A system exception determination method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application disclose a system anomaly determination method and device, electronic equipment and a storage medium. The method comprises: obtaining a target log generated in a system running process and a plurality of log templates stored in the system, wherein the target log is generated according to any one of the plurality of log templates; obtaining an attribute set of the target log and encoding information of each log template respectively; determining a log text vector of the target log according to the attribute set and all the encoding information; and determining whether an anomaly occurs in the system according to the log text vector. Embodiments of the present application obtain the target log generated in the system running process and the plurality of log templates stored in the system, then further obtain the attribute set of the target log and the encoding information of each log template, thereby determining the log text vector of the target log, finally realizing the judgment of the system anomaly, reducing the generation of redundant information, and improving the efficiency of determining the system anomaly.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, and in particular to a method, apparatus, electronic device and storage medium for determining system anomalies. Background Technology

[0002] During the operation of system applications, various logs are generated. These logs record the system's running status and the various operations performed by the system. Therefore, logs are an important source of information for online monitoring and anomaly detection, and it is particularly important to determine system anomalies based on system logs.

[0003] Currently, existing log-based system anomaly detection methods utilize machine learning, primarily based on time series models. However, this approach fails to consider that logs are generated from templates, resulting in a large number of repetitive statements. These repetitive statements have little effect on determining whether a system anomaly has occurred and constitute redundant information, significantly reducing the efficiency of anomaly detection. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for determining system anomalies, enabling the judgment of system anomalies, solving the problem of excessive redundant information in the determination process, and improving the efficiency of determining system anomalies.

[0005] According to one aspect of the present invention, an embodiment of the present invention provides a method for determining system anomalies, the method comprising:

[0006] The system obtains the target log generated during system operation and multiple log templates stored within the system. The target log is generated based on any one of the multiple log templates.

[0007] Obtain the attribute set of the target log and the encoding information of each log template respectively;

[0008] Based on the attribute set and all encoded information, determine the log text vector of the target log;

[0009] Based on the log text vector, determine whether an anomaly has occurred in the system.

[0010] Optionally, the attribute set includes attribute information of all words that make up the target log, including word vectors and position vectors; obtaining the attribute set of the target log includes: inputting the target log into a first preset model to determine the word vector of each word; encoding the position of each word in the target log to determine the position vector of each word; and associating the word vector and position vector of each word to obtain the attribute set.

[0011] Optionally, for any log template, obtaining the encoding information of the log template includes: inputting the log template into a first preset model to determine the log template word vector; and using a second preset model to encode the log template word vector to obtain the encoding information.

[0012] Optionally, based on the attribute set and all encoding information, the log text vector of the target log is determined, including: determining the attention vector between each word and each log template based on the encoding information and the weight between each word and each log template; determining the log word vector based on the attention vector, attribute set and preset algorithm; and determining the log text vector based on the log word vector.

[0013] Optionally, the log word vectors include the updated word vectors of all words that make up the target log; the log word vectors are determined based on the attention vector, attribute set, and preset algorithm, including: obtaining the preprocessed vector of the i-th word using the preset algorithm based on the attribute information of the i-th word and the attention vector between the i-th word and each log template, where i is a positive integer; obtaining the updated word vector of the (i-1)-th word; and inputting the updated word vector of the (i-1)-th word and the preprocessed vector of the i-th word into the third preset model to obtain the updated word vector of the i-th word.

[0014] Optionally, the log text vector is determined based on the log word vector, including: forming the log text vector by updating the word vector after the first word in the log word vector and updating the word vector after the last word.

[0015] Optionally, the system may be determined to be abnormal based on the log text vector, including: determining the abnormality determination parameter of the system based on the log text vector and the word vector of all words; if the abnormality determination parameter is greater than the preset parameter, the system is determined to be abnormal; if the abnormality preset parameter is less than or equal to the preset parameter, the system is determined to be operating normally.

[0016] According to another aspect of the present invention, embodiments of the present invention also provide a system anomaly determination apparatus, the apparatus comprising: a template acquisition module, configured to acquire a target log generated during system operation and multiple log templates stored in the system, wherein the target log is generated based on any one of the multiple log templates; an information acquisition module, configured to acquire the attribute set of the target log and the encoding information of each log template respectively; a vector determination module, configured to determine the log text vector of the target log based on the attribute set and all encoding information; and an anomaly determination module, configured to determine whether an anomaly has occurred in the system based on the log text vector.

