A log detection method and device, electronic equipment and medium

Abstract

Embodiments of the present application disclose a log detection method and device, electronic equipment and medium. The method comprises: extracting a text semantic feature of a sample log to obtain an initial embedding representation of the sample log; extracting a time sequence feature of a sample log sequence comprising at least two sample logs according to the initial embedding representation to obtain an aggregated embedding representation of the sample log sequence; performing feature fusion on the aggregated embedding representations of the at least two sample log sequences, and determining a predicted type of the sample log according to the aggregated embedding representation after feature fusion; determining a loss function according to the predicted type and a labeled type of the sample log, and performing model training based on the loss function to obtain a log detection model, so as to detect a log to be detected according to the log detection model. The technical solution captures more comprehensive and deeper features of log data, and realizes more accurate log anomaly detection.

Description

Technical Field

[0001] This application relates to the field of log detection technology, and in particular to a log detection method, apparatus, electronic device and medium. Background Technology

[0002] In practical operation and maintenance work, logs serve as crucial information recording system operational status, thus requiring meticulous attention to their content. Logs are characterized by their diverse types, complex structures, and large quantities; therefore, quickly locating and categorizing problematic logs is a worthwhile research topic. Rapid and accurate identification of abnormal logs helps shorten troubleshooting and operational analysis time, reduce labor costs, and improve work efficiency.

[0003] Existing log anomaly detection methods are limited by the model feature representation and cannot comprehensively detect abnormal logs, which affects the final anomaly detection results. Summary of the Invention

[0004] This application provides a log detection method, apparatus, electronic device, and medium that can solve the problem of poor accuracy in abnormal log detection.

[0005] According to one aspect of this application, a log detection method is provided, the method comprising:

[0006] Extract the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs;

[0007] Based on the initial embedding representation, the temporal features of a sample log sequence including at least two sample logs are extracted to obtain the aggregated embedding representation of the sample log sequence;

[0008] Feature fusion is performed on the aggregated embedding representations of at least two sample log sequences, and the prediction type of the sample log is determined based on the aggregated embedding representation after feature fusion.

[0009] The loss function is determined based on the prediction type and labeling type of the sample logs. A log detection model is then trained based on the loss function to obtain the log detection model, which is used to detect the logs to be detected.

[0010] According to another aspect of this application, a log detection device is provided, comprising:

[0011] The embedding representation acquisition module is used to extract the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs;

[0012] An aggregation embedding representation module is used to extract temporal features of a sample log sequence including at least two sample logs based on the initial embedding representation, and obtain an aggregation embedding representation of the sample log sequence.

[0013] A type determination module is used to perform feature fusion on the aggregated embedding representations of at least two sample log sequences, and determine the predicted type of the sample log based on the aggregated embedding representation after feature fusion.

[0014] The log detection module is used to determine a loss function based on the prediction type and labeling type of the sample logs, train a model based on the loss function to obtain a log detection model, and then detect the logs to be detected according to the log detection model.

[0015] According to another aspect of this application, a log detection electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the log detection method described in any embodiment of this application.

[0019] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the log detection method described in any embodiment of this application.

[0020] The technical solution of this application extracts textual semantic features from the word vector matrix of sample logs and performs initial embedding representation of the logs by capturing the local contextual relationships of the text. Based on the temporal features of at least two sample logs and the initial embedding representation, an aggregated embedding representation of the sample log sequence is formed through an aggregation operation. The aggregated embedding representations of at least two sample log sequences are then fused to determine the predicted type of the sample logs. A log detection model is then used to detect the logs to be detected, thus completing the prediction of the logs to be detected. This technical solution achieves more accurate log anomaly detection by capturing log data to generate more comprehensive and deeper features.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a log detection method provided according to Embodiment 1 of this application;

[0024] Figure 2 This is a flowchart of a log detection method according to Embodiment 2 of this application;

[0025] Figure 3 This is a structural diagram of a specific implementation provided by an embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of a log detection device according to Embodiment 3 of this application;

[0027] Figure 5 This is a schematic diagram of the structure of an electronic device that implements a log detection method according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1This is a flowchart of a log detection method provided in Embodiment 1 of this application. This embodiment is applicable to identifying abnormal logs among a large number of logs. The method can be executed by a log detection device, which can be implemented in hardware and / or software and can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0032] S110. Extract the textual semantic features of the sample logs to obtain the initial embedded representation of the sample logs.

