Log sequence anomaly detection method based on deep hybrid neural network

Abstract

This invention discloses a log sequence anomaly detection method based on a deep hybrid neural network. The method comprises the following steps: using a sliding window combined with a session window to segment log sequences; using a combination of semantic vector features and statistical features to implement semantic vectorization of log templates; using an improved sequential deep learning model combined with a convolutional neural network model structure to train log sequences with abnormal or normal labels to establish an anomaly detection model; and applying the constructed anomaly detection model to perform anomaly detection on newly generated log sequences. This method can accurately capture the sequence and semantic feature information of logs, and then, with the help of a hybrid deep learning model, achieve accurate log anomaly detection, reveal system status, and has good robustness.

Description

Technical Field

[0001] The present invention belongs to the field of log analysis anomaly detection, and in particular to a log sequence anomaly detection method based on a deep hybrid neural network. Background Art

[0002] With the rapid development of computer science and technology, the scale of various systems and servers has grown exponentially. Simultaneously, system logs have also exploded, making manual log analysis increasingly difficult. However, logs are extremely valuable, recording a wide range of information during system operation. Log analysis allows domain experts to directly understand the system's operating status, enabling them to take appropriate measures to improve and upgrade the system, enhancing its performance and stability. Automated log analysis by machines can significantly improve the efficiency of log analysis and promote smooth and efficient system operation. Therefore, methods for automated log analysis are particularly important, and research on log analysis methods has become a hot topic.

[0003] Log analysis involves automated machine analysis of massive amounts of log data, enabling machines to automatically identify abnormal logs. These logs often possess specific value and require domain experts to capture and analyze. These anomalies include system status anomalies, operational errors, unusual access, and intrusion warnings. Log analysis involves two steps: log parsing and anomaly detection. Log parsing structures unstructured log data. Anomaly detection uses the parsed results to design methods to automatically identify abnormal logs.

[0004] Due to the structured nature of logs, early log analysis methods primarily relied on rule-based matching of log structures. While this improved log analysis efficiency to some extent, the results were less than ideal, hindering the discovery of hidden information in logs, such as sequence errors, deep errors, and fuzzy errors. Rule-based log analysis methods often require domain experts to develop a complex rule-based matching system, lacking portability and scalability, making them incompatible with a wide range of log systems. Furthermore, the rapid growth in log types leads to a sharp decline in rule-based matching efficiency.

[0005] Due to the limitations of rule matching, with the recent development of machine learning, various machine learning models have been applied to log analysis, achieving promising results. Compared to rule matching, machine learning-based log anomaly detection offers better transferability (robustness), higher accuracy, and higher recall. It also eliminates the need for domain experts to build a large rule system, making it more efficient. Principal component analysis (PCA) (W.Xu, L.Huang, A.Fox, D.Patterson, and M.I.Jordon. Detecting large-scale system problems by mining console logs. In SOSP'09: Proc. of the ACM Symposium on Operating Systems Principles, 2009.) is one of the earliest approaches to applying machine learning to log analysis. It extracts features from a log event count matrix and applies principal component analysis (PCA) to achieve unsupervised training and prediction, using normal logs as principal components to detect anomalous logs.Subsequently, different supervised machine learning methods were applied to log analysis, such as SVM (Y. Liang, Y. Zhang, H. Xiong, and R. Sahoo. Failure prediction in ibm bluegene / l event logs. In ICDM'07: Proc. of the 7th International Conference on Data Mining, 2007.), LR (P. Bodik, M. Goldszmidt, A. Fox, D. B. Woodard, and H. Andersen. Fingerprinting the datacenter: automated classification of performance crises. In EuroSys'10: Proc. of the 5th European conference on Computer systems, pages 111–124. ACM, 2010.), and decision trees (M. Chen, A. X. Zheng, J. Lloyd, M. I. Jordan, and E. Brewer. Failure diagnosis using decision trees. In ICAC'04: Proc. of the 1st International Conference on Autonomic Computing, pages 36–43. IEEE, 2004.) etc. InvariantsMiner (J. Lou, Q. Fu, S. Yang, Y Xu, and J. Li. Mining invariants from console logs for system problem detection. In ATC'10: Proc. of the USENIX Annual Technical Conference, 2010.) innovatively mines the invariant properties of log sequences based on the sequence information of logs. It proposes a machine learning method for mining invariants in log sequences, which is an effective unsupervised method.