[0017] According to another aspect of the present invention, an electronic device is also provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the system anomaly determination method of any embodiment of the present invention.

[0018] According to another aspect of the present invention, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions for causing a processor to execute and implement the system anomaly determination method of any embodiment of the present invention.

[0019] The technical solution of this invention obtains a target log generated during system operation and multiple log templates stored within the system. The target log is generated based on any one of the multiple log templates. The invention then obtains the attribute set of the target log and the encoding information of each log template. Based on the attribute set and all encoding information, the log text vector of the target log is determined. Finally, the system anomaly is determined based on the log text vector. Building upon the above embodiment, by obtaining the target log generated during system operation and multiple log templates stored within the system, and then further obtaining the attribute set of the target log and the encoding information of each log template to determine the log text vector of the target log, and finally determining whether the system anomaly has occurred, this invention achieves the judgment of system anomalies, reduces the generation of redundant information, and improves the efficiency of determining system anomalies.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a system anomaly determination method provided in Embodiment 1 of the present invention;

[0023] Figure 2 This is a flowchart of a system anomaly determination method provided in Embodiment 2 of the present invention;

[0024] Figure 3This is a schematic diagram of the structure of a system anomaly determination device provided in Embodiment 3 of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] Example 1

[0029] Figure 1 This is a flowchart of a system anomaly determination method provided in Embodiment 1 of the present invention. This embodiment is applicable to determining abnormal situations in a system. The method can be executed by a system anomaly determination device, which can be implemented in hardware and / or software. In a specific embodiment, the system anomaly determination device can be configured in an electronic device. Figure 1 As shown, the method of this embodiment of the invention specifically includes the following steps:

[0030] S110. Obtain the target logs generated during system operation and multiple log templates stored in the system.

[0031] The target log is generated based on any one of multiple log templates. A log template is a fixed format for a log, which is generated by the log corpus containing all the words that make up the log and stored in the system. There are multiple log templates in the system.

[0032] Specifically, the system stores multiple log templates. During system operation, the system generates multiple logs based on these templates and determines the target log from these multiple logs based on the operations performed on the system.

[0033] S120. Obtain the attribute set of the target log and the encoding information of each log template respectively.

[0034] The target log consists of multiple words and can record the operating system process and the system's running status. The attribute set contains the attribute information of all the words that make up the target log. The attribute information of each word includes the word vector and the position vector of the word. The word vector is used to represent the content of the word, and the position vector is used to represent the position of the word.

[0035] The encoding information of a log template is the information obtained by encoding the content of the log template. Specifically, the encoding information of the log template can be determined by encoding the word vectors of the log template.

[0036] Specifically, after acquiring the target logs generated during system operation, the target logs are input into a first preset model. Through pre-training of word vectors using the first preset model and the log corpus, the word vector of each word in the target log is determined. Then, by encoding the position of each word in the target log, the position vector of each word is determined. The word vector and position vector of each word are then associated to obtain an attribute set. The first preset model is used to train the target logs, and the word vectors are vectors that map words or phrases in the target log to real numbers.

[0037] Furthermore, after obtaining multiple log templates stored in the system, for any log template, the log template is input into the first preset model to determine the log template word vector, and the log template word vector is encoded using the second preset model to obtain encoded information. The second preset model is a model used to encode the log template word vector.

[0038] S130. Determine the log text vector of the target log based on the attribute set and all encoding information.

[0039] Here, the log text vector is a concatenated vector of word vectors updated from the words in the target log.

[0040] Specifically, after determining the attribute set of the target log and the encoding information of each log template, the log text vector of the target log is determined by performing a dot product calculation on the attribute set of the target log and the encoding information of each log template.

[0041] S140. Determine whether an anomaly has occurred in the system based on the log text vector.

