Anomaly detection method for distributed systems based on log spatiotemporal feature analysis

Abstract

The present invention discloses a distributed system anomaly detection method based on log spatiotemporal feature analysis, extracting a number of original log sequences as training samples from the original logs collected during the historical operation of the distributed system, parsing the original log sequences to obtain log template sequences corresponding to the original log sequences, further processing the log templates in the log template sequences and performing semantic vectorization to obtain log template semantic vector sequences, constructing anomaly detection models, using training samples to train the anomaly detection models, and when anomaly detection is required for the distributed system, obtaining the log template semantic vector sequences of the time period to be detected, and inputting the training anomaly detection models to obtain anomaly detection results. The present invention improves the accuracy of anomaly detection by fully considering the temporal and spatial characteristics of logs, and ensures the security and reliability of the distributed system.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent device operation and maintenance, and more specifically, relates to a distributed system anomaly detection method based on log spatiotemporal feature analysis. Background Art

[0002] Modern large-scale distributed systems are becoming more and more complex as the scale and functionality of the systems grow. Anomaly detection has become an important part of ensuring the security and reliability of distributed systems. Logs describe the operating status of distributed systems and record the execution of each component in the system, such as remote procedure calls (RPCs) between service nodes of distributed systems, hardware failures, errors in process runtime, and changes in software configuration. Compared with the traditional method of judging the health of the system by monitoring system indicators, log-based anomaly detection has certain advantages. First, logs support more refined diagnostic techniques to locate error logs or events. Second, logs allow tracking program execution logic, capturing program execution and performance anomalies across components and services, and capturing anomaly details to locate anomalies. Therefore, analyzing system logs to detect failures generated in the operation of distributed systems is crucial to ensuring the security and reliability of distributed systems.

[0003] However, although most logs are written with log levels (e.g., "INFO", "WARNING", "ERROR"), these levels do not necessarily reflect the true operating status of the system. For example, the level of the four logs is "FATAL", that is, according to the traditional log level, these four logs are all at the serious level, but a careful analysis of these logs shows that only the first log caused a system error, and the rest of the logs all had errors but did not cause a system error. Therefore, most of the current research is based on anomaly detection based on the specific situation of the system described in the log event, rather than based on the log level. In a distributed system, a large number of remote procedure calls (RPCs) are generated between the service nodes of the distributed system. The system's log component records the methods and parameters called in the relevant operations and processes. These log data are generated between different servers and have obvious spatial characteristics. Similarly, since the logs of distributed systems are generated in chronological order, they record time information, such as timestamps, so these logs also have time characteristics. In recent years, with the rapid and successful development of machine learning and deep learning, it has become possible to maintain distributed systems with the assistance of machine learning or deep learning and ensure the stability of distributed systems. At present, there are some methods based on machine learning or deep learning that focus on the temporal characteristics of distributed system logs for anomaly detection, such as SVM, PCA, DeepLog, LogAnomaly, HitAnomaly, etc. There are also some methods that focus on the spatial characteristics of distributed systems, such as TextCNN, OASIS, etc.

[0004] When performing log anomaly detection, most of the above deep learning methods only focus on the time characteristics of distributed system logs or only focus on the spatial characteristics of distributed system logs. It is worth noting that modern large-scale distributed systems are becoming more and more complex, and the interactions between different service nodes will become more and more frequent, and the spatial characteristics of the logs they generate are becoming more and more significant. There are big problems with single methods that only consider the time or space characteristics of distributed systems. They cannot fully extract all the characteristics of modern large-scale distributed system logs, so the anomaly detection model cannot more clearly define the difference between abnormal logs and normal logs, making anomaly detection inefficient, thereby creating the risk of system errors or even downtime. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a distributed system anomaly detection method based on log temporal and spatial feature analysis, which fully considers the temporal and spatial characteristics of the log, improves the accuracy of anomaly detection, and ensures the security and reliability of the distributed system.

[0006] In order to achieve the above-mentioned object of the invention, the distributed system anomaly detection method based on log spatiotemporal feature analysis of the present invention comprises the following steps:

[0007] S1: Collect the original logs of the distributed system, including the timestamp, level, code location, and detailed information text of the distributed system operation process recorded in the log, and store the collected original logs;

[0008] S2: Extract several original log sequences from the historical operation process of the distributed system as training samples. Each original log sequence contains K consecutive original logs. The value of K is set according to actual needs. Label each original log sequence. If the original log sequence contains an abnormal situation, the label is 1, otherwise the label is 0.

