A system log detection method and system based on GAN network and meta-learning

Abstract

This invention discloses a system log detection method based on GAN networks and meta-learning. It utilizes generative adversarial networks to generate a balanced dataset, which is then input into a meta-learning model for training and learning, outputting log classifications. This effectively solves the technical problem of inaccurate system log detection when log data is imbalanced or insufficient, thus improving the accuracy of system log detection. Furthermore, this invention also discloses a system log detection system based on GAN networks and meta-learning, constructing a generative adversarial network model and a hyperparameter meta-network model. This system also exhibits good detection performance and high accuracy even when the input system log data is imbalanced or insufficient.

Description

Technical Field

[0001] This invention relates to the field of computer system security detection technology, and in particular to a system log detection method and system based on GAN networks and meta-learning. Background Technology

[0002] With the rapid development of the shared and open internet, network attack methods are also becoming increasingly automated and diversified, posing unprecedented challenges to network security. Network security threats mainly include internal system vulnerability threats, misoperation threats, and external attack threats. Any network system can output log files that record the system's operating status and executed operations. These log files can provide assistance in many areas, such as intrusion detection, fault handling, time correlation, incident handling, and post-incident investigation. Analyzing logs for online monitoring and threat detection is one of the hot research topics in the field of computer security.

[0003] As network intrusion attacks have evolved from independent, simple, and easily exposed attacks to organized, targeted, and long-lasting attacks such as APTs, and as systems have gradually developed in scale, distributed deployment, high parallelism, and redundant operation, traditional detection methods have become bogged down in the difficulty of manually selecting features due to massive log data and highly covert attack methods. Meanwhile, the booming development of deep learning has provided new ideas for solving these problems.

[0004] Deep learning technology has flourished in the era of big data. Examples include convolutional neural networks (CNNs) that focus on learning spatial features of samples, and recurrent neural networks (RNNs) that mine and discover time-series features. With appropriate parameters, deep learning models do not require manual feature extraction; the model itself can perform feature extraction and detection, greatly reducing workload while maintaining accuracy. The accuracy of deep learning detection models is mainly affected by three factors: the model structure must be compatible with the data structure; the model needs a sufficiently balanced dataset for training; and the model needs appropriate hyperparameters. When the amount of data is small, traditional neural networks often fail to train models with high accuracy. Some studies have proposed solutions, such as transfer learning using pre-trained models. However, in some scenarios, there is a lack of raw data available for pre-training; the data in the scenario may differ from the data used for pre-training; and the number of samples in a single class may be too small, such as in rare system anomalies or attacks. Imbalanced datasets often lead to model prediction bias. For classification problems, if the number of samples in the two classes differs significantly, the accuracy of model training will suffer severely. For a simple example, consider the classification of DoS attacks and SQL injection attacks. There are 990 log entries for DoS attacks and 10 log entries for SQL injection attacks. In this case, the model only needs to predict all input samples as DoS attacks to achieve a 99% recognition rate. However, such a classifier is worthless because it cannot predict SQL injection attacks.

[0005] In existing log anomaly detection models based on deep learning technology, imbalanced training datasets and insufficient data volume often lead to low prediction accuracy, or even failure to detect logs from categories with fewer data samples. Current solutions include undersampling, which randomly selects a number of samples from the majority class that is roughly equivalent to the number of samples from the minority class, and then combines them to form a new dataset. The number of samples after undersampling depends on the original number of samples from the minority class. When the difference between the number of samples from the majority and minority classes is significant, and the number of samples from the minority class is small, this can lead to the loss of important information from the majority class samples. Oversampling, simply put, involves sampling a single sample from the minority class multiple times to approximate the number of positive and negative samples before learning. However, expanding the minority class increases the model's training complexity, and directly copying samples can make the rules learned by the learner overly specific, leading to overfitting. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the present invention aims to provide a system log detection method and system based on GAN networks and meta-learning, which solves the technical problem of inaccurate detection when log data is unbalanced or the amount of log data is too small, thereby improving the accuracy of system log detection.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A system log detection method based on GAN networks and meta-learning, the method includes the following steps:

[0009] S1. Obtain system log text data and system hardware data, and construct standard multi-sequence data;

[0010] S2. Construct a generative adversarial network (GAN) model. Use multi-sequence data as input to the GAN model. Utilize the generative and discriminative models of the GAN model to engage in a game of mutual competition. Update the loss function and cross-entropy of the GAN model based on backpropagation to obtain a GAN model with optimal parameters and output a balanced log training dataset.

[0011] S3. Introduce a hyperparameter meta-network as the meta-learner in meta-learning. This network uses the current network weights and total loss function at each step to generate the learning rate parameter and weight decay coefficient, so that each internal loop iteration during meta-learning training can adapt to the given task.

[0012] S4. Use the generative adversarial network model with optimal parameters as the basic meta-learner for meta-learning, and use the hyperparameter meta-network as the meta-learner to construct a log detection meta-learning model.