[0033] Among these, sample logs can be used to record execution information such as the status generated by the entity executing the task; for example, sample logs can be information representing the system's operating status. Text semantic features can be feature information extracted from text data using a text semantic feature extraction model. The initial embedding representation can be an operation that defines a representation method to represent one feature vector and maps it to another feature vector.

[0034] Optionally, based on the text-vector correspondence obtained through pre-training, the log vector corresponding to the text of the sample log is determined; the log vector is then input into a convolutional neural network to extract the text semantic features of the sample log, thereby obtaining the initial embedding representation of the sample log. The method for determining the text-vector correspondence obtained through pre-training includes: pre-training sample logs of unknown labeling types using a BERT model to determine the text-vector correspondence of sample logs of unknown labeling types.

[0035] The BERT (Bidirectional Encoder Representation from Transformers) model is a model that extracts word vectors by simultaneously considering the context of a word.

[0036] Specifically, the BERT model is used to pre-train on sample logs of unknown label types to obtain vectors corresponding to the text in the sample logs, generating a correspondence between text and vectors. Since unlabeled sample logs are unlabeled, all generated logs can be used as sample logs for pre-training, enriching the number of samples and improving the accuracy of pre-training, thus accurately determining the correspondence between text and vectors.

[0037] Specifically, for the sample logs, based on the correspondence between text and vectors obtained through pre-training, the log vectors corresponding to the text in the sample logs are determined. A fully connected neural network can be used to fine-tune the initial word vectors and perform padding operations on the log vectors to expand their boundary range, facilitating subsequent convolution operations. The log vectors are then input into a convolutional neural network to extract the textual semantic features of the sample logs, obtaining the initial embedding representation of the sample logs.

[0038] For example, a BERT model is trained using a large number of sample logs with unknown annotation types, generating numerous correspondence tables between words and word vectors. For example, based on the time point of the annotated sample logs, sample log sequences of different time scales are extracted, such as one minute, one hour, and one day prior to the current annotated sample log time point. The extraction duration of each sample log sequence can be determined according to actual conditions and is not limited here. For each sample log sequence, each log text is converted into a word vector according to the correspondence table, and the word vectors are arranged into a matrix, i.e., a word vector matrix. The word vector matrix is ​​input into the input layer, hidden layer, and output layer of a fully connected neural network for adjustment, and padding is applied to make the word vector matrix have a dimension of d. The word vector matrix is ​​then input into a convolutional neural network with multi-channel convolutional kernels of different dimensions to calculate and capture the relationships of local textual context. Pooling is performed on the word vector matrix processed by each convolutional kernel, and the pooling results are concatenated to obtain the most important features in the text. The concatenated vector is then transformed into the same dimension as the word vector matrix by a fully connected neural network, thus obtaining the initial embedding representation of each log text.

[0039] S120. Based on the initial embedding representation, extract the temporal features of the sample log sequence including at least two sample logs to obtain the aggregated embedding representation of the sample log sequence.

[0040] Among them, temporal features can be the correlation features between various sample logs that have temporal continuity in the sample log sequence. Aggregation embedding representation can be achieved by embedding key information through data recombination, fusion and other operations. Key information can be information that affects the type classification of the text to be detected.

[0041] For example, since each sample log sequence consists of sample logs from a certain period of time, the temporal features of the sample log sequence can be extracted to obtain the correlation characteristics of the sample log sequence in the time dimension. For each sample log sequence, the temporal features of at least two sample logs contained therein are extracted and aggregated to obtain the aggregated embedding representation of each sample log sequence.

