A log classification method and device, electronic equipment and storage medium

Abstract

The application discloses a log classification method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining a log to be classified, extracting a log template corresponding to the log to be classified; determining a feature vector of the log template based on each word, the part of speech of each word and the word position in the log template; and performing classification processing on the feature vector based on a pre-trained log classification model to obtain a classification result of the log to be classified. The above technical solution considers the influence of the part of speech and the word position on log classification, adds the part of speech and the word position to the feature vector, maximally extracts log features, improves the accuracy of log classification, and performs classification processing on the feature vector by using the pre-trained log classification model to obtain a classification result, so that log classification can be performed on the feature to be classified in time, and the timeliness of log classification is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a log classification method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of internet and computer technology, personal computers and servers have become an indispensable part of individuals and businesses. Servers and computers often generate a large amount of log data during operation. This log data can be used to trace the root cause of problems and identify specific issues. To quickly find the root cause of problems, maintenance logs are categorized to facilitate later problem identification.

[0003] Currently, existing technologies classify and match log data based on manually written regular expressions or artificial intelligence methods. Manually written regular expression methods generally require a large number of operations and maintenance personnel to design rules for various types of logs so that logs of the same type are classified into the same category during regular expression matching. Furthermore, when new types of logs emerge, a large number of personnel are still needed to implement regular expression matching for the new types of logs. Artificial intelligence methods, on the other hand, classify logs through machine learning, deep learning, and reinforcement learning, which can greatly reduce the involvement of human rules.

[0004] However, regular expression matching methods require a large number of professionals, and manually writing rules often leads to oversights and errors. To achieve timely classification and improve the accuracy of classification results, human-written rules often have certain limitations. While artificial intelligence methods can greatly reduce the involvement of human rules, they require time for model training and inference. Complex models have high classification accuracy but require a lot of time for training and inference, while simple models require less time for training and inference but often have lower accuracy. It is impossible to simultaneously improve both accuracy and time, and thus has certain limitations, failing to improve training time, inference time, and accuracy at the same time. Summary of the Invention

[0005] This invention provides a log classification method, apparatus, electronic device, and storage medium to solve the problem that existing technologies cannot classify log data in a timely and accurate manner.

[0006] According to one aspect of the present invention, a log classification method is provided, characterized in that it includes:

[0007] Obtain the logs to be classified and extract the log templates corresponding to the logs to be classified.

[0008] The feature vector of the log template is determined based on each word in the log template, the part-of-speech of each word, and the word position.

[0009] The feature vector is classified based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0010] According to another aspect of the present invention, a log classification device is provided, characterized in that it comprises:

[0011] The log template extraction module is used to obtain logs to be classified and extract the log templates corresponding to the logs to be classified.

[0012] The feature vector determination module is used to determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position;

[0013] The log classification module is used to classify the feature vector based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log classification method according to any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the log classification method according to any embodiment of the present invention.

[0019] The technical solution of this invention involves acquiring logs to be classified and extracting the corresponding log templates; determining the feature vector of the log template based on each word, its part-of-speech, and its position; classifying the feature vector based on a pre-trained log classification model to obtain the classification result of the logs to be classified; considering the influence of part-of-speech and its position on log classification, adding part-of-speech and its position to the feature vector maximizes the extraction of log features, improving the accuracy of log classification; and by classifying the feature vector using a pre-trained log classification model to obtain the classification result, logs can be classified in a timely manner, improving the timeliness of log classification.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a log classification method provided in Embodiment 1 of the present invention;

[0023] Figure 2 This is an example diagram of the log template obtained by parsing the original logs provided in Embodiment 1 of the present invention;

[0024] Figure 3 This is a schematic diagram of the log classification model training process provided in Embodiment 2 of the present invention;

[0025] Figure 4 This is a schematic diagram of parameter adjustment for the initialized word vector conversion model and the initialized word position vector conversion model provided in Embodiment 2 of the present invention;

[0026] Figure 5 This is a schematic diagram of the structure of a log classification device provided in Embodiment 3 of the present invention;

[0027] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first loss item," "second loss item," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a log classification method provided in Embodiment 1 of the present invention. This embodiment is applicable to classifying log data generated by servers and computers during operation. The method can be executed by a log classification device, which can be implemented in hardware and / or software and can be configured in a server or computer. Figure 1 As shown, the method includes:

[0032] S110. Obtain the logs to be classified and extract the log templates corresponding to the logs to be classified.