[0013] S5. Input the balanced log training dataset into the log detection meta-learning model to train the classification model and output the log classification.

[0014] Furthermore, step S1 in the system log detection method based on GAN networks and meta-learning includes:

[0015] The system log text data is obtained from the main log text sequence of the system. Based on the log parser, the log template sequence number is extracted to obtain a log data sequence of size N*1.

[0016] The system hardware sequence data of size N*n is collected. The hardware sequence data includes the indicator information of each system hardware and the corresponding collection time, where n is the number of indicators collected from the system hardware.

[0017] The log data sequence and hardware sequence data are matched according to the time dimension to obtain a standard multi-sequence data of size N*(1+n), where each system log data corresponds to one system hardware sequence data.

[0018] Furthermore, step S2 in the system log detection method based on GAN networks and meta-learning includes:

[0019] S21. Input the multi-sequence data into the generation model to generate a fake log sample set;

[0020] S22. Input the fake log sample set and the real log sample set into the discrimination model respectively, and let the discrimination model determine whether the fake log sample set is a real sample or a fake sample.

[0021] S23. During the discrimination process, the loss function in the discrimination model continuously updates the parameters of the discrimination model until the discriminator model can determine whether the fake log sample set is a real event. At this point, the training of the discrimination model ends, and the fake log sample set generated by the generator model is judged by the trained discrimination model. The discrimination model inputs the judgment result into the generator model.

[0022] S24. The loss function in the generative model continuously updates the parameters of the generative model, optimizing the fake log sample set generated by the generative model;

[0023] S25. Input the fake log sample set and the real log sample set generated by the generative model into the discriminative model for discrimination. When the discriminative model cannot distinguish whether the input fake log sample set is a fake log sample set generated by the generator model or a real log sample set, the training of the generative model ends and the training of the discriminative model continues.

[0024] S26. When the set number of training cycles is reached, the generative model and the discriminative model reach a balance, resulting in a mature generative model, and the training ends.

[0025] Furthermore, step S203 in the system log detection method based on GAN networks and meta-learning includes:

[0026] The parameters of the discriminant model are continuously updated based on the loss function in the discriminant model. The loss function in the discriminant model is: Where θ is the initial weight, m ​​is the number of samples, and x i For the i-th true log sample, Z i For the i-th fake log sample, D(x) i ) represents x i The probability of a log being judged as genuine, G(Z) i ) represents the generated log sample, D(G(Z) i The logD(x) represents the probability that a generated log sample is identified as a real log. i ) represents the probability that the discriminant model classifies a true log sample as real data, log(1-D(G(Z)). i The probability that the discriminant model will classify the fake log samples generated by the generative model as fake data.

[0027] Furthermore, step S204 in the system log detection method based on GAN networks and meta-learning includes:

[0028] The parameters of the generative model are continuously updated based on the loss function in the generative model. The loss function in the generative model is:

[0029] Maximizing the loss function in the discriminative model and minimizing the loss function in the generative model, the optimization function of the generative adversarial network model is expressed as:

[0030] min G max D V(D,G)=[E[logD(x i )]+E[log(1-D(G(z i )))).

[0031] Where, E[logD(x) i E[log(1-D(G(Z)]] refers to the expected probability that the discriminant model will classify a true log sample as real data, E[log(1-D(G(Z)]] i [)] refers to the expected probability that the discriminative model will classify the fake log samples generated by the generative model as fake data.

[0032] Furthermore, the steps for obtaining a generative adversarial network model with optimal parameters in the system log detection method based on GAN networks and meta-learning include:

[0033] Multi-sequence data is input into the generative model to generate a fake log sample set;

[0034] Input the fake log sample set and the real log sample set into the discrimination model respectively to obtain the generation distribution of the fake log sample set generated by the generation model;

[0035] The loss function and cross-entropy of the generative adversarial network model are updated based on backpropagation. The model parameters of each layer are updated in reverse until the optimal parameters of the generative adversarial network model are obtained. The cross-entropy is the cross-entropy between the sample distribution of the real log sample set and the generation distribution of the generated fake log sample set.

[0036] The formula for calculating cross-entropy H is:

[0037]

[0038] Where, p i Let q be the sample distribution of the true log sample set. i The generation distribution of the fake log sample set.

[0039] Furthermore, step S3 in the system log detection method based on GAN networks and meta-learning includes:

[0040] A balanced log training dataset is input into the meta-learning network for pre-training. In the pre-training task, k sub-tasks are given, and the dataset for each sub-task is divided into a training set and a test set.

[0041] Train the model on the training sets of each of the k subtasks to obtain the model parameters for each subtask; test the model parameters of each subtask using the test set in each subtask, and calculate the loss function l between the predicted value and the true label for each subtask. k ;

[0042] Based on the loss function lk for each sub-task, the loss function of the meta-learning network is obtained. for:

[0043]

[0044] Among them, D i T represents the probability that the generated log is classified as true in the i-th training task. i Let l represent the i-th training task. h Let l1...l be the loss function for the h-th training task. k Here is the loss function for each subtask.

