Log template recognition method, device, electronic device and readable medium

Abstract

The present disclosure provides a log template recognition method, device, electronic device and readable medium, wherein the log template recognition method includes: adding synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized; training the recognition model based on the loss function after adding the condition constraints and the data sample set of the log template. Through the embodiments of the present disclosure, the constraint conditions of the recognition model are enhanced, the data volume of the data sample set is reduced, the maintenance difficulty of the data sample set and the recognition model is reduced, and the reliability and efficiency of log template recognition are improved.

Description

Background Art

[0002] At present, log information is one of the most widely used data in the operation and maintenance process. A log generally consists of two parts: "template" and "parameters". When generating a log, a certain template is often followed, and different "parameters" are filled in according to the system operation conditions. For example, the log: "PacketResponder 0 for block blk_4003 The two parameters "0" and "blk_4003" are shown in the underlined part of "terminating".

[0003] In related technologies, logs are text messages that are built by program developers and sent when specific conditions are met, so they are highly subjective and arbitrary. For system operators, they generally focus on the "template" part. The appearance of a specific template means that the current operating status of the system may be abnormal.

[0004] However, as the number of modern system modules increases and the underlying architecture becomes increasingly complex, it is difficult for operation and maintenance personnel to learn and master all the log templates in these modules, making it difficult to effectively analyze a large number of logs. In addition, since a large number of data sample sets are required to train the recognition model, not only does it lead to low efficiency in training the recognition model, but it also leads to a sharp increase in the amount of data required to maintain the recognition model and data sample sets.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a log template recognition method, device, electronic device and readable medium, which are used to overcome the problem of large data volume of data sample sets used for training due to limitations and defects of related technologies at least to a certain extent.

[0007] According to a first aspect of an embodiment of the present disclosure, a method for identifying a log template is provided, comprising: adding synonym condition constraints and antonym condition constraints to the loss function of a recognition model corresponding to the log template to be identified; and training the recognition model based on the loss function after adding the condition constraints and a data sample set of the log template.

[0008] In an exemplary embodiment of the present disclosure, it also includes: inputting the log template to be identified into a trained recognition model to determine a first type of vector corresponding to the recognizable entry output by the recognition model; and / or inputting the unrecognizable entry output by the recognition model into a neural network model for regression calculation; determining a second type of vector corresponding to the unrecognizable entry based on the regression calculation result of the neural network model; determining a vector corresponding to the log template to be identified based on the first type of vector and / or the second type of vector, wherein the dimension of the recognition result of the neural network model is the same as the dimension of the entry that has been calculated by the recognition model.

[0009] In an exemplary embodiment of the present disclosure, it also includes: performing weighted averaging on the vectors corresponding to the log template; determining the vector representation of the log template according to the calculation result of the weighted average; and determining the classification type of the log template based on the vector representation.

[0010] In an exemplary embodiment of the present disclosure, it also includes: inputting the manually annotated log template into a trained recognition model, and generating the vector space according to the output result of the recognition model, wherein the vector space includes the classification type and corresponding vector representation of the manually annotated log template.

[0011] In an exemplary embodiment of the present disclosure, adding synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized includes: determining that the expression of the synonym condition constraint is: And / or the expression for determining the antonym conditional constraint is: The expression of the synonym condition constraint and the expression of the antonym condition constraint are added to the loss function, wherein w represents the terms in the data sample set of the recognition model, S(w) represents the synonym vocabulary of w, u represents the synonyms in the synonym vocabulary, A(w) represents the antonym vocabulary of w, v represents the antonyms in the antonym vocabulary, c represents the terms other than w in the data sample set, W(c) represents the vocabulary corresponding to the terms whose probability of appearing simultaneously with c is higher than a preset probability, #(w,v) represents the number of occurrences of w and v, and sim(w,v) represents the cosine similarity between w and v.

[0012] In an exemplary embodiment of the present disclosure, adding the expression of the synonym condition constraint and the expression of the antonym condition constraint to the loss function includes: determining the expression of the loss function as: ∑ w∈V ∑ c∈V{#(w,c)logσ(sim(w,c))+k#(w)P0(c)logσ(-sim(w,c)_};According to the expression of the synonym condition constraint, the expression of the antonym condition constraint and the expression of the loss function, the expression of the loss function after adding the constraint is determined as follows: Among them, the L represents the loss function after adding constraints, the P0(c) represents the probability of occurrence of c in the data sample set, the k represents a preset constant coefficient, the σ represents the sigmoid function, and the V represents the data sample set.