[0042] S130. Perform feature fusion on the aggregated embedding representations of at least two sample log sequences, and determine the prediction type of the sample logs based on the aggregated embedding representations after feature fusion.

[0043] Feature fusion can involve summing and concatenating data from different dimensions to unify them into a single dimension. Prediction type can be the result obtained by classifying the current sample data using a model or algorithm.

[0044] Specifically, the aggregated embedding representation of each sample log sequence is fused with features, and the prediction type is determined for the fused aggregated embedding representation.

[0045] S140. Determine the loss function based on the prediction type and labeling type of the sample logs, train the model based on the loss function to obtain a log detection model, and detect the logs to be detected according to the log detection model.

[0046] The loss function, in this context, can be a computational function used to measure the difference between the model's predicted values ​​and the actual values. It is a non-negative real-valued function; the smaller the loss function, the better the model's robustness. A log detection model can be used to detect whether log data is an anomalous or normal log sequence.

[0047] Specifically, the loss function is determined based on the prediction and labeling types of the sample logs. The loss function can be the cross-entropy loss function. The loss function compares the classification results with the true results to calculate the difference. Backpropagation optimizes the model parameters to reduce the difference until the difference value stabilizes, at which point model training is complete, generating a log detection model. The logs to be detected are then predicted using the log detection model, completing the log detection process.

[0048] In this embodiment, semantic features of the text are extracted from the word vector matrix of the sample logs, and an initial embedding representation of the logs is formed by capturing the local contextual relationships of the text. An aggregated embedding representation of the sample log sequence is formed by combining the temporal features of at least two sample logs and the initial embedding representation. The aggregated embedding representations of the at least two sample log sequences are then fused to determine the predicted type of the sample logs. The log detection model is then used to detect the logs to be detected, thus completing the prediction of the logs to be detected. This technical solution achieves more accurate log anomaly detection by capturing log data to generate more comprehensive and deeper features.

[0049] Example 2

[0050] Figure 2 This is a flowchart of a log detection method provided in Embodiment 2 of this application. This embodiment is an optimization based on the above embodiment. Figure 2 As shown, the method in this embodiment specifically includes the following steps:

[0051] S210. Extract the textual semantic features of the sample logs to obtain the initial embedded representation of the sample logs.

[0052] Specifically, based on the correspondence between text and vector, the log vector corresponding to the sample log is determined, and the log vector is input into a convolutional neural network to extract the textual semantic features of the sample log, thereby obtaining the initial embedding representation of the sample log.

[0053] S220. According to the time order of at least two sample logs, input the initial embedding representations of at least two sample logs into the Transformer model to determine the associated embedding representation of the fused temporal features.

[0054] For example, using the time point of the labeled sample logs as a baseline, sample log sequences of different time magnitudes are extracted backwards, such as sample log sequences from one minute, one hour, and one day prior to the current labeled sample log time point. The extraction duration of each sample log sequence can be determined based on actual circumstances and is not limited here. For each sample log sequence, the initial embedding representation of each sample log is determined. For each sample log sequence, according to the chronological order of each sample log, the initial embedding representation of each sample log is input into the Transformer model; that is, the sample logs from earlier times are input into the Transformer model first, and the sample logs from later times are input later, to determine the associated embedding representation that fuses the temporal features.

[0055] S230. Aggregate the associated embedding representations of at least two sample logs to obtain the aggregated embedding representation.

[0056] For example, for each sample log sequence, the associated embedding representations of each sample log contained therein are aggregated to obtain an aggregated embedding representation.

[0057] As an optional but not limited implementation, the aggregation of the associated embedding representations of at least two sample logs to obtain the aggregated embedding representation includes steps A1-A2:

[0058] Step A1: Aggregate the associated embedding representations of at least two sample logs through a max pooling layer and / or an average pooling layer to obtain a merged embedding representation;

[0059] Specifically, max pooling and / or average pooling layers are used to aggregate the associated embedding representations to obtain the merged embedding representation for each sample log sequence.