[0045] Furthermore, step S3 in the system log detection method based on GAN networks and meta-learning includes:

[0046] The parameters of the subtask with the best model parameters among the k subtasks are set as the initial parameters of the hyperparameter meta-network, and these initial parameters are used as the initial weights θ of the network. Based on these initial parameters and the loss function of the meta-learning network, the model is trained on a balanced log training dataset, and the training task is adaptively updated with a fixed number of inner loop updates, resulting in:

[0047]

[0048] Where, θ i+1 Let θ be the weight at step i+1. i Let β be the weight for the i-th step, β = 1 - αλ. The adaptive process is controlled by updating the hyperparameters in the equation. The hyperparameters are the learning rate parameter α and the regularization parameter β, and λ is the regularization coefficient.

[0049] Optimal hyperparameters are generated through model training.

[0050] Furthermore, step S3 in the system log detection method based on GAN networks and meta-learning also includes:

[0051] The hyperparameter generation network employs a 3-layer MLP structure with ReLU activation. It takes the gradient and mean weights of each layer as input. For the output, the learning rate α and regularization parameter β are first generated term-by-term, and then copied to their respective parameters θ. i Dimensions.

[0052] A system log detection system based on GAN networks and meta-learning, the system comprising:

[0053] The acquisition module is used to acquire system log text data and system hardware data, and construct standard multi-sequence data.

[0054] The Generative Adversarial Network (GAN) module is used to build a GAN model. It takes multi-sequence data as input to the GAN model, uses the generative and discriminative models of the GAN model to play against each other, and updates the loss function and cross-entropy of the GAN model based on backpropagation to obtain a GAN model with optimal parameters and output a balanced log training dataset.

[0055] The hyperparameter meta-network module is used to introduce a hyperparameter meta-network as a meta-learner in meta-learning. This network uses the current network weights and total loss function at each step to generate learning rate parameters and weight decay coefficients, so that each inner loop iteration during meta-learning training can adapt to the given task.

[0056] The log detection meta-learning model module is used to construct a log detection meta-learning model by using a generative adversarial network model with optimal parameters as the basic meta-learner and a hyperparameter meta-network as the meta-learner.

[0057] The classification module is used to input a balanced log training dataset into the log detection meta-learning model for classification model training, and output the log classification.

[0058] Compared with existing technologies, the system log detection method and system based on GAN networks and meta-learning provided by this invention have the following beneficial effects: This invention utilizes generative adversarial networks to generate a balanced dataset, which is then input into a meta-learning model for training and learning. This effectively solves the technical problems of imbalanced log data and insufficient log data volume in existing technologies, thereby improving the accuracy of system log detection. It also utilizes generative adversarial networks to address the bias problem caused by the training and prediction of log anomaly detection models. In addressing the bias problem caused by the training and prediction of log anomaly detection models, it effectively solves the problems of model overfitting and information loss. Finally, it utilizes a meta-learning model to address the technical problem of inaccurate model predictions due to insufficient log data volume. Attached Figure Description

[0059] Figure 1This is a flowchart illustrating a system log detection method based on GAN network and meta-learning in an embodiment of the present invention.

[0060] Figure 2 This is a flowchart illustrating the specific steps of step S1 in a system log detection method based on GAN network and meta-learning in an embodiment of the present invention.

[0061] Figure 3 This is a flowchart illustrating a training method for a generative adversarial network model according to an embodiment of the present invention.

[0062] Figure 4 This is a flowchart illustrating the specific steps of step S3 in a system log detection method based on GAN network and meta-learning in an embodiment of the present invention.

[0063] Figure 5 This is a schematic diagram of the structure of a system log detection system based on GAN network and meta-learning in an embodiment of the present invention. Detailed Implementation

[0064] The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention. Any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0065] This invention utilizes a generative model in a Generative Adversarial Network (GAN) to generate a fake log sample set. This fake sample set, along with a real log sample set, is input into a discriminative model. The discriminative model determines whether a sample is a real log sample set or a fake one generated by the generative model. The generative model generates fake samples that closely resemble real samples, attempting to deceive the discriminative model. The discriminative model strives to distinguish between the fake and real log sample sets generated by the generative model. Through continuous interaction and competition, the generative and discriminative models improve each other until they reach a stable equilibrium. At this point, the generative model outputs a balanced log dataset. This balanced log dataset is then input into a trainer in a meta-learning neural network for training. n sub-tasks are randomly selected from the training task, and model parameters are trained for each sub-task. Gradient descent is used to update the parameters, thus finding the optimal hyperparameter settings. The trained trainer is then used to train the learner in the meta-learning model. The learner leverages the prior knowledge from the trainer to better train for specific tasks. The trained learner demonstrates excellent detection performance for logs with only a limited number of sample types.