[0006] With the development of deep learning in recent years, more and more deep learning methods have been applied to log analysis. DeepLog (M.Du, F.Li, G.Zheng, and V.Srikumar, “DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security-CCS'17. Dallas, Texas, USA: ACM Press, 2017, pp. 1285–1298. [Online].) applies the sequential deep neural network (LSTM) to log analysis. It uses an unsupervised training method and uses a one-dimensional log event sequence as the feature vector. This method is simple and intuitive and can predict the next possible log event based on a known log sequence. LogRobust (X. Zhang, Y. Xu, Q. Lin, B. Qiao, H. Zhang, Y. Dang, C. Xie, X. Yang, Q. Cheng, Z. Li et al., “Robust log-based anomaly detection on unstable log data,” in Proceedings of the 201927th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2019, pp. 807–817.) uses natural language processing to semantically vectorize log events, then trains them in an LSTM machine learning framework for supervised training. The results are directly mapped to labels (0 and 1). This log anomaly detection method has a certain degree of robustness.

[0007] Current machine learning log analysis methods have become increasingly sophisticated, but they still face some challenges:

[0008] 1) Most machine learning methods, such as PCA, SVM, and Clustering, select log features based on the event count matrix of log sequence blocks. This feature extraction approach ignores the semantic and sequential characteristics of logs and is unable to fully explore log features and provide sufficient training.

[0009] 2) Most log analysis methods have high training set requirements and low robustness. However, log data is growing rapidly, with new logs constantly being added to the log system. Low robustness means that the model needs to be constantly updated, which is time-consuming and labor-intensive.

[0010] 3) Most existing machine learning models cannot fully exploit the sequential features of logs. Currently, the best model for capturing log sequence information is LSTM. A serialized deep learning model that is more suitable for capturing log sequence feature information is needed. Summary of the Invention

[0011] The purpose of the present invention is to provide a log sequence anomaly detection method based on deep hybrid neural network with good robustness, high accuracy and recall rate.

[0012] The technical solution to achieve the purpose of the present invention is: a log sequence anomaly detection method based on a deep hybrid neural network, comprising the following steps:

[0013] Step 1: Sequence the logs using a combination of sliding windows and session windows.

[0014] Step 2: semantic vectorization of log templates is achieved by combining semantic vector features and statistical features;

[0015] Step 3: Use an improved serialized deep learning model combined with a convolutional neural network to train log sequences with abnormal or normal labels to establish an anomaly detection model.

[0016] Step 4: Apply the constructed anomaly detection model to perform anomaly detection on the newly generated log sequence.

[0017] Furthermore, in step 1, the sequence pattern of the log is determined: if it is a time-based sequence, the parameters of the sliding window size window_size and the sliding step size step_size are specified, and the log sequence is segmented by sliding on the log set according to the timestamp; if it is a sequence based on the session ID, the log events corresponding to each ID are extracted according to the session ID and combined into the log sequence corresponding to the ID to complete the log sequence segmentation.

[0018] Furthermore, before anomaly detection, the unstructured log data is structured to obtain a log event template and a structured log event set.

[0019] Furthermore, the sliding window log event extraction method generates log event sequences by sliding all logs in the time dimension. The window size window_size and the sliding distance step_size are set according to the time span of the logs. When step_size>=window_size, the log event sequence has no repetitions. When there is one or more abnormal logs in a log event sequence, the sequence is considered an abnormal sequence; otherwise, it is a normal sequence.

[0020] The session window log event extraction method extracts all log events belonging to a session ID: blk_id and combines them into a log event sequence, and matches them with the label corresponding to the blk_id.

[0021] Furthermore, in step 2, the log template is first semantically vectorized using the pre-trained language model Bert, and then the inverse frequency of each log event is calculated. The Bert semantic vector is combined with the event inverse frequency to achieve semantic vectorization of the log template.

[0022] Furthermore, the specific steps for semantic vectorization of log templates in step 2 are as follows:

[0023] Step 2.1, preprocess the log template generated in step 1.1, remove invalid symbols and interference numbers, and split the spliced ​​words;

[0024] In step 2.2, the processed log template is input into the Bert pre-training model to obtain the semantic vector of the log template. Each log event corresponds to a 768-dimensional semantic vector.