[0033] The log to be classified is the raw log generated by the server or computer during operation. This raw log includes a variable portion and a fixed-format portion. The variable portion includes, but is not limited to, the response time and server IP address. The fixed-format portion is the main component of the log, such as the event type and event name, and represents the basic information of the raw log. The log template is the template obtained by removing the variable portion from the log to be classified. Specifically, the variable portion in the log to be classified can be replaced with characters to obtain the log template. For example, the variable portion can be replaced with "*". In this embodiment, the log to be classified is obtained, parsed according to the log template extraction algorithm, and the log template is extracted from the log to be classified. The log template extraction algorithm includes, but is not limited to, FT-Tree, and is not specified here.

[0034] For example, Figure 2 This is an example diagram of the log template obtained by parsing the original logs provided in Embodiment 1 of the present invention, as shown below. Figure 2As shown, by replacing the variable parts in each original log with "*", we obtain the same template used to represent a certain type of log. For example, the log templates extracted from the original logs Log1 and Log5 are both the log template Template1. The log template Template1 can be used as the log template for all logs of the same type as Log1 and Log5.

[0035] S120. Determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position.

[0036] Among them, part of speech refers to the part of speech of each English word in the log template. Specifically, part of speech includes, but is not limited to, verbs, nouns, adjectives, etc.; word position refers to the position of each English word in the log template.

[0037] Based on the above embodiments, optionally, determining the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position of each word includes: performing vector transformation on each word in the log template to obtain the word vector corresponding to the log template; determining the word position vector corresponding to the log template; determining the part-of-speech of each word in the log template, and determining the weight data corresponding to each word based on the part-of-speech; and determining the feature vector of the log template based on the word vector, the word position vector, and the weight data corresponding to each word.

[0038] Specifically, the word vectors in the log template can be transformed using a word vector transformation model to obtain the word vectors corresponding to the log template. The word vector transformation model includes, but is not limited to, one-hot encoding, singular value decomposition (SVD), word2vector decomposition, etc., and is not limited here.

[0039] In some embodiments, pre-trained word vectors can be used for initialization to accelerate the training process.

[0040] Specifically, the word positions corresponding to the log template can be vectorized using a word position vector transformation model to obtain the word position vector corresponding to the log template. This can be achieved by converting the log template to a preset character length, where blank spaces can be filled with "0". For example, the preset character length can be obtained based on the character count of historical log templates. For instance, the word positions are initialized using the `torch.nn.Embedding()` function to obtain a position encoding matrix, which is then updated as the word position vector transformation model is trained.

[0041] Specifically, part-of-speech tagging can be performed on each word in the log template using natural language processing methods to obtain the part-of-speech of each word in the log template, and weight data corresponding to each word can be set according to the part-of-speech of each word. Among them, natural language processing methods include, but are not limited to, Jieba, SnowNLP, THULAC, StanfordCoreNLP, Hanlp, NLTK, etc., and are not limited here.

[0042] In this embodiment, the feature vector of the log template is obtained by vector fusion based on word vectors, word position vectors, and the weight data corresponding to each word. It can be understood that this invention uses part-of-speech weights to characterize the importance of each word; the weight data corresponding to words with important parts of speech can be appropriately increased, while the weight data corresponding to words with relatively unimportant parts of speech can be decreased.

[0043] It should be noted that although the variable part has been removed from the log template, there are still some non-native English words and characters that are not very meaningful for log classification, as well as English words such as "a", "the", and "at" that have little or no practical meaning. These words and characters should also be removed. However, this invention sets weight data for the part of speech of each word in the log template (the weight data of non-native English words and characters, and English words that have little or no practical meaning can be adjusted to 0 or a very small value), without the need to build new matching rules, reducing the workload of operators and improving the efficiency of log classification.

[0044] Based on the above embodiments, optionally, determining the feature vector of the log template based on the word vector, word position vector and weight data corresponding to each word includes: obtaining an intermediate vector based on the word vector and the weight data corresponding to each word; and obtaining the feature vector of the log template based on the sum of the intermediate vector and the word position vector.

