape devices; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (e.g., hard disks or optical storage); registers or other similar types of memory elements. Storage medium may also include other types of memory or combinations thereof. Furthermore, storage medium may reside in a computer system in which a program is executed, or it may reside in a different second computer system connected to the computer system via a network (such as the Internet). The second computer system can provide program instructions to the computer for execution. The term "storage medium" can include two or more storage media that may reside in different unknowns (e.g., in different computer systems connected via a network). Storage medium may store program instructions (e.g., specifically implemented as a computer program) that can be executed by one or more processors.

[0124] Of course, the computer-executable instructions provided in the embodiments of this application are not limited to the log-based system anomaly detection operation described above, but can also execute related operations in the log-based system anomaly detection method provided in any embodiment of this application.

[0125] Example 7

[0126] Embodiment 7 of this application provides an electronic device that can integrate the log-based system anomaly detection device provided in this application embodiment. The electronic device can be configured within the system or can be a device that performs some or all of the system's functions. Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment Seven of this application. Figure 6 As shown, this embodiment provides an electronic device 600, which includes: one or more processors 620; and a storage device 610 for storing one or more programs. When the one or more programs are executed by the one or more processors 620, the one or more processors 620 implement the log-based system anomaly detection method provided in this application embodiment. The method includes:

[0127] Obtain the current logs of the system under test as the logs to be analyzed;

[0128] Based on the time information in the log to be analyzed, the log to be analyzed is sliced ​​at a set time interval, and the number of logs to be analyzed in each time slice is counted as the log quantity feature of the log to be analyzed.

[0129] The log content features of the log to be analyzed are extracted using a preset content feature extraction algorithm.

[0130] Based on the log content characteristics and the log quantity characteristics, the anomaly detection result of the system to be detected is determined.

[0131] Of course, those skilled in the art will understand that the processor 620 also implements the technical solution of the log-based system anomaly detection method provided in any embodiment of this application.

[0132] Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the performance and scope of use of the embodiments of this application.

[0133] like Figure 6 As shown, the electronic device 600 includes a processor 620, a storage device 610, an input device 630, and an output device 640; the number of processors 620 in the electronic device can be one or more. Figure 6 Taking a processor 620 as an example; the processor 620, storage device 610, input device 630, and output device 640 in the electronic device can be connected via a bus or other means. Figure 6 Taking the connection between China and Israel via bus 650 as an example.

[0134] Storage device 610, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and module units, such as the program instructions corresponding to the log-based system anomaly detection method in the embodiments of this application.

[0135] Storage device 610 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for performance; the data storage area may store data created based on terminal usage. Furthermore, storage device 610 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, storage device 610 may further include memory remotely located relative to processor 620, and these remote memories can be connected via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0136] Input device 630 can be used to receive input digital, character, or voice information, and to generate key signal inputs related to user settings and performance control of the electronic device. Output device 640 may include electronic devices such as a display screen and a speaker.

[0137] The log-based system anomaly detection device, medium, and electronic device provided in the above embodiments can execute the log-based system anomaly detection method provided in any embodiment of this application, and have the corresponding performance modules and beneficial effects for executing the method. Technical details not described in detail in the above embodiments can be found in the log-based system anomaly detection method provided in any embodiment of this application.

[0138] Note that the above are merely preferred embodiments and the technical principles employed in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of this application, the scope of which is determined by the scope of the appended claims.

Claims

1. A log-based system anomaly detection method, characterized by, The method comprises: obtaining a current log of a system to be detected as a log to be analyzed; based on time information in the log to be analyzed, time slicing the log to be analyzed at a set time interval, and respectively counting the number of logs in each time slice as a log quantity feature of the log to be analyzed; using a preset content feature extraction algorithm to extract log content features of the log to be analyzed; wherein the log content features are obtained by using the preset content feature extraction algorithm to extract word frequency or keywords from the log to be analyzed, and each log to be analyzed has corresponding log content features; determining an anomaly detection result of the system to be detected according to the log content features and the log quantity features; wherein the anomaly detection result is related to a content classification result; the content classification result is obtained by a text classification model classifying the log to be analyzed according to the log content features; the text classification model is pre-trained using training samples with labeled data; the labeled data is determined according to the frequent item sets of the training samples by frequent item set mining on the training samples; wherein, according to the frequent item sets, the labeled data of the training samples is determined, comprising: classifying the training samples based on the similarity between the frequent item sets, and determining the log templates corresponding to each type of training samples based on the frequent item sets; determining the labeled data of each type of log template based on the labeled data of the log templates in the operation and maintenance knowledge base; determining the labeled data of the training samples based on the labeled data of each type of template; wherein, the similarity between any two frequent item sets is calculated, and the calculated similarity is compared with a preset similarity threshold; the training samples corresponding to the frequent item sets with a similarity greater than the preset similarity threshold are classified into a category; the log template corresponding to the same type of training samples is generated as a sample log template based on the frequent item sets of the same type of training samples; the sample log template corresponding to the training samples is matched with the reference log template in the operation and maintenance knowledge base; if the matching is successful, the labeled data of the reference log template in the operation and maintenance knowledge base is used as the labeled data of the sample log template; the training samples are respectively matched with the log templates; if the matching is successful, the labeled data of the sample log template is used as the labeled data of the training samples; wherein, the labeled data corresponding to the reference log template is used to indicate whether the reference log template records an abnormal event.