[0009] S3: parse each original log in the original log sequence, remove the "timestamp", "level", and "code location" information in each original log, and match the IP address parameter in the detailed information with a wildcard <*> to obtain the log template corresponding to the original log, and then obtain the log template sequence corresponding to the original log sequence;

[0010] S4: For each log template sequence, replace the punctuation marks and wildcards in each log template with spaces, and then obtain the number of words in the log template as the log template length. When the log template length is less than the preset unified log template length N, the preset default string is used to fill the log template to the length N. When the log template length is greater than the preset unified log template length N, the last word is removed to shorten the log template length to N, otherwise no operation is performed;

[0011] S5: Semantic feature embedding and statistical feature embedding are combined to semantically vectorize the log template subsequence. The specific method is as follows:

[0012] The kth log template in the log template sequence is (a k,1 ,a k,2 ,…,a k,N ), a k,i represents the i-th word in the k-th log template, k = 1, 2, ..., K, i = 1, 2, ..., N; the words in the log template are embedded using the word2vec algorithm, denoted by e k,i For word a k,i The M-dimensional vector is obtained by word embedding; then the weight t of each word is obtained based on the TF-IDF method k,i :Statistical word a k,i Word frequency and tf in log template k,i and inverse document frequency idf k,i , calculate the weight t k,i =tf k,i ×idf k,i; According to the word embedding vector e k,i and weight t k,i , get the semantic vector v of the i-th word in the k-th log template k,i =e k,i ×t k,i , so that the semantic vector matrix of size N×M of the kth log template is V k :

[0013]

[0014] Then the semantic vectors of all log templates in the log template sequence are combined to form a log template semantic vector sequence F of size N×M×K:

[0015]

[0016] S6: Construct an anomaly detection module, including K feature extraction modules, K mask modules, 1 transformer network, 1 fully connected layer and 1 softmax layer, where:

[0017] The N feature extraction modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i )’s time characteristics T i , time feature T i The dimension is set to H×W×L, and then the time feature T i sent to the converter network;

[0018] The N masking modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i ) position characteristics s i , location features i The dimension is set to H, and then the position feature s i Fill with 0 to get the three-dimensional position feature S with dimension H×W×L i , and then the position feature S i sent to the converter network;

[0019] The converter network receives N time features T i and position feature S i , extract the spatiotemporal features X of the log template semantic vector sequence and send it to the fully connected layer;

[0020] The fully connected layer is used to integrate the received spatiotemporal features X, convert them into one-dimensional features and output them to the softmax layer;

[0021] The softmax layer is used to predict whether the original log sequence is abnormal based on the received features;

[0022] S7: taking the log template semantic vector sequence corresponding to the original log sequence as the training sample as input and the label corresponding to the original log sequence as the expected output, training the anomaly detection model constructed in step S6 to obtain a trained anomaly detection model;

[0023] S8: When it is necessary to perform anomaly detection on the distributed system, first extract K consecutive original logs from the time period to be detected to form an original log sequence to be detected, then use the method in step S3 to perform log parsing, use the method in step S4 to perform log template preprocessing, and use the method in step S5 to perform log template semantic vectorization to obtain a log template semantic vector sequence corresponding to the original log sequence to be detected, input it into the trained anomaly detection model, and obtain the anomaly detection result of the original log sequence to be detected.

[0024] Furthermore, in step S1, blockchain is used to store original logs. The specific method is: the collected original logs are sent to the blockchain storage client, the blockchain storage client hash-encodes the original logs and uploads them to the alliance chain node, and the alliance chain node stores the original logs in the key-value pair database on the service node.

[0025] Furthermore, the feature extraction module in step S6 includes two cascaded bidirectional long short-term memory networks, and the semantic vector sequence (v 1,i ,v 2,i ,…,v K,i ) corresponds to a neuron in the bidirectional long short-term memory network.

[0026] Furthermore, in step S6, the position feature s in the shielding module i The hth element s in i [h] is calculated as follows:

[0027]

[0028] in, Indicates rounding down.