[0042] Specifically, after determining the log text vector, the system's anomaly determination parameters are determined based on the log text vector and the word vectors of all words in the target log. If the anomaly determination parameters are greater than the preset parameters, the system is determined to have an anomaly; if the anomaly determination parameters are less than or equal to the preset parameters, the system is determined to be operating normally.

[0043] The technical solution of this invention obtains a target log generated during system operation and multiple log templates stored within the system. The target log is generated based on any one of the multiple log templates. The invention then obtains the attribute set of the target log and the encoding information of each log template. Based on the attribute set and all encoding information, the log text vector of the target log is determined. Finally, the system anomaly is determined based on the log text vector. Building upon the above embodiment, by obtaining the target log generated during system operation and multiple log templates stored within the system, and then further obtaining the attribute set of the target log and the encoding information of each log template to determine the log text vector of the target log, and finally determining whether the system anomaly has occurred, this invention achieves the judgment of system anomalies, reduces the generation of redundant information, and improves the efficiency of determining system anomalies.

[0044] Example 2

[0045] Figure 2 This is a flowchart of a system anomaly determination method provided in Embodiment 2 of the present invention. This embodiment is applicable to determining system anomalies. The method can be executed by a system anomaly determination device, which can be implemented in hardware and / or software. In a specific embodiment, the system anomaly determination device can be configured in an electronic device. Based on the above embodiment, the following steps are taken: obtaining the attribute set of the target log; obtaining the encoding information of any log template; determining the log text vector of the target log based on the attribute set and all encoding information; and further optimizing the method based on the log text vector to determine whether a system anomaly has occurred. Figure 2 As shown, the method specifically includes the following steps:

[0046] S201. Obtain the target logs generated during system operation and multiple log templates stored in the system.

[0047] Specifically, during system operation, target logs are generated, and the system retrieves the target logs generated during system operation, as well as multiple log templates stored in the system.

[0048] S202. Input the target log into the first preset model to determine the word vector of each word.

[0049] The first preset model is used to train the target log, such as the word2vec model, which is not limited in this embodiment. The word2vec model is a relevant model used to generate word vectors; word vectors are vectors that map words or phrases in the target log to real numbers.

[0050] Specifically, after obtaining the target log, the target log is input into the first preset model. Through the pre-training of word vectors by the first preset model and the log corpus, the word vector of each word in the target log is determined.

[0051] S203. Encode the position of each word in the target log and determine the position vector of each word.

[0052] Specifically, after determining the word vector of each word in the target log, the position vector of each word is determined by encoding the position of each word in the target log.

[0053] S204. Associate the word vector and position vector of each word to obtain the attribute set.

[0054] Specifically, after determining the word vector of each word in the target log and the position vector of each word in the target log, the word vector of each word and the position vector of each word in the target log are added together to obtain the attribute set of the target log.

[0055] S205. For any log template, input the log template into the first preset model and determine the log template word vector.

[0056] Specifically, after obtaining any log template, the log template is input into the first preset model for training and analysis to determine the log template word vector.

[0057] S206. Encode the word vectors of the log template using the second preset model to obtain encoded information.

[0058] The second preset model is a model used to encode the word vectors of the log template, such as a convolutional neural network (CNN), etc. This embodiment does not limit this.

[0059] Specifically, after determining the log template word vector, the log template word vector is input into the second preset model (convolutional neural network) for training. The convolutional neural network encodes the log template word vector to determine the encoding information corresponding to each template.

[0060] S207. Based on the encoding information and the weight between each word and each log template, determine the attention vector between each word and each log template.

[0061] Here, the weight is used to represent the matching relationship between each word and each log template; the attention vector is a parameter used to determine the correspondence between each word and each log template.

[0062] Specifically, after determining the encoded information, the attention vector... in, Let i be the weight between the i-th word and the j-th log template. Let i be the encoding information of the j-th log template, where j = 1, ..., m, m is the number of log templates stored in the system, and i is a positive integer.

[0063] Furthermore, the weight between the i-th word and the j-th log template in, and This is a log intermediate parameter, and the log intermediate parameter f is a constant coefficient and All are parameter matrices. This is the encoding information for the k-th template. For the updated word vector of the (i-1)th word, is the attribute set corresponding to the i-th word; a, b, and c have no entity meaning and are only used to distinguish the encoded information, word vectors, and updated word vectors, which correspond to different parameter matrices.