[0066] like Figure 1 The present invention, as shown in one embodiment, provides a system log detection method based on GAN networks and meta-learning, comprising the following steps:

[0067] S1. Obtain system log text data and system hardware data, and construct standard multi-sequence data;

[0068] S2. Construct a generative adversarial network (GAN) model. Use multi-sequence data as input to the GAN model. Utilize the generative and discriminative models of the GAN model to engage in a game of mutual competition. Update the loss function and cross-entropy of the GAN model based on backpropagation to obtain a GAN model with optimal parameters and output a balanced log training dataset.

[0069] S3. Introduce a hyperparameter meta-network as the meta-learner in meta-learning. This network uses the current network weights and total loss function at each step to generate the learning rate parameter and weight decay coefficient, so that each internal loop iteration during meta-learning training can adapt to the given task.

[0070] S4. Use the generative adversarial network model with optimal parameters as the basic meta-learner for meta-learning, and use the hyperparameter meta-network as the meta-learner to construct a log detection meta-learning model.

[0071] S5. Input the balanced log training dataset into the log detection meta-learning model to train the classification model and output the log classification.

[0072] It should be noted that the hyperparameter meta-network is an adaptive hyperparameter meta-learning neural network. Hyperparameters refer to the parameters set before the learning process begins. Setting appropriate hyperparameters can improve the performance and effectiveness of the neural network.

[0073] This application embodiment utilizes generative adversarial networks to generate a balanced dataset. The generated balanced dataset is then input into a meta-learning model for training and learning, and outputs a log classification. This effectively solves the technical problems of inaccurate system log detection when log data is imbalanced or the amount of log data is too small, thereby improving the accuracy of system log detection.

[0074] like Figure 2 As shown, as an optional implementation, the steps for obtaining system log text data and system hardware data to construct standard multi-sequence data, i.e., step S1, include:

[0075] S11. Obtain system log text data from the system's main log text sequence, extract the log template sequence number based on the log parser, and obtain a log data sequence of size N*1.

[0076] S12. Collect system hardware sequence data of size N*n at a frequency of 1 data point / second. The hardware sequence data includes the indicator information of each system hardware and the corresponding collection time, where n is the number of indicators collected for the system hardware.

[0077] S13. Match system log text data and system hardware data according to the time dimension, that is, match the N*1 log data sequence with the N*n hardware sequence data in time order to form a standard multi-sequence data of N*(1+n), where each system log data corresponds to one system hardware sequence data.

[0078] It should be noted that, optionally, the hardware sequence information may include information such as the system's CPU, random access memory (RAM), cache, and hard disk. In this embodiment, four system hardware metrics are collected, and the collected system hardware sequence information includes the system's CPU, RAM, cache, and hard disk metrics, along with their corresponding times.

[0079] In this implementation, log data sequences and hardware sequence data are matched according to the time dimension to establish standard multi-sequence data, making the data more ordered and easier to call.

[0080] Optionally, to eliminate the influence of dimensions on the results, the hardware data is normalized to obtain normalized system hardware data.

[0081]

[0082] Among them, (X) hw ) represents hardware data, max(X) hw ) and min(X hw ) are the maximum and minimum values ​​in the system hardware data, respectively.

[0083] Step S2: Construct a generative adversarial network (GAN) model, using multi-sequence data as input to the GAN model, employing the generative and discriminative models of the GAN model to engage in a game of mutual competition, and updating the loss function and cross-entropy of the GAN model based on backpropagation, obtaining a GAN model with optimal parameters, and outputting a balanced log training dataset.

[0084] Generative Adversarial Networks (GANs) consist of a generative model and a discriminative model. The generative model generates fake samples (i.e., samples that do not actually exist) that resemble real data. These fake samples cause the discriminative model to misclassify a sample. The discriminative model, for each sample, determines whether it comes from the real dataset or from a fake sample generated by the generative model. Based on this, the generative and discriminative models continuously improve each other through a game until they reach a stable equilibrium. At this point, the generative model can be used to generate samples that are highly similar to real data. In other words, by learning the data distribution of normal data through GANs, the data generated or reconstructed by the generative model is considered normal data.

[0085] like Figure 3 As shown, as an optional implementation, step S2, i.e., the training method of the generative adversarial network model, includes:

[0086] S21. Input the multi-sequence data into the generation model to generate a fake log sample set;

[0087] S22. Input the fake log sample set and the real log sample set into the discrimination model respectively, and let the discrimination model determine whether the fake log sample set is a real sample or a fake sample.

[0088] S23. During the discrimination process, the loss function in the discrimination model continuously updates the parameters of the discrimination model until the discriminator model can determine whether the fake log sample set is a real event. At this point, the training of the discrimination model ends, and the generator model is trained. The fake log sample set generated by the generator model is judged by the trained discrimination model, and the discrimination model inputs the judgment result into the generator model.