2. The method of claim 1, wherein, According to the log content features and the log quantity features, the anomaly detection result of the system to be detected is determined, comprising: inputting the log content features into a pre-trained text classification model to output the content classification result of the log to be analyzed by the text classification model; inputting the log quantity features into a pre-trained quantity prediction model to output the quantity confidence interval of the log to be analyzed by the quantity prediction model; determining the anomaly detection result of the system to be detected according to the content classification result and the quantity confidence interval.

3. The method of claim 2, wherein, Before inputting the log content feature into the pre-trained text classification model, the method further comprises a training process of the text classification model: obtaining historical logs of the system to be detected as training samples of the text classification model; sampling the training samples according to the labeled data to obtain a sampling result; training the text classification model using the log content feature and the labeled data of the sampling result.

4. The method of claim 2, wherein, Before inputting the log quantity feature into the pre-trained quantity prediction model, the method further comprises a training process of the quantity prediction model: obtaining historical logs of the system to be detected as training samples of the quantity prediction model; based on the time information in the training samples, performing time slicing processing on the training samples at the set time interval, and respectively counting the number of the training samples in each time slice as the log quantity feature of the training samples; determining the time sequence label of the log quantity feature according to the time sequence of the time slice to which the log quantity feature belongs; training the quantity prediction model using the log quantity feature and the time sequence label.

5. The method of claim 2, wherein, Wherein, the text classification model is a fasttext model; and the quantity prediction model is a Prophet model.

6. A log-based system anomaly detection apparatus characterized by comprising: The device comprises: a current log obtaining module configured to obtain current logs of a system to be detected as logs to be analyzed; a log quantity feature determining module configured to perform time slicing processing on the logs to be analyzed at a set time interval based on time information in the logs to be analyzed, and respectively count the number of the logs to be analyzed in each time slice as log quantity features of the logs to be analyzed; a log content feature determining module configured to extract log content features of the logs to be analyzed using a pre-set content feature extraction algorithm; wherein the log content features are obtained by processing term frequencies or keywords of the logs to be analyzed using the pre-set content feature extraction algorithm, and each log to be analyzed has corresponding log content features; a system detection result determining module configured to determine an anomaly detection result of the system to be detected according to the log content features and the log quantity features; wherein the anomaly detection result is related to a content classification result, the content classification result is obtained by classifying the logs to be analyzed according to the log content features by a text classification model, the text classification model is pre-trained using training samples with labeled data, and the labeled data is determined according to frequent item sets of the training samples by frequent item set mining on the training samples; wherein determining the labeled data of the training samples according to the frequent item sets comprises: classifying the training samples based on the similarity between the frequent item sets, and determining log templates corresponding to each type of training samples based on the frequent item sets; determining the labeled data of each type of log template based on the labeled data of the log templates in an operation and maintenance knowledge base; and determining the labeled data of the training samples based on the labeled data of each type of template. The similarity between any two frequent item sets is calculated, and the calculated similarity is compared with a preset similarity threshold; the training samples corresponding to the frequent item sets with a similarity greater than the preset similarity threshold are classified into a same class; a log template corresponding to the training samples in the same class is generated as a sample log template; the sample log template corresponding to the training samples is matched with a reference log template in an operation and maintenance knowledge base; if the matching is successful, the labeled data corresponding to the reference log template in the operation and maintenance knowledge base is used as the labeled data of the sample log template; the training samples are matched with the log template respectively; if the matching is successful, the labeled data of the sample log template is used as the labeled data of the training samples; the labeled data corresponding to the reference log template is used to indicate whether an abnormal event is recorded in the reference log template.

7. The apparatus of claim 6, wherein, The system detection result determination module comprises: a content classification result determination submodule configured to input the log content feature into a pre-trained text classification model, and configured to output a content classification result of the log to be analyzed by the text classification model; a quantity confidence interval determination submodule configured to input the log quantity feature into a pre-trained quantity prediction model, and configured to output a quantity confidence interval of the log to be analyzed by the quantity prediction model; an abnormality detection result determination submodule configured to determine an abnormality detection result of the system to be detected according to the content classification result and the quantity confidence interval.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the log-based system abnormality detection method according to any one of claims 1-5.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the log-based system abnormality detection method according to any one of claims 1-5.

Images