[0064] In this embodiment of the invention, there is no sequential relationship between steps S202-S204 and steps S205-S207. That is, steps S202-S204 can be executed first and then steps S205-S207 can be executed, or steps S205-S207 can be executed first and then steps S202-S204 can be executed, or steps S202-S204 and steps S205-S207 can be executed simultaneously.

[0065] S208. Determine the log word vectors based on the attention vector, attribute set, and preset algorithm.

[0066] The preset algorithm is an algorithm used to determine the log word vectors, such as a gate mechanism, etc. This embodiment does not limit it.

[0067] Specifically, after determining the attention vector and attribute set, the log word vector is determined based on the attention vector, attribute set, and preset algorithm.

[0068] Furthermore, based on the above embodiments, optionally, the log word vector includes the updated word vectors of all words constituting the target log; determining the log word vector according to the attention vector, attribute set, and preset algorithm includes: obtaining the preprocessed vector of the i-th word using the preset algorithm based on the attribute information of the i-th word and the attention vector between the i-th word and each log template, where i is a positive integer; obtaining the updated word vector of the (i-1)-th word; inputting the updated word vector of the (i-1)-th word and the preprocessed vector of the i-th word into the third preset model to obtain the updated word vector of the i-th word.

[0069] The third preset model is a pre-defined model algorithm used to analyze and determine the updated word vectors. For example, it can be a gated recurrent unit (GRU), but this embodiment does not limit it.

[0070] Specifically, based on the attribute information of the i-th word and the attention vector between the i-th word and each log template, a preprocessing vector for the i-th word is obtained using a preset algorithm. Further, the preprocessing vector... Among them, g i are constant coefficients and To calculate the dot product of vectors, W g This is the parameter matrix corresponding to the preprocessing vector. After determining the preprocessing vector for the i-th word, the preprocessing vector is input... in, Let i be the updated word vector of the i-th word in the target log. The BiGRU model is a neural network model consisting of unidirectional, opposite-direction, output GRUs, updated word vectors for the (i-1)th word of the target log. This allows us to determine the updated word vectors for all words in the target log. The advantage of this approach is that it determines log word vectors based on attention vectors, attribute sets, and a pre-defined algorithm, avoiding redundant information during the determination process and improving efficiency.

[0071] S209. Determine the log text vector based on the log word vector.

[0072] Furthermore, after determining the updated log word vectors of the target log, based on the above embodiments, optionally, the updated word vectors of the first word and the updated word vectors of the last word in the log word vectors are combined to form the log text vector.

[0073] Specifically, the updated log word vector corresponding to the first word vector of the target log is determined, and so on for the second, third, and so on, until the updated log word vector corresponding to the nth word vector is determined. Then, the updated word vectors of the first and last words in the log word vectors are combined to form the log text vector, and concatenated to determine the log text vector. in, The word vector updated for the first word. The word vector updated for the last word.

[0074] Because this invention introduces the concept of weight between words and log templates, and determines the attention vector between each word and each log template, redundant information is not generated when determining the log text vector of the target log, thus improving computational efficiency.

[0075] S210. Determine the system's anomaly detection parameters based on the log text vector and the word vectors of all words.

[0076] Specifically, after determining the log text vector and the word vectors of all words, the system's anomaly detection parameters are determined. Where l is a constant coefficient.

[0077] S211. Determine if the abnormal parameter is greater than the preset parameter.

[0078] Specifically, after determining the anomaly determination parameter, if the anomaly determination parameter is greater than the preset parameter, then execute S212 to determine that the system has an anomaly; if the anomaly determination parameter is less than or equal to the preset parameter, then execute S213 to determine that the system is operating normally.

[0079] For example, when the preset parameter is 0, if the exception determination parameter is greater than 0, the system is determined to have an exception and S212 is executed; if the exception determination parameter is less than or equal to the preset parameter, the system is determined to be operating normally and S213 is executed.

[0080] S212, System malfunction.

[0081] Specifically, if the anomaly determination parameter is greater than the preset parameter, then the system is determined to have an anomaly.