[0089] S24. The loss function in the generative model continuously updates the parameters of the generative model, optimizing the fake log sample set generated by the generative model;

[0090] S25. Input the fake log sample set and the real log sample set generated by the generative model into the discriminative model for discrimination. When the discriminative model cannot distinguish whether the input fake log sample set is a fake log sample set generated by the generator model or a real log sample set, the training of the generative model ends and the training of the discriminative model continues.

[0091] S26. When the set number of training cycles is reached, the generative model and the discriminative model reach a balance, resulting in a mature generative model, and the training ends.

[0092] Specifically, assuming the input multi-sequence data of the generative model follows a prior distribution π(z), and the probability distribution of the output data of the generative model is p(x), that is, the output of the generative model consists of fake log samples with training set features that follow the p(x) distribution. The generative model trains the mapping relationship between the prior distribution π(z) of the input data and the probability distribution p(x) of the training set. The real log sample set and the fake log sample set generated by the generative model are input into the discriminative model for discrimination. The discriminative model outputs the probability D(x) that the fake log sample set is real. The discriminative model is required to determine whether the fake log sample set is a real or fake sample as closely as possible, while simultaneously requiring the fake log samples generated by the generative model to become increasingly closer to real log samples. The mathematical representation of the discriminative model is y = f(x), which can also be represented as the conditional probability distribution p(y|x). When a sample from the fake log sample set is input, the discriminative model outputs a classification label y. The discriminative model learns the mapping relationship between the fake log sample x and the output class label. That is, the goal of learning is to maximize the probability of the discriminative model outputting the classification label y given the fake log sample x.

[0093] In this implementation, the generative model and the discriminative model improve each other through continuous interaction, making the fake log sample set generated by the generative model closer to the real log sample set.

[0094] As an optional implementation, the steps to obtain the optimization function of the generative adversarial network model include: continuously updating the parameters of the discriminant model based on the loss function in the discriminant model, where the loss function in the discriminant model is... Where θ is the initial weight, m ​​is the number of samples, and x i For the i-th true log sample, Z i For the i-th fake log sample, D(x) i ) represents x i The probability of a log being judged as genuine, G(Z) i ) represents the generated log sample, D(G(Z) i The log(x) represents the probability that a generated log sample is judged as a real log, where log D(x) is the log value. i ) represents the probability that the discriminant model classifies a true log sample as real data, log(1-D(G(Z)). i The discriminant model determines the probability that it will classify a fake log sample generated by the generative model as fake data. The discriminant model aims for the highest possible accuracy, therefore it needs to maximize log D(x). i )+log(1-D(G(Z i )));

[0095] The parameters of the generative model are continuously updated based on the loss function in the generative model. The loss function in the generative model is: The generative model aims to minimize the probability that the discriminant model will classify fake log samples as fraudulent. Therefore, the generative model needs to minimize log(1-D(G(Z)). i ))).

[0096] Therefore, the optimization function of the generative adversarial network model is expressed as:

[0097] min G max D V(D, G) = [E[logD(x)] i )]+E[log(1-D(G(z i )))).

[0098] Where, E[logD(x) i The probability that a discriminative model will classify a genuine log sample as real data is the expected value.

[0099] E[log(1-D(G(Z i [)] refers to the expected probability that the discriminative model will classify the fake log samples generated by the generative model as fake data.

[0100] In this implementation, the generation model and the discrimination model continuously compete and improve each other. When the discrimination model cannot make a judgment, that is, when the discrimination model's accuracy rate is 50%, the generation model and the discrimination model reach a dynamic equilibrium and no longer update their parameters. At this point, the fake log sample set generated by the generation model is closest to the real log sample set.

[0101] As an optional implementation, the steps to obtain a generative adversarial network model with optimal parameters include:

[0102] Multi-sequence data is input into the generative model to generate a fake log sample set;

[0103] Input the fake log sample set and the real log sample set into the discrimination model respectively to obtain the generation distribution of the fake log sample set generated by the generation model;

[0104] The loss function and cross-entropy of the generative adversarial network model are updated based on backpropagation. The model parameters of each layer are updated in reverse until the optimal parameters of the generative adversarial network model are obtained. The cross-entropy is the cross-entropy between the sample distribution of the real log sample set and the generation distribution of the generated fake log sample set.

[0105] The formula for calculating cross-entropy H is:

[0106]

[0107] Where, p i Let q be the sample distribution of the true log sample set. i The generation distribution of the fake log sample set.

[0108] In this implementation, the Generative Adversarial Network (GAN) model starts from the output layer and uses the chain rule of function differentiation to calculate the model gradient layer by layer from back to front, eliminating repetitive differentiation steps and reducing the computational cost during GAN training. Furthermore, the GAN model optimizes its parameters using the cross-entropy between the distribution of real log samples and the generation distribution of fake log samples, reducing the discrepancy between the generated samples and the real distribution.