[0045] The intermediate vector refers to the word vector with part-of-speech tags. Specifically, the intermediate vector is obtained by multiplying the word vector with the corresponding weight data of each word. In this embodiment, the intermediate vector is obtained by multiplying the word vector with the corresponding weight data of each word, and then the intermediate vector is added to the word position vector to obtain the feature vector of the log template.

[0046] S130. The feature vector is classified based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0047] In this embodiment, the feature vector is classified according to a pre-trained log classification model to obtain the classification result of the log to be classified; wherein, the classification result may include normal logs and abnormal logs, or statistical logs, access logs and diagnostic logs, which are not limited here.

[0048] Based on the above embodiments, optionally, after extracting the log template corresponding to the log to be classified, the method further includes: matching the log template with the already classified template; if the matching is successful, determining the classification result of the log to be classified based on the classification result of the successfully matched already classified template.

[0049] In this embodiment, a classified template refers to a log template that has already been classified. Since a log template can represent a type of log, the classification result of a classified template can represent the classification result of any log that matches the classified template. In this embodiment, after extracting the log template corresponding to the log to be classified, the log template and the classified template can be matched. If a match is successful, it indicates that the classified template is the log template of the log to be classified, and the classification result of the classified template can be used as the classification result of the log to be classified. This embodiment avoids duplicate classification of the same type of log by matching log templates with classified templates, reducing resource consumption and improving both log classification efficiency and resource utilization.

[0050] The technical solution of this embodiment obtains logs to be classified and extracts the log templates corresponding to the logs to be classified; determines the feature vectors of the log templates based on each word, part-of-speech tag, and word position in the log templates; classifies the feature vectors based on a pre-trained log classification model to obtain the classification results of the logs to be classified; considering the influence of part-of-speech tag and word position on log classification, the part-of-speech tag and word position are added to the feature vectors to maximize the extraction of log features and improve the accuracy of log classification; and by classifying the feature vectors using a pre-trained log classification model to obtain the classification results, the logs to be classified can be classified in a timely manner, improving the timeliness of log classification.

[0051] Example 2

[0052] This embodiment provides a detailed explanation of the training process for the log classification model, based on the above embodiments. The method includes:

[0053] S210. Obtain the logs to be classified and extract the log templates corresponding to the logs to be classified.

[0054] S220. Determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position.

[0055] S230. The feature vector is classified based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0056] Based on the above embodiments, optionally, the training process of the log classification model includes: iteratively executing the following training process until the training termination condition is met, and determining the trained student model as the log classification model:

[0057] 1) Obtain sample logs and extract the sample log template from the sample logs;

[0058] 2) Determine the input information for the teacher model and student model based on the sample log template;

[0059] 3) Input the input information of the student model into the student model to obtain the training classification results under different temperature parameters; and input the input information of the teacher model into the teacher model to obtain the teacher classification results.

[0060] 4) Determine the loss function based on the teacher classification results, the training classification results, and the classification labels of the sample logs, and adjust the model parameters of the student model based on the loss function.

[0061] The training termination condition can be either reaching a preset iteration threshold or the loss no longer decreasing; this is not limited to either. In this embodiment, Figure 3 This is a schematic diagram of the log classification model training process provided in Embodiment 2 of the present invention. Figure 3 As shown, the knowledge distillation-based method trains a log classification model (i.e., a student model) using a pre-trained teacher model. Specifically, sample logs are acquired, and sample log templates are extracted. Based on these templates, the input information for both the teacher and student models is determined. The teacher model's input information is fed into the pre-trained teacher model to obtain the teacher classification result under a first temperature parameter. Similarly, the student model's input information is fed into the student model, and the student model is trained simultaneously under both the first and second temperature parameters to obtain training classification results under the first and second temperature parameters, respectively. Furthermore, based on the teacher classification result under the first temperature parameter, the training classification result under the first temperature parameter, the training classification result under the second temperature parameter, and the classification labels of the sample logs, a loss function is determined. The student model's parameters are then adjusted based on this loss function. Here, the teacher model is a pre-trained model; specifically, it can be a BERT model, without limitation. The student model is the model to be trained; specifically, it can be a TextCNN model, without limitation. The first temperature parameter is a high-temperature parameter, set by those skilled in the art according to training requirements, and it is greater than the second temperature parameter, which can be 1.