[0082] S213, The system is running normally.

[0083] Specifically, if the abnormal determination parameter is less than or equal to the preset parameter, the system is considered to be operating normally.

[0084] The technical solution of this invention involves: acquiring target logs generated during system operation and multiple log templates stored within the system; inputting the target logs into a first preset model to determine the word vector of each word; encoding the position of each word in the target log to determine the position vector of each word; associating the word vector and position vector of each word to obtain an attribute set; for any log template, inputting the log template into the first preset model to determine the log template word vector; encoding the log template word vector using a second preset model to obtain encoding information; determining the attention vector between each word and each log template based on the encoding information and the weight between each word and each log template; determining the log word vector based on the attention vector, attribute set, and preset algorithm; determining the log text vector based on the log word vector; determining the system's anomaly determination parameter based on the log text vector and the word vectors of all words; determining whether the anomaly determination parameter is greater than a preset parameter; if the anomaly determination parameter is greater than the preset parameter, determining that the system has an anomaly; if the anomaly preset parameter is less than or equal to the preset parameter, determining that the system is operating normally. Based on the above embodiments, by determining the log template word vectors and encoding information respectively, the attention vector between each word and each template is further determined. Then, the log word vectors are determined according to the attention vectors, attribute sets and preset algorithms. Finally, the system's anomaly determination parameters are determined according to the log word vectors. It is judged whether the anomaly determination parameters are greater than the preset parameters, thereby determining whether the system is operating normally. This realizes the judgment of system anomalies, reduces redundant information generated in the judgment process, and improves the efficiency of determining system anomalies.

[0085] Example 3

[0086] Figure 3 This is a schematic diagram of a system anomaly determination device provided in Embodiment 3 of the present invention. The device includes: a template acquisition module 310, an information acquisition module 320, a vector determination module 330, and an anomaly determination module 340.

[0087] The template acquisition module 310 is used to acquire the target log generated during system operation and multiple log templates stored in the system. The target log is generated based on any one of the multiple log templates.

[0088] The information acquisition module 320 is used to acquire the attribute set of the target log and the encoding information of each log template respectively.

[0089] Vector determination module 330 is used to determine the log text vector of the target log based on the attribute set and all encoding information.

[0090] The anomaly determination module 340 is used to determine whether an anomaly has occurred in the system based on the log text vector.

[0091] Optionally, the attribute set includes attribute information for all words that make up the target log, including word vectors and position vectors.

[0092] Optionally, the information acquisition module 320 acquires the attribute set of the target log, specifically for: inputting the target log into the first preset model to determine the word vector of each word; encoding the position of each word in the target log to determine the position vector of each word; and associating the word vector and position vector of each word to obtain the attribute set.

[0093] Optionally, the information acquisition module 320, for any log template, acquires the encoding information of the log template, specifically for: inputting the log template into the first preset model to determine the word vector of the log template; and using the second preset model to encode the word vector of the log template to obtain the encoding information.

[0094] Optionally, the vector determination module 330 is specifically used to: determine the attention vector between each word and each log template based on the encoding information and the weight between each word and each log template; determine the log word vector based on the attention vector, attribute set and preset algorithm; and determine the log text vector based on the log word vector.

[0095] Optionally, the log word vectors include the updated word vectors of all the words that make up the target log.

[0096] Optionally, the vector determination module 330 is further configured to: obtain the preprocessed vector of the i-th word using a preset algorithm based on the attribute information of the i-th word and the attention vector between the i-th word and each log template, where i is a positive integer; obtain the updated word vector of the (i-1)-th word; and input the updated word vector of the (i-1)-th word and the preprocessed vector of the i-th word into the third preset model to obtain the updated word vector of the i-th word.

[0097] Optionally, the vector determination module 330 is also used to: form a log text vector by combining the updated word vector of the first word and the updated word vector of the last word in the log word vector.

[0098] Optionally, the anomaly determination module 340 is specifically used to: determine the anomaly determination parameters of the system based on the log text vector and the word vectors of all words; if the anomaly determination parameters are greater than the preset parameters, then the system is determined to have an anomaly; if the anomaly preset parameters are less than or equal to the preset parameters, then the system is determined to be operating normally.