[0109] like Figure 4 As shown, as an optional implementation, step S3 includes:

[0110] S31. Input the balanced log training dataset into the meta-learning network for pre-training. In the pre-training task, k sub-tasks are given, and the dataset of each sub-task is divided into a training set and a test set.

[0111] S32. Train the model on the training sets of each of the k sub-tasks to obtain the model parameters for each sub-task; test the model parameters of each sub-task using the test set in each sub-task, and calculate the loss function l between the predicted value and the true label in each sub-task. k ;

[0112] S33, Loss function based on each subtask k The loss function of the meta-learning network is obtained. for: Among them, D i T represents the probability that the generated log is classified as true in the i-th training task. i Let l represent the i-th training task. h Let l1…l be the loss function for the h-th training task. k Here is the loss function for each subtask.

[0113] It should be noted that the training and test datasets are obtained from the balanced log training dataset of the input. The training set is used to train the meta-learning network, and the test set is used to test the trained meta-learning network.

[0114] The loss function of the meta-learning network can be obtained through the pre-training process described above. That is, the sum of the loss functions of all subtasks. The loss function of the meta-learning network is used to update the parameters of each subtask.

[0115] As an optional implementation, step S3 also includes:

[0116] S34. Set the parameters of the subtask with the best model parameters among the k subtasks as the initial parameters of the hyperparameter meta-network, and use these initial parameters as the initial weights θ of the network. Based on these initial parameters and the loss function of the meta-learning network, train the model on the balanced log training dataset, and adaptively update the training task with a fixed number of inner loop updates, as follows:

[0117]

[0118] Where λ is the regularization coefficient, used to reduce the risk of model overfitting, and θ i+1 Let θ be the weight at step i+1. i Let β be the weight for the i-th step, β = 1 - αλ. The adaptive process is controlled by updating the hyperparameters in the equation, namely the learning rate parameter α and the regularization parameter β.

[0119] S35. Generate optimal hyperparameters through model training.

[0120] The initial weights θ of the network are the parameters with the best performance among the k subtasks obtained during the pre-training process.

[0121] In this implementation, the hyperparameter metanetwork can adapt to different training tasks by updating the hyperparameters in the equation, thus enabling the hyperparameter metanetwork to adapt to different tasks.

[0122] As an optional implementation, step S3 also includes:

[0123] The hyperparameter generation network employs a 3-layer multilayer perceptron (MLP) structure with Rectified Linear Unit (RELU) activation. It takes the gradient and the mean of the weights of each layer as input. For the output, the learning rate α and the regularization parameter β are first generated term by term, and then copied to their respective parameters θ. i Dimensions.

[0124] This hyperparameter generation network enables adaptive generation of hyperparameters and updates the parameters using gradient descent, thereby finding the optimal hyperparameter settings for different training tasks.

[0125] This invention also provides a system log detection system based on GAN networks and meta-learning. By introducing generative adversarial networks and hyperparameter meta-learning networks, it solves the technical problems of inaccurate detection when log data is imbalanced and the amount of log data is too small, thereby improving the accuracy of system log detection.

[0126] like Figure 5 As shown, this invention provides a system log detection system based on GAN networks and meta-learning, the system comprising:

[0127] The acquisition module 51 is used to acquire system log text data and system hardware data, and construct standard multi-sequence data.

[0128] Generative Adversarial Network (GAN) module 52 is used to construct a GAN model. It takes multi-sequence data as input to the GAN model, uses the generative and discriminative models of the GAN model to play against each other, and updates the loss function and cross-entropy of the GAN model based on backpropagation to obtain a GAN model with optimal parameters and output a balanced log training dataset.

[0129] The hyperparameter meta-network module 53 is used to introduce a hyperparameter meta-network as a meta-learner in meta-learning. This network uses the current network weights and total loss function at each step to generate learning rate parameters and weight decay coefficients, so that each inner loop iteration during meta-learning training can adapt to the given task.

[0130] The log detection meta-learning model module 54 is used to construct a log detection meta-learning model by using the optimal parameter generative adversarial network model as the basic meta-learner and the hyperparameter meta-network as the meta-learner.

[0131] The classification module 55 is used to input a balanced log training dataset into the log detection meta-learning model for classification model training and output the log classification.

[0132] In this implementation, the system log detection system based on GAN networks and meta-learning utilizes a generative adversarial network (GAN) module to construct a GAN model. The optimal parameters of the GAN model are obtained through continuous interaction between the generator and discriminator models, solving the technical problem of inaccurate detection when log data is imbalanced. Furthermore, the system log detection system based on GAN networks and meta-learning introduces a hyperparameter meta-learning network through a hyperparameter meta-network module and constructs a log detection meta-learning model using a log detection meta-learning model module. The meta-learners in the log detection meta-learning model are trained to obtain optimal hyperparameter settings. The trained meta-learners are then used to train basic meta-learners, enabling the basic meta-learners to achieve good detection results even with logs containing only a small number of sample types. This solves the technical problem of inaccurate detection when log data volume is too small, improving the accuracy of system log detection.