[0060] Step A2: Aggregate the association embedding representation of the suspicious logs in at least two sample logs with the merged embedding representation to obtain the aggregated embedding representation; wherein, the suspicious log is the sample log with the largest distance from the cluster center after clustering at least two sample logs.

[0061] Specifically, clustering is performed on the sample logs to obtain clusters. The distance between each sample log and the center of its respective cluster is calculated, and the sample log with the largest distance from the cluster center is identified as a suspicious log. The association embedding representation of the suspicious log is aggregated with its merged inclusion representation to obtain an aggregated embedding representation.

[0062] In this embodiment, the beneficial effect of aggregating the association embedding representation of suspicious logs with their merged inclusion representation is that, since the merged embedding representation is obtained through max pooling and / or average pooling, features may be weakened by fusion. Suspicious logs are sample logs farthest from the cluster center, and their features are more prominent, making them potentially abnormal logs. Therefore, aggregating the association embedding representation of suspicious logs with their merged inclusion representation can highlight the features of abnormal logs, thereby improving the accuracy of abnormal log detection.

[0063] S240. Based on the attention mechanism, perform feature fusion on the aggregated embedding feature representations of at least two sample log sequences, and input the aggregated embedding representation after feature fusion into a multilayer perceptron to determine the prediction type of the sample logs.

[0064] Specifically, an attention mechanism assigns attention weights to the aggregated embedding features of at least two sample log sequences, achieving feature fusion. The fused adaptive sample log sequence is then input into a multilayer perceptron and a softmax classification function to predict the log type.

[0065] Optionally, the method for determining the sample log sequence includes: determining sample logs with known annotation types, and determining the sample logs within a preset time period prior to the sample logs, together with the sample logs with known annotation types, as a sample log sequence; wherein, the same sample log corresponds to at least two sample log sequences, and the preset time periods corresponding to at least two sample log sequences are different.

[0066] Specifically, based on the time point of the labeled sample logs, sample log sequences of different time magnitudes are extracted backwards. The number of sample log sequences extracted and the time length covered by each sample log sequence can be adaptively selected without limitation. For example, sample log sequences from one minute, one hour, and one day prior to the current labeled sample log time point can be extracted. Furthermore, each sample log contains at least two sample log sequences from different preset time points.

[0067] S250. Determine the loss function based on the prediction type and labeling type of the sample logs, train the model based on the loss function to obtain a log detection model, and detect the logs to be detected according to the log detection model.

[0068] Specifically, the loss function is determined based on the prediction type and annotation type of the sample logs, and the log detection model is trained using the sample log sequences. The logs to be detected are then predicted by the log detection model to complete the log detection.

[0069] In this embodiment, a convolutional neural network extracts textual semantic features from a word vector matrix transformed from log vectors, and uses the local contextual relationships captured by the convolutional neural network to create an initial embedding representation of the logs. A Transformer model is used to obtain temporal features, resulting in an associated embedding representation that fuses these temporal features. The associated embedding representations of each sample log in the sample log sequence are then aggregated to form an aggregated embedding representation of the sample log sequence. The aggregated embedding representations of at least two sample log sequences are then fused to determine the prediction type of the sample log. The selection process for the sample log sequence is refined. This technical solution achieves more accurate log anomaly detection by capturing more comprehensive and deeper features of log data.

[0070] Figure 3 A schematic diagram of a specific implementation method that can be used to carry out embodiments of the present invention is shown. It includes: M n H n D nThese represent sample log sequences of different durations, such as log sequences from one minute, one hour, and one day prior to the current labeled log sequence time point. The embedding operation transforms each sample log sequence into a vector matrix. A CNN operation is performed on each sample log sequence using three-dimensional convolutional kernels: (3*d), (4*d), and (5*d). The results from each convolutional kernel are concatenated using a pooling layer (Top N Pooling) to obtain the most important features of each sample log sequence. The concatenation function Concat() and FNN then adjust the dimensions of the most important features in each sample log sequence, resulting in the initial embedding representation for each sample log. A Transformer is used to compute the log text embedding representation, which incorporates temporal features. Then, max pooling (Max) and average pooling (AVG) are used to aggregate the concatenated text vector features. Finally, this aggregated text vector feature is combined with the embedding representation of the sample log furthest from the cluster center in the cluster. The attention mechanism, with attention weights w, is used to fuse features from three different sample log sequences. The attention weights w include (α1, α2, α3). The feature representation of the fused log sequences is then fed into a multilayer perceptron and classified using softmax. A log detection model is trained using the cross-entropy loss function.