[0099] The system anomaly determination device provided in the embodiments of the present invention can execute the system anomaly determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0100] Example 4

[0101] Figure 4 This is a schematic diagram of an electronic device provided in Embodiment 4 of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0102] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0103] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0104] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the method system anomaly determination method.

[0105] In some embodiments, the method for determining system anomalies may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the method for determining system anomalies described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the method for determining system anomalies by any other suitable means (e.g., by means of firmware).

[0106] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0108] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0110] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0111] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0112] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0113] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for determining system anomalies, characterized in that, The method includes: The system obtains a target log generated during system operation and multiple log templates stored within the system, wherein the target log is generated based on any one of the multiple log templates; The attribute set of the target log and the encoding information of each log template are obtained respectively; wherein, the attribute set includes the attribute information of all words that make up the target log, and the attribute information includes word vectors and position vectors; Based on the attribute set and all the encoded information, determine the log text vector of the target log; Based on the log text vector, determine whether the system has experienced an anomaly; Determining the log text vector of the target log based on the attribute set and all the encoded information includes: Based on the encoding information and the weights between each word and each log template, an attention vector is determined between each word and each log template. The log word vectors are determined based on the attention vector, the attribute set, and the preset algorithm. The log text vector is determined based on the log word vector; The step of determining whether the system has experienced an anomaly based on the log text vector includes: Based on the log text vector and the word vectors of all the words, the anomaly determination parameters of the system are determined; If the anomaly determination parameter is greater than the preset parameter, then the system is determined to have encountered an anomaly. If the anomaly determination parameter is less than or equal to the preset parameter, then the system is determined to be operating normally.

2. The method according to claim 1, characterized in that, The acquisition of the attribute set of the target log includes: The target log is input into the first preset model to determine the word vector for each word; The position of each word in the target log is encoded to determine the position vector of each word; The word vector and position vector of each word are associated to obtain the attribute set.

3. The method according to claim 1, characterized in that, For any of the log templates, obtaining the encoding information of the log template includes: The log template is input into the first preset model to determine the log template word vector; The word vectors of the log template are encoded using a second preset model to obtain the encoded information.

4. The method according to claim 1, characterized in that, The log word vectors include the updated word vectors of all words that make up the target log; The step of determining the log word vector based on the attention vector, the attribute set, and the preset algorithm includes: Based on the attribute information of the i-th word and the attention vector between the i-th word and each of the log templates, the preprocessing vector of the i-th word is obtained using the preset algorithm, where i is a positive integer; Obtain the updated word vector for the (i-1)th word; The updated word vector of the (i-1)th word and the preprocessed vector of the ith word are input into the third preset model to obtain the updated word vector of the ith word.

5. The method according to claim 4, characterized in that, Determining the log text vector based on the log word vector includes: The log text vector is formed by updating the word vector of the first word and the word vector of the last word in the log word vector.

6. A system anomaly determination device, characterized in that, The device includes: The template acquisition module is used to acquire the target log generated during system operation and multiple log templates stored in the system, wherein the target log is generated based on any one of the multiple log templates; The information acquisition module is used to acquire the attribute set of the target log and the encoding information of each log template respectively; wherein, the attribute set includes attribute information of all words that make up the target log, and the attribute information includes word vectors and position vectors; A vector determination module is used to determine the log text vector of the target log based on the attribute set and all the encoded information. An anomaly determination module is used to determine whether an anomaly has occurred in the system based on the log text vector. The vector determination module is specifically used for: Based on the encoding information and the weight between each word and each log template, an attention vector is determined between each word and each log template; based on the attention vector, the attribute set, and a preset algorithm, a log word vector is determined; based on the log word vector, the log text vector is determined. The anomaly determination module is specifically used for: Based on the log text vector and the word vectors of all the words, the anomaly determination parameter of the system is determined; if the anomaly determination parameter is greater than a preset parameter, the system is determined to have an anomaly; if the anomaly determination parameter is less than or equal to the preset parameter, the system is determined to be operating normally.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the system anomaly determination method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the system anomaly determination method according to any one of claims 1-5.

Images