[0133] In summary, this application provides a system log detection method based on GAN networks and meta-learning. It utilizes generative adversarial networks to generate a balanced dataset, inputs this balanced dataset into a meta-learning model for training, and outputs log classifications. This effectively solves the technical problem of inaccurate system log detection when log data is imbalanced or insufficient, thus improving the accuracy of system log detection. Furthermore, this application also provides a system log detection system based on GAN networks and meta-learning, constructing a generative adversarial network model and a hyperparameter meta-network model. This system also exhibits good detection performance and high accuracy even when the input system log data is imbalanced or insufficient.

[0134] Although preferred embodiments of the invention have been disclosed for illustrative purposes, those skilled in the art will recognize that various modifications, additions, and substitutions are possible without departing from the scope and spirit of the invention as disclosed in the appended claims.

Claims

1. A system log detection method based on GAN network and meta-learning, characterized in that, The method comprises the steps of: S1, obtaining system log text data and system hardware data, and constructing standard multi-sequence data; S2, constructing a generative adversarial network model, taking the multi-sequence data as the input of the generative adversarial network model, using the generative model and the discriminative model of the generative adversarial network model to play against each other, updating the loss function and the cross entropy of the generative adversarial network model based on back propagation, obtaining a generative adversarial network model with optimal parameters, and outputting a balanced log training data set; S3, introducing a hyperparameter meta-network as a meta-learner in meta-learning, which uses the current network weight and total loss function of each step to generate learning rate parameters and weight decay coefficients, so that each internal loop iteration in the meta-learning training process can adapt to the given task; S4, taking the generative adversarial network model with optimal parameters as the basic meta-learner of meta-learning, and taking the hyperparameter meta-network as the meta-learner to construct a log detection meta-learning model; S5, inputting the balanced log training data set into the log detection meta-learning model for classification model training, and outputting the classification of the log; The step S2 comprises: S21, inputting the multi-sequence data into the generative model to generate a false log sample set; S22, inputting the false log sample set and the true log sample set into the discriminative model respectively, and discriminating whether the false log sample set is a true sample or a false sample by the discriminative model; S23, in the discrimination process of the discriminative model, the loss function in the discriminative model continuously updates the parameters of the discriminative model until the discriminative model can judge whether the false log sample set is a real event, then the training of the discriminative model is completed, the false log sample set generated by the generative model is discriminated by the trained discriminative model, and the discrimination result is input into the generator model; S24, the loss function in the generative model continuously updates the parameters of the generative model, and optimizes the false log sample set generated by the generative model; S25, inputting the false log sample set generated by the generative model and the true log sample set into the discriminative model for discrimination, when the discriminative model cannot distinguish whether the input false log sample set is the false log sample set generated by the generator model or the true log sample set, the training of the generative model is completed, and the discriminative model continues to be trained; S26, when the set number of loop training is reached, the generative model and the discriminative model reach balance, a mature generative model is obtained, and the training is completed. 2.The system log detection method based on GAN network and meta-learning of claim 1, wherein, The step S1 comprises: obtaining system log text data from the main log text sequence of the system, extracting log template serial numbers based on a log parser, and obtaining a log data sequence with a size of N*1; collecting system hardware sequence data with a size of N*n, the hardware sequence data comprising index information of each system hardware and corresponding collection time, n being the number of indexes collected by the system hardware; matching the log data sequence and the hardware sequence data according to the time dimension, and matching to obtain standard multi-sequence data with a size of N*(1+n), wherein each system log data corresponds to one system hardware sequence data. 3.The system log detection method based on GAN network and meta-learning of claim 1, wherein, The step S23 comprises: The parameters of the discriminative model are constantly updated based on a loss function in the discriminative model, and the loss function in the discriminative model is where θ is an initial weight, m is a sample number, x i is the i th real log sample, Z i is the i th false log sample, D(x i ) represents a probability that x i is determined as a real log, G(Z i ) represents a generated log sample, D(G(Z i )) represents a probability that the generated log sample is determined as a real log, logD(x i ) is a probability that the discriminative model determines a real log sample as real data, and log(1-D(G(Z i ))) is a probability that the discriminative model determines a false log sample generated by the generated model as false data.

4. The system log detection method based on GAN network and meta-learning according to claim 3, wherein, The step S24 comprises: The parameters of the generation model are constantly updated based on a loss function in the generation model, and the loss function in the generation model is The loss function in the discriminant model is maximized, and the loss function in the generation model is minimized, and the optimization function of the generative adversarial network model is represented as: min G max D V(D,G) = [E[log D(x i )] + E[log(1-D(G(Z i )))] ; where E[log D(x i )] denotes the expectation of the probability that the discriminative model judges the true log sample as real data, and E[log(1-D(G(Z i )))] denotes the expectation of the probability that the discriminative model judges the fake log sample generated by the generative model as fake data.