[0062] Understandably, log classification models trained using knowledge distillation methods can be further trained on the training data to fine-tune the log classification model.

[0063] Based on the above embodiments, optionally, the input information of the student model is determined based on each word in the sample log template, the part-of-speech tag of each word, and the word position; the input information of the teacher model is determined based on the input requirements of the teacher model.

[0064] In this embodiment, the input information of the student model is determined based on each word, part-of-speech tag, and word position in the sample log template. Specifically, it can be the feature vector of the sample log template determined based on each word, part-of-speech tag, and word position in the sample log template. The teacher model is a pre-trained model that has not been fine-tuned, and its input information depends on the input requirements of the teacher model. For example, taking the BERT model as an example, the feature input of the BERT model includes three types: token embeddings (vector representation of the word itself), segment embeddings (vector representation used to distinguish between two sentences), and position embeddings (word position information encoded into feature vectors).

[0065] It should be noted that if the already trained teacher model is fine-tuned, further training of the teacher model is required, which will affect the training speed of the log classification model. This invention uses the un-fine-tuned teacher model to directly train the log classification model using knowledge distillation, which saves training resources and improves the training speed of the log classification model. Furthermore, the log classification model trained based on the knowledge distillation method is a lightweight model, which is easy to store and deploy.

[0066] Based on the above embodiments, optionally, determining the loss function based on the teacher classification result, the training classification result, and the classification label of the sample log includes: determining a first loss term based on the teacher classification result and the training classification result under the first temperature parameter; determining a second loss term based on the classification label of the sample log and the training classification result under the second temperature parameter; and determining a loss function based on the first loss term and the second loss term.

[0067] In this embodiment, as Figure 3 As shown, the loss function is obtained by weighting the first loss term and the second loss term. Specifically, the first loss term is determined based on the teacher classification results and training classification results at the first temperature, and the second loss term is determined based on the classification labels of the sample logs and the training classification results under the second temperature parameter.

[0068] For example, the loss function L can be expressed as:

[0069] L=αLsoft +(1-α)L hard

[0070] Where L represents the loss function, α is the weight parameter, and L soft L represents the first loss term. hard This indicates the second loss item.

[0071] Optionally, during the training of the learning model, the method further includes: obtaining an initialized word vector conversion model and an initialized word position vector conversion model, wherein the word vector conversion model is used to perform word vector conversion on the input log template, and the word position vector conversion model is used to perform word position vector conversion on the input log template; during the training of the student model, the model parameters of the initialized word vector conversion model and the initialized word position vector conversion model are adjusted.

[0072] In this embodiment, Figure 4 This is a schematic diagram illustrating the parameter adjustment of the initialized word vector conversion model and the initialized word position vector conversion model provided in Embodiment 2 of the present invention, as shown below. Figure 4 As shown, an initialized word vector conversion model and an initialized word position vector conversion model are obtained. A sample log template is input into the initialized word vector conversion model, and word vector conversion is performed on the sample log template based on the initialized word vector conversion model to obtain sample word vectors. Similarly, the sample log template is input into the initialized word position vector conversion model, and word position vector conversion is performed on the sample log template based on the initialized word position vector conversion model to obtain sample word position vectors. These sample word vectors and sample word position vectors are used to determine the input information for the teacher model and the student model, and the subsequent log classification model is trained based on the input information of the teacher model and the student model. During the training of the student model (i.e., the log classification model), the model parameters of the initialized word vector conversion model and the initialized word position vector conversion model are adjusted according to the training of the log classification model to update the initialized word vector conversion model and the initialized word position vector conversion model.

[0073] The technical solution of this embodiment directly trains the log classification model with knowledge distillation using an unadjusted teacher model, resulting in a lightweight log classification model. This saves training resources while improving the training speed of the log classification model. At the same time, the lightweight log classification model is also easy to store and deploy.

[0074] Example 3

[0075] Figure 5 This is a schematic diagram of the structure of a log classification device provided in Embodiment 3 of the present invention. Figure 5 As shown, the device includes:

[0076] The log template extraction module 510 is used to obtain logs to be classified and extract the log templates corresponding to the logs to be classified.