[0013] In an exemplary embodiment of the present disclosure, training the recognition model using the expanded data sample set includes: determining a label corresponding to the data sample set; and training the recognition model and the neural network model based on the label and the data sample set.

[0014] According to a second aspect of an embodiment of the present disclosure, a log template recognition device is provided, comprising: a training module, configured to add synonym condition constraints and antonym condition constraints to the loss function of a recognition model corresponding to a log template to be recognized; the training module is configured to train the recognition model based on the loss function after adding condition constraints and a data sample set of the log template.

[0015] According to a third aspect of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the methods described above based on instructions stored in the memory.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a program is stored, and when the program is executed by a processor, the method for identifying a log template as described in any one of the above items is implemented.

[0017] The disclosed embodiment reduces the data volume requirement for the data sample set, reduces the difficulty of maintaining the data sample set and the recognition model, and improves the reliability and efficiency of log template recognition by adding synonym condition constraints and antonym condition constraints in the loss function of the recognition model corresponding to the log template to be recognized, and training the recognition model based on the loss function after adding the condition constraints and the data sample set of the log template.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing an exemplary system architecture to which a log template recognition solution according to an embodiment of the present invention can be applied;

[0021] Figure 2 is a flow chart of a method for identifying a log template in an exemplary embodiment of the present disclosure;

[0022] Figure 3 is a flow chart of another method for identifying a log template in an exemplary embodiment of the present disclosure;

[0023] Figure 4 is a flow chart of another method for identifying a log template in an exemplary embodiment of the present disclosure;

[0024] Figure 5 is a flow chart of another method for identifying a log template in an exemplary embodiment of the present disclosure;

[0025] Figure 6 is a flow chart of another method for identifying a log template in an exemplary embodiment of the present disclosure;

[0026] Figure 7 is a flow chart of another method for identifying a log template in an exemplary embodiment of the present disclosure;

[0027] Figure 8 is a block diagram of a log template recognition device in an exemplary embodiment of the present disclosure;

[0028] Fig. 9 is a block diagram of an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0030] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0031] Figure 1 The diagram shows an exemplary system architecture to which the log template recognition solution according to the embodiment of the present invention can be applied.

[0032] like Figure 1 As shown, the system architecture 100 may include one or more of terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0033] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0034] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Terminal devices 101, 102, 103 can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, desktop computers, etc.

[0035] In some embodiments, the log template recognition method provided in the embodiment of the present invention is generally executed by the terminal 105, and accordingly, the log template recognition device is generally set in the terminal device 103 (which may also be the terminal device 101 or 102). In other embodiments, some servers may have functions similar to those of the terminal device to execute the method. Therefore, the log template recognition method provided in the embodiment of the present invention is not limited to execution in the terminal device.

[0036] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0037] Figure 2 4 is a flowchart of a method for identifying a log template in an exemplary embodiment of the present disclosure.

[0038] refer to Figure 2 , the identification method of the log template may include:

[0039] Step S202: adding synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized.

[0040] Step S204: training the recognition model based on the loss function with added conditional constraints and the data sample set of the log template.

[0041] The disclosed embodiment improves the reliability and efficiency of log template recognition, reduces the data volume requirement for the data sample set, and reduces the difficulty of maintaining the data sample set and the recognition model by adding synonym condition constraints and antonym condition constraints in the loss function of the recognition model corresponding to the log template to be recognized, and training the recognition model based on the loss function after adding the condition constraints and the data sample set of the log template.

[0042] The following describes in detail the steps of the log template recognition method.

[0043] In an exemplary embodiment of the present disclosure, Figure 3 As shown, the log template identification method also includes:

[0044] Step S302: input the log template to be identified into the trained recognition model to determine the first type of vector corresponding to the recognizable term output by the recognition model.

[0045] Step S304: input the unrecognizable terms output by the recognition model into a neural network model for regression calculation.

[0046] Step S306, determining the second type of vector corresponding to the unrecognizable term according to the regression calculation result of the neural network model.

[0047] Step S308, determining the vector corresponding to the log template to be identified according to the first type of vectors and / or the second type of vectors, wherein the dimension of the recognition result of the neural network model is the same as the dimension of the entry calculated by the recognition model.