5. The system log detection method based on GAN network and meta-learning according to claim 4, wherein, The step of obtaining a generative adversarial network model with optimal parameters comprises: inputting the multi-sequence data into the generation model to generate a set of fake log samples; inputting the set of fake log samples and the set of true log samples into the discrimination model respectively to obtain a generation distribution of the set of fake log samples of the generation model; updating the loss function and the cross entropy of the generative adversarial network model based on back propagation, and updating the model parameters of each layer reversely until the optimal parameters of the generative adversarial network model are obtained, wherein the cross entropy is the cross entropy of the sample distribution of the set of true log samples and the generation distribution of the set of fake log samples; a calculation formula of the cross entropy H is: where p i is the sample distribution of the true log sample set, q i is the generating distribution of the false log sample set.

6. The system log detection method based on GAN network and meta-learning according to claim 5, wherein, the step S3 comprises: inputting the balanced log training data set into the meta-learning network for pre-training, and in the pre-training task, k sub-tasks are given, and the data set of each sub-task is divided into a training set and a test set; training the training set in the k sub-tasks respectively to obtain the model parameters of each sub-task; The model parameters of the subtask are tested by using the test set in each subtask, and the loss function l of the predicted value and the real label in each subtask is calculated k ; Loss function l of each subtask k , obtaining the loss function of the meta-learning network is: Wherein, D i represents the probability of generating a log discrimination as true in the i-th training task, T i represents the i-th training task, l h represents the loss function of the h-th training task, l1…l k Loss function of each subtask.

7. The system log detection method based on GAN network and meta-learning according to claim 6, wherein, the step S3 comprises: setting the parameters of the sub-task with the best model parameters in the k sub-tasks as the initial parameters of the hyperparameter meta-network, setting the initial parameters as the initial weights θ of the network, and performing model training on the balanced log training data set based on the initial parameters and the loss function of the meta-learning network, and updating the training task with a fixed number of inner loop updates to: where θ i+1 is the weight of the i+1th step, θ i is the weight of the ith step, β = 1 - αλ, the adaptive process is controlled by updating the hyperparameters in the equation, that is, the learning rate parameter α and the regularization parameter β, and λ is a regularization coefficient; generating the optimal hyperparameters through model training.

8. The system log detection method based on GAN network and meta-learning according to claim 7, wherein, the step S3 further comprises: The hyperparameter generation network adopts a 3-layer MLP structure with RELU activation, taking the mean of the gradients and weights of each layer as input, and for the output, learning rate a and regularization parameter β, the former is generated item by item, and then copied to the respective parameters θ i of the dimensions. 9.A system log detection system based on GAN network and meta learning, characterized in that, the system comprises: an acquisition module, configured to acquire log text data and system hardware data of a system, and construct standard multi-sequence data; a generative adversarial network module, configured to construct a generative adversarial network model, input the multi-sequence data into the generative adversarial network model, perform mutual game between a generation model and a discrimination model of the generative adversarial network model, update the loss function and the cross entropy of the generative adversarial network model based on back propagation, obtain the generative adversarial network model with optimal parameters, and output a balanced log training data set; a hyperparameter meta-network module, configured to introduce a hyperparameter meta-network as a meta-learner in meta-learning, and use the current network weights and the total loss function of each step to generate learning rate parameters and weight decay coefficients, so that each internal loop iteration in the meta-learning training process can adapt to a given task; a log detection meta-learning model module, configured to use the generative adversarial network model with optimal parameters as a basic meta-learner in meta-learning, and use the hyperparameter meta-network as a meta-learner to construct a log detection meta-learning model; a classification module, configured to input the balanced log training data set into the log detection meta-learning model for classification model training, and output the classification of the log; the generative adversarial network module is specifically configured to: input the multi-sequence data into the generation model to generate a set of fake log samples; input the set of fake log samples and the set of true log samples into the discrimination model respectively, and determine whether the set of fake log samples is a true sample or a fake sample by the discrimination model; In the discriminant model discriminant process, the loss function in the discriminant model constantly updates the parameters of the discriminant model until the discriminant model can judge whether the holiday log sample set is a real event, the discriminant model training is completed, the generated model generates the holiday log sample set, and the generated model is discriminated by the trained discriminant model, and the discriminant model inputs the discrimination result into the generator model; The loss function in the generated model constantly updates the parameters of the generated model to optimize the generated holiday log sample set generated by the generated model; The generated holiday log sample set generated by the generated model and the true holiday log sample set are input into the discriminant model for discrimination, and when the discriminant model cannot distinguish whether the input holiday log sample set is the holiday log sample set generated by the generator model or the true holiday log sample set, the training of the generated model is completed, and the discriminant model is continued to be trained; When the set number of cycle training is reached, the generated model and the discriminant model reach balance, a mature generated model is obtained, and the training is completed.

Images