[0077] The feature vector determination module 520 is used to determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position;

[0078] The log classification module 530 is used to classify the feature vector based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0079] The technical solution of this embodiment obtains logs to be classified and extracts the log templates corresponding to the logs to be classified; determines the feature vectors of the log templates based on each word, part-of-speech tag, and word position in the log templates; classifies the feature vectors based on a pre-trained log classification model to obtain the classification results of the logs to be classified; considering the influence of part-of-speech tag and word position on log classification, the part-of-speech tag and word position are added to the feature vectors to maximize the extraction of log features and improve the accuracy of log classification; and by classifying the feature vectors using a pre-trained log classification model to obtain the classification results, the logs to be classified can be classified in a timely manner, improving the timeliness of log classification.

[0080] Based on the above embodiments, optionally, the feature vector determination module 520 includes a word vector determination unit, a word position vector determination unit, a weight data determination unit, and a feature vector determination unit, wherein:

[0081] The word vector determination unit is used to perform vector transformation on each word in the log template to obtain the word vector corresponding to the log template;

[0082] The word position vector determination unit is used to determine the word position vector corresponding to the log template;

[0083] The weight data determination unit is used to determine the part-of-speech tag of each word in the log template, and to determine the weight data corresponding to each word based on the part-of-speech tag;

[0084] The feature vector determination unit is used to determine the feature vector of the log template based on the word vector, word position vector and weight data corresponding to each word.

[0085] Based on the above embodiments, optionally, the feature vector determination unit is specifically used to obtain an intermediate vector based on the word vector and the weight data corresponding to each word; and to obtain the feature vector of the log template based on the sum of the intermediate vector and the word position vector.

[0086] Based on the above embodiments, optionally, after extracting the log template corresponding to the log to be classified, the device further includes a classified template classification module, used to match the log template with the classified template; if the match is successful, the classification result of the log to be classified is determined based on the classification result of the successfully matched classified template.

[0087] Optionally, based on the above embodiments, the device further includes a log classification model training module for training the log classification model. The training process of the log classification model includes: iteratively executing the following training process until the training termination condition is met, and determining the trained student model as the log classification model: acquiring sample logs and extracting sample log templates from the sample logs; determining the input information of the teacher model and the student model based on the sample log templates; inputting the input information of the student model into the student model to obtain training classification results under different temperature parameters, and inputting the input information of the teacher model into the teacher model to obtain teacher classification results; determining a loss function based on the teacher classification results, the training classification results, and the classification labels of the sample logs, and adjusting the model parameters of the student model based on the loss function.

[0088] Based on the above embodiments, optionally, the input information of the student model is determined based on each word in the sample log template, the part-of-speech tag of each word, and the word position; the input information of the teacher model is determined based on the input requirements of the teacher model.

[0089] Based on the above embodiments, optionally, the log classification model training module includes a loss function determination unit, used to determine a first loss term based on the teacher classification result and the training classification result under the first temperature parameter; determine a second loss term based on the classification label of the sample log and the training classification result under the second temperature parameter; and determine a loss function based on the first loss term and the second loss term.

[0090] Based on the above embodiments, optionally, the device further includes a model parameter adjustment module, used to obtain an initialized word vector conversion model and an initialized word position vector conversion model, wherein the word vector conversion model is used to perform word vector conversion on the input log template, and the word position vector conversion model is used to perform word position vector conversion on the input log template; during the training process of the student model, the model parameters of the initialized word vector conversion model and the initialized word position vector conversion model are adjusted.

[0091] The log classification device provided in the embodiments of the present invention can execute the log classification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0092] Example 4

[0093] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0094] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0095] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0096] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as log classification methods.

[0097] In some embodiments, the log classification method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the log classification method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the log classification method by any other suitable means (e.g., by means of firmware).

[0098] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0099] Computer programs for implementing the log classification method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0100] Example 5

[0101] Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a log classification method, the method comprising:

[0102] Obtain the log to be classified, and extract the log template corresponding to the log to be classified; determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position; classify the feature vector based on a pre-trained log classification model to obtain the classification result of the log to be classified.