[0048] In an exemplary embodiment of the present disclosure, the log template to be identified is input into a trained recognition model to determine a first type of vector corresponding to the recognizable terms output by the recognition model, and the unrecognizable terms output by the recognition model are input into a neural network model for regression calculation, and then the second type of vector corresponding to the unrecognizable terms is determined according to the regression calculation result of the neural network model, and finally the vector corresponding to the log template to be identified is determined according to the first type of vector and / or the second type of vector, thereby further improving the reliability of the recognition model and improving the accuracy of extracting the log template.

[0049] In an exemplary embodiment of the present disclosure, Figure 4 As shown, the log template identification method also includes:

[0050] Step S402: performing weighted averaging on the vectors corresponding to the log template.

[0051] Step S404: determining a vector representation of the log template according to the calculation result of the weighted average.

[0052] Step S406: Determine the classification type of the log template based on the vector representation.

[0053] In an exemplary embodiment of the present disclosure, Figure 5 As shown, it also includes:

[0054] Step S502: input the manually annotated log template into the trained recognition model, and generate the vector space according to the output result of the recognition model, wherein the vector space includes the classification type and the corresponding vector representation of the manually annotated log template.

[0055] In an exemplary embodiment of the present disclosure, the specific steps of the above-mentioned manual labeling include: reading the log template of the first specified category in the log message queue, performing classification prediction on the read log template, reporting the result of the classification prediction to the second specified category, and continuing to manually label the log template of the second specified category.

[0056] In an exemplary embodiment of the present disclosure, after determining the vector expression of the log template to be identified, the classification type corresponding to the log template to be identified is determined by the similarity (or distance or cosine similarity) between the vector expression of the log template to be identified and the vector expression in the vector space.

[0057] In an exemplary embodiment of the present disclosure, adding synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized includes:

[0058] The expression for determining the synonym condition constraint is:

[0059]

[0060] And / or the expression for determining the antonym conditional constraint is:

[0061]

[0062] The expression of the synonym condition constraint and the expression of the antonym condition constraint are added to the loss function, wherein w represents the terms in the data sample set of the recognition model, S(w) represents the synonym vocabulary of w, u represents the synonyms in the synonym vocabulary, A(w) represents the antonym vocabulary of w, v represents the antonyms in the antonym vocabulary, c represents the terms other than w in the data sample set, W(c) represents the vocabulary corresponding to the terms whose probability of appearing simultaneously with c is higher than a preset probability, #(w,v) represents the number of occurrences of w and v, and sim(w,v) represents the cosine similarity between w and v.

[0063] In an exemplary embodiment of the present disclosure, adding the synonym condition constraint expression and the antonym condition constraint expression to the loss function includes:

[0064] The expression for determining the loss function is:

[0065]

[0066] According to the expression of the synonym condition constraint, the expression of the antonym condition constraint and the expression of the loss function, the expression of the loss function after adding constraints is determined as follows:

[0067]

[0068] Wherein, L represents the loss function after adding constraints, P0(c) represents the probability of occurrence of c in the data sample set, k represents a preset constant coefficient, σ represents the sigmoid function, and the sigmoid function expression is σ(x)=1 / (1+e -x ), wherein V represents the data sample set.

[0069] In an exemplary embodiment of the present disclosure, Figure 6 As shown, training the recognition model through the expanded data sample set includes:

[0070] Step S602: determine the label corresponding to the data sample set.

[0071] Step S604: training the recognition model and the neural network model based on the label and the data sample set.

[0072] In an exemplary embodiment of the present disclosure, Figure 7 As shown, the log template recognition scheme is implemented based on the log processing system 700. The log processing system 700 includes a data I / O module, a preprocessing module, a template extraction module, a word vector extraction module, an unknown word vector generation module, a sentence vectorization module and a nearest neighbor classifier. The specific implementation process of the technical solution of the present disclosure includes:

[0073] ① Data IO module: This module is composed of a Kafka consumer and a Kafka producer, and performs streaming processing on the continuous log data of the system. The module uses the consumer part to read the log template from a specific topic in the Kafka message queue and predict its corresponding category; after the prediction is completed, the producer part uploads the classification result to another topic.

[0074] ② Preprocessing module: This module is responsible for preprocessing the template, including Chinese / English word segmentation, punctuation filtering, hash value replacement and other common methods.