[0071] Example 3

[0072] Figure 4 This is a schematic diagram of a log detection device provided in Embodiment 4 of this application. This device can execute the log detection method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the method. Figure 4 As shown, the device includes:

[0073] The embedding representation acquisition module 310 is used to extract the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs.

[0074] The aggregation embedding representation module 320 is used to extract the temporal features of a sample log sequence including at least two sample logs based on the initial embedding representation, and obtain the aggregation embedding representation of the sample log sequence.

[0075] The type determination module 330 is used to perform feature fusion on the aggregated embedding representations of at least two sample log sequences, and determine the predicted type of the sample log based on the aggregated embedding representation after feature fusion.

[0076] The log detection module 340 is used to determine a loss function based on the prediction type and labeling type of the sample log, train a model based on the loss function to obtain a log detection model, and detect the log to be detected according to the log detection model.

[0077] In this embodiment of the application, the embedded representation acquisition module 310 includes:

[0078] The first determining unit is used to determine the log vector corresponding to the text of the sample log based on the correspondence between text and vector obtained from pre-training.

[0079] The second determining unit is used to input the log vector into a convolutional neural network, extract the textual semantic features of the sample log, and obtain the initial embedding representation of the sample log;

[0080] The third determining unit is used to pre-train sample logs of unknown labeled types based on the BERT model to determine the correspondence between text and vectors of sample logs of unknown labeled types.

[0081] In this embodiment of the application, the aggregation embedding representation module 320 includes:

[0082] The temporal feature fusion unit is used to input the initial embedding representations of at least two sample logs into the Transformer model according to the temporal order of at least two sample logs, and determine the associated embedding representation of the fused temporal features;

[0083] The embedding representation aggregation unit is used to aggregate the associated embedding representations of at least two sample logs to obtain an aggregated embedding representation.

[0084] In this embodiment of the application, the time-series feature fusion unit is specifically used for:

[0085] The associated embedding representations of at least two sample logs are aggregated using max pooling and / or average pooling layers to obtain a merged embedding representation;

[0086] The association embedding representation of the suspicious logs in at least two sample logs is aggregated with the merged embedding representation to obtain the aggregated embedding representation; wherein, the suspicious log is the sample log with the largest distance from the cluster center after clustering at least two sample logs.

[0087] In this embodiment of the application, the type determination module 330 includes:

[0088] The sample log type determination unit is used to perform feature fusion on the aggregated embedding feature representations of at least two sample log sequences based on an attention mechanism, and input the feature-fused aggregated embedding representation into a multilayer perceptron to determine the predicted type of the sample log. In this embodiment, the sample log type determination unit is specifically used for:

[0089] Identify sample logs with known annotation types, and combine them with sample logs within a preset time period prior to the identified sample logs to form a sample log sequence. Each sample log corresponds to at least two sample log sequences, and the preset time periods for each of the at least two sample log sequences are different.

[0090] The log detection device provided in this application embodiment can execute a log detection method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] Example 4

[0092] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of this application, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0093] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0094] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0095] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as log detection methods.

[0096] In some embodiments, the log detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the log detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the log detection method by any other suitable means (e.g., by means of firmware).