[0025] Step 2.3: Count the number of different log events according to step 1.1 and calculate the inverse frequency Event_IDF of each log event:

[0026]

[0027] Where n is the number of events in the log, e i represents the i-th event;

[0028] In step 2.4, Event_IDF is appropriately scaled and then combined with the semantic vector generated in step 2.2.

[0029]

[0030] Where [min, max] is the specified zoom range, IDF min and IDF max is the minimum and maximum value of the event inverse frequency calculated in step 2.3. nor-i(e i ) is calculated and scaled to the specified range [min, max]; then the normalized event inverse frequency is multiplied by the log template semantic vector in step 2.2 to achieve the combination of log statistical characteristics and semantic vectors, and obtain a robust log template feature vector.

[0031] Furthermore, the specific steps for building the log anomaly detection model in step 3 are as follows:

[0032] In step 3.1, the log sequence from step 1 is feature-vectorized using the log template semantic vector generated in step 2. This generates a feature vector for the log sequence and then feeds it into the model. A fully connected layer is first introduced to extract and compress the feature vector, ensuring that the semantic vector generated in step 2 is more closely aligned with the log data.

[0033] In step 3.2, the log sequence feature vectors are then fed into the improved serialization deep learning model Mogrifier LSTM in the order of log events. The feature vector of each log event corresponds to a neural cell unit, which is used to capture the sequence and semantic features of the log.

[0034] In step 3.3, a convolutional neural network (CNN) is connected to the serialized deep learning model. The CNN's feature capture capability is used to extract features from the LSTM layer's output. A fully connected layer is then connected to map the CNN layer's output to labels 0 and 1.

[0035] Furthermore, in step 4, the prediction results of the model are normalized using the sigmoid function to obtain the probability of the log sequence being normal or abnormal, and whether the log sequence is normal or not is determined based on the probability.

[0036] Furthermore, the specific steps of log anomaly detection in step 4 are as follows:

[0037] Step 4.1: The log sequence to be predicted is feature-vectorized according to the log template vector in step 2, and then fed into the model trained in step 3 to obtain a one-dimensional vector of size 2 output by the fully connected layer.

[0038] Step 4.2, use the sigmoid function to normalize the results and obtain the probabilities of the results being 0 and 1;

[0039]

[0040] Step 4.3: Set the prediction threshold P. When the probability of the prediction result generated in step 4.2 being 0 is greater than P, the log sequence is predicted to be normal. When the probability of the result being 0 is less than P, the log sequence is predicted to be abnormal.

[0041] Compared with existing technologies, this invention offers significant advantages: Its feature extraction approach, combining a pre-trained BERT model with the statistical characteristics of log events, fully exploits the unique characteristics of log sets, improving the robustness and F1 score of the overall model. Furthermore, its model, combining an improved sequential deep learning model (Mogrifier LSTM) with a convolutional neural network (CNN), better captures the connections between semantic vectors and the sequential information of logs, enhancing the model's predictive performance. On publicly available HDFS and BGL datasets, this invention's log anomaly detection performance and robustness surpass those of most mainstream methods.

[0042] The present invention is further described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of the log sequence anomaly detection method based on deep hybrid neural network of the present invention.

[0044] Figure 2 It is the flow chart of log sequence segmentation.

[0045] Figure 3 This is a schematic diagram of the semantic vectorization of log templates. DETAILED DESCRIPTION

[0046] The present invention provides a log sequence anomaly detection method based on a deep hybrid neural network. The method uses a BERT pre-training model and log event inverse frequency (Event_IDF) to extract log event semantic vectors to enhance robustness. An improved serialization model Mogrifier LSTM is combined with a convolutional neural network (CNN) training fitting model to obtain better prediction results. The method specifically includes the following steps:

[0047] Step 1: Log sequence segmentation: Based on the characteristics of the log data, a sliding window or session window is used to divide the log data set into different log sequence groups. Each log sequence corresponds to a label (0 or 1).

[0048] Step 2: Semantic vectorization of log templates. The log templates obtained after log parsing are semantically vectorized. First, the log events are put into the Bert pre-training model to obtain a preliminary semantic vector (768 dimensions). Then, the inverse frequency (Event_IDF) of each log event is calculated based on the statistical characteristics of the log events. The semantic vector is combined with the inverse frequency Event_IDF of the log events to obtain the final feature vector with good robustness.