[0075] ③ Template extraction module: This module is responsible for extracting a relatively small number of templates from a large number of logs. Many mature template extraction algorithms on the market can be applied here, such as "Drain", "Spell", etc. Some of these extracted templates have been labeled after manual processing. These templates and corresponding labels will be directly output to the message queue; the remaining templates are sent to the model structure (④-⑥) proposed in this disclosure. Most of these unlabeled templates are newly generated when the system is running, and the operation and maintenance personnel have no time to label them.

[0076] ④Word vector extraction module: This module is responsible for generating word vectors based on log templates. There are many pre-trained word vectors based on large corpora such as wikidump (Wikipedia) available on the market, but the log template data sample set includes a large proportion of IT-specific nouns, so the effect of pre-trained word vectors is poor. Based on this, the model proposed in the present disclosure chooses manual generation, regards each log template as a complete "sentence", and uses the word2vec method to extract the word vector of each word. Due to the small number of words in the log template, the present disclosure also uses synonyms / antonyms of specific word interpretations in the corpus to further constrain the model output at the loss function level.

[0077] Specifically, the data sample set expansion method adopted in this disclosure is as follows:

[0078] The loss function usually used by the word2vec model is the skip-gram loss with negative sampling. The word2vec model is a group of related models used to generate word vectors. These models are shallow, two-layer neural networks that are trained to reconstruct linguistic word texts. Considering a specific word w in the dictionary (which can be used as a data sample set), the model needs to maximize the similarity of words that often appear with it. In addition, k words are randomly sampled from the model dictionary. The probability that these words happen to appear with w is very low, so the model needs to minimize the similarity between them.

[0079] The loss function of the above SGNS (skip-gram negative sampling) model is as follows:

[0080]

[0081] However, since log text has the characteristics of "small number of dictionaries, many proper nouns, and frequent repetition of the same words", the assumption of the above negative sampling part will be challenged. The present disclosure solves the above problem by modifying the SGNS loss function based on the principle of synonym / antonym expansion.

[0082] For word w, set its synonymous (including synonyms, etc.) word set (lexicon) as S(w). If the word has some synonyms, then intuitively it can be considered that the distance between the word and these synonyms should be close. The premise of the calculation is that "the synonym actually appears in the data sample set".

[0083] The present disclosure adds the following additional items to the above SGNS loss function to reflect the constraint condition. Where W(c) is a set constructed using local mutual information (LMI), which includes words with a probability higher than the mean that appears with word c, # indicates the number of occurrences, c is a word other than w, and the expression of the synonym constraint condition includes:

[0084]

[0085] For the antonym set A(w), the present disclosure also uses the same method to make the distance between words and these antonyms farther. The expression of the antonym constraint condition includes:

[0086]

[0087] In summary, the loss function corresponding to the recognition model of the present disclosure is as follows:

[0088]

[0089] The above method adopted in the present invention is equivalent to further constraining the output of the model through synonym / antonym conditions on the basis of the original data sample set. It solves the problem of fewer training samples by enhancing constraints rather than expanding the data sample set, reducing the amount of data sample set required for training, thereby reducing data maintenance costs, and improving training efficiency and the reliability of the recognition model.

[0090] ⑤ Unknown word vector generation module: Newly generated templates are often accompanied by new words, mainly referring to entries that cannot be determined by the recognition model. Conventional word vector systems will directly ignore these words, but in log template processing, these words often directly contain the fault type or the name of the faulty component, and are of high importance. Based on this, the present disclosure also proposes a method of using an LSTM (Long Short-Term Memory, referring to a long short-term memory artificial neural network) neural network model to process trained word vectors to generate vectors corresponding to unknown words.

[0091] The input of the neural network model is a series of letters (including Chinese characters and special characters), each letter corresponds to about k emb dimensional vector, the model prediction result is k w2v The vector is the same size as the original word vector, rather than the normalized "log template classification probability" that often appears in the field of log processing. The LSTM model can output k by combining any letters as a sequence input to the model. w2v dimensional vector that can be used for subsequent calculations. emb and k w2vIt is usually a positive integer and can be 20 and 64 respectively in actual application scenarios.

[0092] In addition, in order to maintain the properties of the original word2vec model, the results of the LSTM output should be as close as possible to the word vectors that have been calculated in the original word2vec model. Therefore, the present disclosure uses all the words in the original dictionary as input during the training phase and uses the L2 loss function (mean square error) as the objective function.