[0097] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0099] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0101] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0102] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0103] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0104] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A log detection method, characterized in that, The method includes: Extract the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs; Based on the initial embedding representation, the temporal features of a sample log sequence including at least two sample logs are extracted to obtain the aggregated embedding representation of the sample log sequence, wherein the sample log sequence includes at least two historical logs of different time magnitudes that are truncated backward from the time point of the sample log. Feature fusion is performed on the aggregated embedding representations of at least two sample log sequences, and the prediction type of the sample log is determined based on the aggregated embedding representation after feature fusion. The loss function is determined based on the prediction type and labeling type of the sample logs. A log detection model is then trained based on the loss function to obtain the log detection model, which is used to detect the logs to be detected. Based on the initial embedding representation, temporal features of a sample log sequence including at least two sample logs are extracted to obtain an aggregated embedding representation of the sample log sequence, including: According to the time order of at least two sample logs, the initial embedding representations of at least two sample logs are respectively input into the Transformer model to determine the associated embedding representation of the fused temporal features; Aggregate the associated embedding representations of at least two sample logs to obtain the aggregated embedding representation; Aggregate the associated embedding representations of at least two sample logs to obtain an aggregated embedding representation, including: The associated embedding representations of at least two sample logs are aggregated using max pooling and / or average pooling layers to obtain a merged embedding representation; The association embedding representation of the suspicious logs in at least two sample logs is aggregated with the merged embedding representation to obtain the aggregated embedding representation; wherein, the suspicious log is the sample log with the largest distance from the cluster center after clustering at least two sample logs.

2. The method according to claim 1, characterized in that, Extracting the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs includes: Based on the correspondence between text and vector obtained from pre-training, determine the log vector corresponding to the text of the sample log. The log vector is input into a convolutional neural network to extract the textual semantic features of the sample log, thereby obtaining the initial embedding representation of the sample log.

3. The method according to claim 1, characterized in that, The process involves feature fusion of the aggregated embedding representations of at least two sample log sequences, and determining the prediction type of the sample logs based on the feature-fused aggregated embedding representations, including: Based on the attention mechanism, feature fusion is performed on the aggregated embedding feature representations of at least two sample log sequences, and the aggregated embedding representation after feature fusion is input into a multilayer perceptron to determine the prediction type of the sample log.

4. The method according to claim 3, characterized in that, The methods for determining the sample log sequence include: Identify sample logs with known annotation types, and combine them with sample logs within a preset time period prior to the identified sample logs to form a sample log sequence. Each sample log corresponds to at least two sample log sequences, and the preset time periods for each of the at least two sample log sequences are different.

5. The method according to claim 1, characterized in that, The methods for determining the correspondence between text and vectors obtained from pre-training include: The BERT model is used to pre-train sample logs with unknown annotation types to determine the correspondence between text and vectors in sample logs with unknown annotation types.

6. A log detection device, characterized in that, The device includes: The embedding representation acquisition module is used to extract the textual semantic features of the sample logs to obtain the initial embedding representation of the sample logs; An aggregation embedding representation module is used to extract the temporal features of a sample log sequence including at least two sample logs based on the initial embedding representation, and obtain the aggregation embedding representation of the sample log sequence, wherein the sample log sequence includes at least two historical logs of different time magnitudes that are truncated backward from the time point of the sample logs. A type determination module is used to perform feature fusion on the aggregated embedding representations of at least two sample log sequences, and determine the predicted type of the sample log based on the aggregated embedding representation after feature fusion. The log detection module is used to determine a loss function based on the prediction type and labeling type of the sample logs, train a model based on the loss function to obtain a log detection model, and then detect the logs to be detected according to the log detection model. The aggregation embedding representation module includes: The temporal feature fusion unit is used to input the initial embedding representations of at least two sample logs into the Transformer model according to the temporal order of at least two sample logs, and determine the associated embedding representation of the fused temporal features; An embedding representation aggregation unit is used to aggregate the associated embedding representations of at least two sample logs to obtain an aggregated embedding representation; The embedded representation aggregation unit is specifically used for: The associated embedding representations of at least two sample logs are aggregated using max pooling and / or average pooling layers to obtain a merged embedding representation; The association embedding representation of the suspicious logs in at least two sample logs is aggregated with the merged embedding representation to obtain the aggregated embedding representation; wherein, the suspicious log is the sample log with the largest distance from the cluster center after clustering at least two sample logs.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log detection method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the log detection method according to any one of claims 1-5.

Images