[0049] Step 3: Build a log sequence anomaly detection model. First, use the improved serialization deep learning model Mogrifier LSTM to learn the log sequence information. Then, connect the convolutional neural network (CNN) to extract features from the results of the previous layer of serialization deep neural network. Finally, use the fully connected layer to map the results to the result labels.

[0050] Step 4: Log sequence anomaly detection. After performing sequence segmentation on the log to be predicted in step 1, perform feature vectorization according to the log template vector generated in step 2. Then, apply it to the anomaly detection model trained in step 3. This will produce a one-dimensional vector of length 2. The result is normalized using the sigmoid function to obtain the probabilities of the predicted results being 0 and 1. The log sequence is then judged to be normal or not based on the probabilities.

[0051] The specific steps of the present invention are described in detail below with reference to the accompanying drawings.

[0052] Combine Figure 1 The present invention provides a log sequence anomaly detection method based on a deep hybrid neural network, comprising the following steps:

[0053] Step 1: split the log sequence, such as Figure 2 The specific steps are as follows:

[0054] In step 1.1, parse the log set using common log parsing methods. The main function of log parsing is to divide unstructured logs into structured logs, as follows:

[0055] Log:Received block blk_-90739925866 87739851 of size 11977 from / 10.250.19.102

[0056] Template:Received block<*>of size<*>from<*>

[0057] During log parsing, each log entry is categorized as a log template (log event), the variable is changed to <*>, and the final log template (the collection of all log events) is provided. This paper focuses on the second half of log analysis: anomaly detection. Therefore, as a pre-task, we use the mature Drain method to perform log parsing and obtain structured log data.

[0058] In step 1.2, determine how the logs are generated. If the log set is generated based on a session ID, that is, each log corresponds to a specified session ID, then the logs are sequentially segmented using a session window. If the log set is generated based on a time sequence, that is, each log is generated in chronological order without a specific ID basis, then the log set is sequentially segmented using a sliding window.

[0059] In step 1.3, the log set is segmented into log sequences using a session window or a sliding window.

[0060] Session window: Applicable to log sets generated based on session IDs. Each log corresponds to a session ID (Block_Id). The session window aggregates the logs contained in each Block_Id to form a log sequence, which corresponds to the label of the Block_Id.

[0061] Sliding window: This method primarily targets time-sequentially generated logs. It uses a fixed-size window that slides along the log timeline at a fixed step size, generating sequential log sequences. Sliding windows have two main parameters: window_size and sliding_step. Window_size primarily refers to the window size of the log sequence, while sliding_step indicates the speed at which the window moves across the log set. As the sliding window moves along the timeline, each window forms a log sequence. If a log sequence contains an abnormal log entry, it is considered an abnormal sequence; otherwise, it is considered a normal sequence.

[0062] Step 2: Log template semantic vectorization, such as Figure 3 The specific steps are as follows:

[0063] Step 2.1: perform data preprocessing on the log template generated in step 1.1, removing invalid symbols and interfering numbers, splitting spliced ​​words, etc.

[0064] In step 2.2, the processed log template is fed into the BERT pre-trained model to obtain its semantic vector. The BERT ("BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding." (2018)) model is an advanced semantic extraction model based on the Transformer (A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, ANGomez, L. Kaiser, and I. Polosukhin, "Attention is all you need," in Proceedings of the 31st International Conference on Neural Information Processing Systems, 2017, pp. 5998–6008.) attention mechanism. Composed of multiple Transformer blocks (Trms), each consisting of a multi-head attention mechanism layer and a feedforward neural network layer, BERT fully captures the weighted relationships between each word in the input log event and incorporates word position information for semantic extraction. The present invention uses a pre-trained Bert model to perform preliminary semantic vectorization on log events, and each log event is ultimately converted into a 768-dimensional vector.

[0065] Step 2.3: Count the number of different log events according to step 1.1 and calculate the inverse frequency Event_IDF of each log event.

[0066]

[0067] where count(e i ) indicates log event e i The number of times it occurs in this log set, and Indicates the total number of occurrences of all log events in the log set, Event idf (e i ) can show the statistical characteristics of log events to a certain extent.

[0068] In step 2.4, Event_IDF is appropriately scaled and then combined with the semantic vector generated in step 2.2.