[0093] ⑥ Sentence vectorization module and nearest neighbor classifier: When components ④ and ⑤ are trained, the model can convert any word into a vector of a specific dimension. For any log template "sentence", the model calculates (or searches) the vector corresponding to each word in it. TF-IDF (term frequency-inverse document frequency) is a commonly used weighted technique for information retrieval and data mining. TF is term frequency, and IDF is inverse document frequency. After using TF-IDF weighted average or simple average to obtain the vector representation of the sentence. If the target template is unclassified, search the space for the classified template with the closest cosine distance to the sentence, and take the category corresponding to this template as the category of the target template. The recognition model proposed in the present disclosure uses the nnDescent algorithm, which is an embodiment of the K nearest neighbor graph, to accelerate the calculation process of the log template.

[0094] Corresponding to the above method embodiment, the present disclosure also provides a log template recognition device, which can be used to execute the above method embodiment.

[0095] Figure 8 It is a block diagram of a log template recognition device in an exemplary embodiment of the present disclosure.

[0096] refer to Figure 8 , the log template recognition device 800 may include:

[0097] The training module 802 is configured to add synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized.

[0098] The training module 802 is further configured to train the recognition model based on the loss function after adding conditional constraints and the data sample set of the log template.

[0099] In an exemplary embodiment of the present disclosure, it also includes: an identification module 804, which is configured to input the log template to be identified into a trained recognition model to determine a first type of vector corresponding to the recognizable entry output by the recognition model; and / or, input the unrecognizable entry output by the recognition model into a neural network model for regression calculation; determine the second type of vector corresponding to the unrecognizable entry based on the regression calculation result of the neural network model; determine the vector corresponding to the log template to be identified based on the first type of vector and / or the second type of vector, wherein the dimension of the recognition result of the neural network model is the same as the dimension of the entry that has been calculated by the recognition model.

[0100] In an exemplary embodiment of the present disclosure, the identification module 804 is further configured to: perform weighted averaging on the vectors corresponding to the log template; determine the vector representation of the log template based on the calculation result of the weighted average; and determine the classification type of the log template based on the vector representation.

[0101] In an exemplary embodiment of the present disclosure, the recognition module 804 is further configured to: input the manually annotated log template into a trained recognition model, and generate the vector space according to the output result of the recognition model, wherein the vector space includes the classification type and corresponding vector representation of the manually annotated log template.

[0102] In an exemplary embodiment of the present disclosure, the training module 802 is further configured to: determine that the expression of the synonym condition constraint is: And / or the expression for determining the synonym condition constraint is: The expression of the synonym condition constraint and the expression of the antonym condition constraint are added to the loss function, wherein w represents the terms in the data sample set of the recognition model, S(w) represents the synonym vocabulary of w, u represents the synonyms in the synonym vocabulary, A(w) represents the antonym vocabulary of w, v represents the antonyms in the antonym vocabulary, c represents the terms other than w in the data sample set, W(c) represents the vocabulary corresponding to the terms whose probability of appearing simultaneously with c is higher than a preset probability, #(w,v) represents the number of occurrences of w and v, and sim(w,v) represents the cosine similarity between w and v.

[0103] In an exemplary embodiment of the present disclosure, the training module 802 is further configured to: determine the expression of the loss function as: ∑ w∈V ∑ c∈V{#(w,c)logσ(sim(w,c))+k#(w)P0(c)logσ(-sim(w,c)_};According to the expression of the synonym condition constraint, the expression of the antonym condition constraint and the expression of the loss function, the expression of the loss function after adding the constraint is determined as follows: Among them, the L represents the loss function after adding constraints, the P0(c) represents the probability of occurrence of c in the data sample set, the k represents a preset constant coefficient, the σ represents the sigmoid function, and the V represents the data sample set.

[0104] In an exemplary embodiment of the present disclosure, the training module 802 is further configured to: determine a label corresponding to the data sample set; and train the recognition model and the neural network model based on the label and the data sample set.

[0105] Since the functions of the log template recognition device 800 have been described in detail in the corresponding method embodiments, the present disclosure will not elaborate on them here.

[0106] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0107] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0108] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0109] Refer to the following Fig. 9 An electronic device 900 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 900 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0110] like Fig. 9As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0111] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can perform the method shown in the embodiment of the present disclosure.