[0103] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0104] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0105] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0106] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0107] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0108] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A log classification method, characterized in that, include: Obtain the logs to be classified and extract the log templates corresponding to the logs to be classified. The feature vector of the log template is determined based on each word in the log template, the part-of-speech of each word, and the word position. The feature vector is classified based on a pre-trained log classification model to obtain the classification result of the log to be classified. The training process of the log classification model includes: The following training process is executed iteratively until the training termination condition is met, and the trained student model is then identified as the log classification model: Obtain sample logs and extract the sample log template from the sample logs; The input information for the teacher model and the student model is determined based on the sample log template. The input information of the student model is input into the student model to obtain training classification results under different temperature parameters; and the input information of the teacher model is input into the teacher model to obtain teacher classification results; wherein, the teacher model is a pre-trained BERT model that has not been fine-tuned, and the student model is a TextCNN model; The first loss term is determined based on the teacher classification results and the training classification results under the first temperature parameter. The second loss term is determined based on the classification labels of the sample logs and the training classification results under the second temperature parameter; The loss function is determined based on the first loss term and the second loss term; The model parameters of the student model are adjusted based on the loss function. The method further includes, after extracting the log template corresponding to the log to be classified, the following: Match the log template with the categorized templates; If a match is successful, the classification result of the log to be classified is determined based on the classification result of the successfully matched classified template.

2. The method according to claim 1, characterized in that, The step of determining the feature vector of the log template based on each word in the log template, the part-of-speech tag of each word, and the word position includes: Perform vector transformation on each word in the log template to obtain the word vector corresponding to the log template; Determine the word position vector corresponding to the log template; Determine the part-of-speech tag of each word in the log template, and determine the weight data corresponding to each word based on the part-of-speech tag; The feature vector of the log template is determined based on the word vector, word position vector, and weight data corresponding to each word.

3. The method according to claim 2, characterized in that, The step of determining the feature vector of the log template based on the word vector, word position vector, and weight data corresponding to each word includes: An intermediate vector is obtained based on the word vectors and the weight data corresponding to each word. The feature vector of the log template is obtained by summing the intermediate vector and the word position vector.

4. The method according to claim 1, characterized in that, The input information of the student model is determined based on each word in the sample log template, the part-of-speech tag of each word, and the word position. The input information for the teacher model is determined based on the input requirements of the teacher model.

5. The method according to claim 1, characterized in that, The method further includes: Obtain an initialized word vector conversion model and an initialized word position vector conversion model, wherein the word vector conversion model is used to perform word vector conversion on the input log template, and the word position vector conversion model is used to perform word position vector conversion on the input log template; During the training of the student model, the model parameters of the initialized word vector conversion model and the initialized word position vector conversion model are adjusted.

6. A log classification device, characterized in that, include: The log template extraction module is used to obtain logs to be classified and extract the log templates corresponding to the logs to be classified. The feature vector determination module is used to determine the feature vector of the log template based on each word in the log template, the part-of-speech of each word, and the word position; The log classification module is used to classify the feature vector based on a pre-trained log classification model to obtain the classification result of the log to be classified. The device further includes a log classification model training module for training the log classification model. The training process of the log classification model includes: iteratively executing the following training process until the training termination condition is met, and determining the trained student model as the log classification model: acquiring sample logs and extracting sample log templates from the sample logs; determining the input information of the teacher model and the student model based on the sample log templates; inputting the input information of the student model into the student model to obtain training classification results under different temperature parameters, and inputting the input information of the teacher model into the teacher model to obtain teacher classification results; wherein the teacher model is a pre-trained BERT model that has not been fine-tuned, and the student model is a TextCNN model; determining a loss function based on the teacher classification results, the training classification results, and the classification labels of the sample logs, and adjusting the model parameters of the student model based on the loss function; After extracting the log template corresponding to the log to be classified, the device further includes a classified template classification module, which is used to match the log template with the classified template; if the match is successful, the classification result of the log to be classified is determined based on the classification result of the successfully matched classified template. The log classification model training module includes a loss function determination unit, which is used to determine a first loss term based on the teacher classification result and the training classification result under the first temperature parameter; determine a second loss term based on the classification label of the sample log and the training classification result under the second temperature parameter; and determine a loss function based on the first loss term and the second loss term.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log classification method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the log classification method according to any one of claims 1-5.

Images