[0069]

[0070] Where [min, max] is the specified zoom range, IDF min and IDF maxis the minimum and maximum value of the event inverse frequency calculated in step 2.3. nor-idf (e i ) is calculated and scaled to the specified range [min, max]. Whether a log sequence is abnormal or not is often more closely related to rare log events in the sequence. Log events that appear less globally often have a greater impact on the current log sequence. Therefore, based on the log event semantic vector generated in step 2.2, we multiply it by the scaled log event inverse frequency Event nor-i (e i ), this statistical characteristic can be used to influence the semantic features in a weighted manner, while [min, max] is the manually controllable influence of Event_IDF on the semantic feature vector, which is generally set to around 1. Combining the two, we obtain the final log template semantic feature vector.

[0071] Step 3: Build a log sequence anomaly detection model. The specific steps are as follows:

[0072] In step 3.1, the log sequence obtained in step 1 is semantically vectorized according to the log template semantic vector obtained in step 2 to obtain the semantic vector of the log sequence. For example, if a log sequence consists of n logs, the semantic vector of the log sequence is [n, 768].

[0073] The [n,768] feature vector is connected to a fully connected layer for feature purification and compression to the specified size [n,in_size]. The purpose of this step is to match the BERT pre-trained semantic vector with the log dataset text for feature extraction.

[0074] In step 3.2, the [n, in_size] vector is fed into the serialized deep learning model Mogrifier LSTM. In the order of the log sequence, the vectors corresponding to the n logs are input into the n neural unit cells respectively.

[0075] Mogrifier LSTM is an improved long short-term memory network discovered by this invention that can better fit the characteristics of log sequences. Compared with the ordinary long short-term memory network LSTM, Mogrifier LSTM performs interactive processing on information before it enters the cell. t Before inputting into the cell, it will first be compared with the hidden layer state h of the previous cell. t-1 Perform iterative interaction. The specific iterative operations are as follows:

[0076]

[0077]

[0078] Experimental proof x t and h t-1 After a limited number of iterative interactions, the data is put into the LSTM cell, which greatly improves the memory and fitting capabilities of the serialization model. This is why Mogrifier LSTM can better capture and fit the log serialization features.

[0079] In step 3.3, after passing through the Mogrifier LSTM, we use multiple convolution kernels of different sizes to perform convolution operations on the hidden layer output [n, hidden_size]. The convolution results are concatenated and then connected to the fully connected layer to map them to the final result (0 or 1). This can maximize the mining of log features after Mogrifier LSTM processing.

[0080] Step 4: Perform log anomaly detection. The specific steps are as follows:

[0081] In step 4.1, the log sequence to be predicted is feature-vectorized according to the log template vector in step 2, and then fed into the model trained in step 3. Finally, a one-dimensional vector with a length of 2 is obtained as the output of the fully connected layer.

[0082] In step 4.2, the sigmoid function is used to normalize the results and obtain the probabilities of the results being 0 and 1.

[0083]

[0084] Feeding the log sequence to be predicted into the model trained in step 3 ultimately yields a one-dimensional vector of length 2, where the first number represents the probability of a prediction result of 0, and the second number represents the probability of a prediction result of 1. After passing through the sigmoid function, the likelihood is normalized to a value between (0 and 1), conforming to the probability form.

[0085] Step 4.3, set the prediction threshold P. When the probability of the prediction result generated in step 4.2 being 0 is greater than P, the log sequence is predicted to be normal. When the probability of the result being 0 is less than P, the log sequence is predicted to be abnormal. The present invention uses a threshold P to determine whether the predicted log sequence is normal or not. Compared with the method of simply comparing the probability of 0 and 1, the prediction accuracy can be adjusted. According to the log characteristics and user needs, appropriately raising the P value can reduce the number of normal results and increase the number of abnormal results in the prediction results, thereby increasing the recall rate and reducing the accuracy rate; conversely, lowering the P value can increase the number of normal results in the prediction results, reduce the number of abnormalities, improve the accuracy rate, and increase the recall rate. The prediction threshold P allows users to adjust the accuracy and recall rate of the model according to their needs.