[0112] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0113] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0114] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0115] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or may communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0116] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0117] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0118] The program product for implementing the above method according to an embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0119] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0120] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0121] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0122] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0123] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0124] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A log template recognition method, characterized in that: include: Add synonym and antonym constraints to the loss function of the recognition model corresponding to the log template to be recognized, including: The expression for determining the synonym condition constraint is: And / or the expression for determining the antonym conditional constraint is: The expression of the synonym condition constraint and the expression of the antonym condition constraint are added to the loss function, wherein w represents the terms in the data sample set of the recognition model, S(w) represents the synonym word library of w, u represents the synonyms in the synonym word library, A(w) represents the antonym word library of w, v represents the antonyms in the antonym word library, c represents the terms other than w in the data sample set, W(c) represents the word library corresponding to the terms whose probability of co-occurrence with c is higher than a preset probability, #(w,v) represents the number of occurrences of w and v, sim(w,v) represents the cosine similarity between w and v, #(w,u) represents the number of occurrences of w and u, and sim(w,u) represents the cosine similarity between w and u; The recognition model is trained based on the loss function with added conditional constraints and the data sample set of the log template.

2. The log template recognition method according to claim 1, characterized in that: Also includes: Inputting the log template to be identified into the trained recognition model to determine the first type of vector corresponding to the recognizable term output by the recognition model; and / or, inputting the unrecognizable terms output by the recognition model into a neural network model for regression calculation; Determining a second type of vector corresponding to the unrecognizable term according to a regression calculation result of the neural network model; Determine the vector corresponding to the log template to be identified according to the first type of vectors and / or the second type of vectors, The dimension of the recognition result of the neural network model is the same as the dimension of the entry calculated by the recognition model.

3. The log template recognition method according to claim 2, characterized in that: Also includes: Performing weighted averaging on the vectors corresponding to the log template; Determining a vector representation of the log template according to a calculation result of the weighted average; The classification type of the log template is determined based on the vector representation and a preset vector space.

4. The log template recognition method according to claim 3, characterized in that: Also includes: The manually annotated log template is input into a trained recognition model, and the vector space is generated according to an output result of the recognition model, wherein the vector space includes the classification type and the corresponding vector representation of the manually annotated log template.

5. The log template recognition method according to claim 1, characterized in that: Adding the synonym condition constraint expression and the antonym condition constraint expression to the loss function includes: The expression for determining the loss function is: According to the expression of the synonym condition constraint, the expression of the antonym condition constraint and the expression of the loss function, the expression of the loss function after adding constraints is determined as follows: Among them, the L represents the loss function after adding constraints, the P0(c) represents the probability of occurrence of the c in the data sample set, the k represents the preset constant coefficient, the σ represents the sigmoid function, the V represents the data sample set, the #(w) represents the number of occurrences of the w, the #(w,c) represents the number of occurrences of the w and the c, the #(w,v) represents the number of occurrences of the w and the v, and the sim(w,c) represents the cosine similarity between the w and the c.

6. The log template recognition method according to claim 2, characterized in that: Training the recognition model using the expanded data sample set includes: Determine a label corresponding to the data sample set; The recognition model and the neural network model are trained based on the label and the data sample set.

7. A log template recognition device, characterized in that: include: The training module is configured to add synonym condition constraints and antonym condition constraints to the loss function of the recognition model corresponding to the log template to be recognized, including: The expression for determining the synonym condition constraint is: And / or the expression for determining the antonym conditional constraint is: The expression of the synonym condition constraint and the expression of the antonym condition constraint are added to the loss function, wherein w represents the terms in the data sample set of the recognition model, S(w) represents the synonym word library of w, u represents the synonyms in the synonym word library, A(w) represents the antonym word library of w, v represents the antonyms in the antonym word library, c represents the terms other than w in the data sample set, W(c) represents the word library corresponding to the terms whose probability of co-occurrence with c is higher than a preset probability, #(w,v) represents the number of occurrences of w and v, sim(w,v) represents the cosine similarity between w and v, #(w,u) represents the number of occurrences of w and u, and sim(w,u) represents the cosine similarity between w and u; The training module is configured to train the recognition model based on the loss function after adding conditional constraints and the data sample set of the log template.

8. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, wherein the processor is configured to execute the log template recognition method according to any one of claims 1 to 6 based on instructions stored in the memory.

9. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method for recognizing a log template according to any one of claims 1 to 6 is implemented.

Images