[0086] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A log sequence anomaly detection method based on deep hybrid neural network, characterized in that: The following steps are involved: Step 1: Sequence the logs using a combination of sliding windows and session windows. Step 2: semantic vectorization of log templates is achieved by combining semantic vector features and statistical features; First, the pre-trained language model Bert is used to semantically vectorize the log template. Then, the inverse frequency of each log event is calculated. The Bert semantic vector is combined with the inverse frequency of the event to achieve semantic vectorization of the log template. Step 3: Using an improved serialized deep learning model combined with a convolutional neural network, we train log sequences with abnormal or normal labels to establish an anomaly detection model. The specific steps for building a log anomaly detection model are: In step 3.1, the log sequence from step 1 is feature-vectorized using the log template semantic vector generated in step 2. This generates a feature vector for the log sequence, which is then fed into the model. A fully connected layer is first introduced to extract and compress the feature vector, ensuring that the semantic vector generated in step 2 is more closely aligned with the log data. In step 3.2, the log sequence feature vectors are fed into the improved sequential deep learning model Mogrifier LSTM in the order of the log events. The feature vector of each log event corresponds to a neural cell unit, which is used to capture the sequential and semantic features of the log. In step 3.3, a convolutional neural network is connected to the serialized deep learning model. The feature capture capability of the convolutional neural network is used to extract features from the results of the LSTM layer. A fully connected layer is then connected to map the output of the CNN layer to labels 0 and 1. Step 4: Apply the constructed anomaly detection model to perform anomaly detection on the newly generated log sequence.

2. The method according to claim 1, characterized in that In step 1, determine the sequence pattern of the log: If it is a time-based sequence, specify the sliding window size window_size and sliding step size step_size parameters, slide on the log set according to the timestamp, and split the log sequence; If it is a sequence based on the session ID, the log events corresponding to each ID are extracted according to the session ID and combined into a log sequence corresponding to the ID to complete the log sequence division.

3. The method according to claim 2, characterized in that Before anomaly detection, the unstructured log data is structured to obtain the log event template and the structured log event set.

4. The method according to claim 2, characterized in that The sliding window log event extraction method generates log event sequences by sliding all logs in the time dimension according to the window sliding method. The window size window_size and sliding distance step_size are set according to the time span of the log. When step_size>=window_size, the log event sequence has no repetitions. When there is one or more abnormal logs in a log event sequence, the sequence is considered an abnormal sequence; otherwise, it is a normal sequence.

5. The method according to claim 2, characterized in that The session window log event extraction method extracts all log events belonging to a session ID: blk_id and combines them into a log event sequence, and matches them with the label corresponding to the blk_id.

6. According to the method of claim 1, the specific steps of step 2 of semantic vectorization of log template are: Step 2.1, preprocess the log template generated in step 1.1, remove invalid symbols and interference numbers, and split the spliced ​​words; In step 2.2, the processed log template is fed into the BERT pre-trained model to obtain the semantic vector of the log template. Each log event corresponds to a 768-dimensional semantic vector. Step 2.3: Count the number of different log events according to step 1.1 and calculate the inverse frequency Event_IDF of each log event: Where n represents the number of events in the log, e i represents the i-th event; Step 2.4: After appropriately scaling Event_IDF, combine it with the semantic vector generated in step 2.

2. Where [min, max] is the specified zoom range, IDF min and IDF max is the minimum and maximum value of the event inverse frequency calculated in step 2.3; Event nor-idf (e i ) is calculated and scaled to the specified range [min, max]; then the normalized event inverse frequency is multiplied by the log template semantic vector in step 2.2 to achieve the combination of log statistical characteristics and semantic vectors to obtain the log template feature vector.

7. The method according to claim 1, characterized in that In step 4, the sigmoid function is used to normalize the prediction results of the model to obtain the probability of the log sequence being normal or abnormal, and whether the log sequence is normal or not is determined based on the probability.

8. According to the method of claim 7, the specific steps of step 4 of log anomaly detection are: Step 4.1: The log sequence to be predicted is feature-vectorized according to the log template vector in step 2, and then fed into the model trained in step 3 to obtain a one-dimensional vector of size 2 output by the fully connected layer. Step 4.2, use the sigmoid function to normalize the results and obtain the probabilities of the results being 0 and 1; Step 4.3: Set the prediction threshold P. When the probability of the prediction result generated in step 4.2 being 0 is greater than P, the log sequence is predicted to be normal. When the probability of the result being 0 is less than P, the log sequence is predicted to be abnormal.

Images