[0029] The present invention is based on the distributed system anomaly detection method of log spatiotemporal feature analysis, extracts several original log sequences as training samples from the original logs collected during the historical operation of the distributed system, parses the original log sequence to obtain the log template sequence corresponding to the original log sequence, further processes the log template in the log template sequence and performs semantic vectorization to obtain the log template semantic vector sequence, constructs an anomaly detection model including N feature extraction modules, N masking modules, 1 converter network, 1 fully connected layer and 1 softmax layer, trains the anomaly detection model with the training samples, and when the distributed system needs to be detected, obtains the log template semantic vector sequence of the time period to be detected, and inputs the training anomaly detection model to obtain the anomaly detection result. The present invention improves the accuracy of anomaly detection by fully considering the time and space characteristics of the log, and ensures the security and reliability of the distributed system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of a specific implementation method of a distributed system anomaly detection method based on log spatiotemporal feature analysis of the present invention;

[0031] Figure 2 This is a log parsing example diagram in this embodiment;

[0032] Figure 3 It is a structural diagram of the anomaly detection model in this embodiment. DETAILED DESCRIPTION

[0033] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0034] Example

[0035] Figure 1 This is a flow chart of a specific implementation of the distributed system anomaly detection method based on log spatiotemporal feature analysis of the present invention. Figure 1 As shown, the specific steps of the distributed system anomaly detection method based on log spatiotemporal feature analysis of the present invention include:

[0036] S101: Collect distributed system logs:

[0037] Collect the original logs of the distributed system, including the log timestamp, level, code location, and detailed information text of the distributed system operation process recorded in the log, and store the collected original logs.

[0038] In this embodiment, in order to improve the security of original log storage, blockchain is used for original log storage. The specific method is as follows: the collected original logs are sent to the blockchain storage client, the blockchain storage client hashes the original logs and uploads them to the alliance chain node, and the alliance chain node stores the original logs in the key-value database on the service node. After the storage is successful, the node can also use its own private key to encrypt the log data and save the returned key to further improve security. When the original log is subsequently extracted, each service node uses the saved key to decrypt the original log stored in its key-value database, and then summarizes it to obtain the original log of the entire distributed system.

[0039] S102: Obtain training samples:

[0040] Several original log sequences are extracted from the original logs collected during the historical operation of the distributed system as training samples. Each original log sequence contains K consecutive original logs. The value of K is set according to actual needs. Each original log sequence is labeled. If the original log sequence contains an abnormal situation, the label is 1, otherwise the label is 0.

[0041] In practical applications, a sliding time window with a preset length of K can be used to divide the entire original log sequence into several log template subsequences according to a preset step size, and each log template subsequence is a training sample.

[0042] S103: Log analysis:

[0043] Each original log in the original log sequence is parsed separately, the "timestamp", "level", and "code location" information in each original log is removed, and the IP address parameter in the detailed information is matched with a wildcard <*> to obtain the log template corresponding to the original log, and then obtain the log template sequence corresponding to the original log sequence.

[0044] Figure 2 This is an example of log parsing in this embodiment. Figure 2As shown in the figure, the original log is parsed into a common log template and parameters according to its relevance. The log in the figure: "081109 203615148 INFO dfs.DataNode$PacketResponder:PacketResponder 1 for block blk_38865049064139660terminating" is parsed into the log template "PacketResponder<*>for block<*>terminating" and the parameter value "1,blk_38865049064139660", where the wildcard <*> is used to match the parameter. The log template simplifies the original log sequence, saves the key information of the original log sequence, removes redundant information, and expresses the original log sequence more concisely.

[0045] S104: Log template preprocessing:

[0046] Next, the log template sequence obtained by parsing in step S103 is preprocessed to remove redundant information in the log template and fill in shorter templates. The specific method is as follows:

[0047] For each log template sequence, replace the punctuation marks and wildcards in each log template with spaces, and then obtain the number of words in the log template as the log template length. When the log template length is less than the preset unified log template length N, use the preset default string ("PAD" in this embodiment) to fill the log template to the length N. When the log template length is greater than the preset unified log template length N, remove the last word to shorten the log template length to N, otherwise do nothing. Generally speaking, the log template length N should be set according to the maximum log template length that may appear in the distributed system, so as to retain the log template information to the maximum extent.

[0048] S105: Log template semantic vectorization:

[0049] In the present invention, in order to better extract the features of the log template, the semantic feature embedding and statistical feature embedding are combined to semantically vectorize the log template sequence. The specific method is as follows:

[0050] The kth log template in the log template sequence is (a k,1 ,a k,2 ,…,a k,N ), a k,i represents the i-th word in the k-th log template, k = 1, 2, ..., K, i = 1, 2, ..., N. The word2vec algorithm is used to embed the words in the log template, and e is recorded k,i For word a k,iThe M-dimensional vector is obtained by word embedding. Then the weight t of each word is obtained based on the TF-IDF method. k,i :Statistical word a k,i Word frequency and tf in log template k,i and inverse document frequency idf k,i , calculate the weight t k,i =tf k,i ×idf k,i . According to the word embedding vector e k,i and weight t k,i , get the semantic vector v of the i-th word in the k-th log template k,i =e k,i ×t k,i , so that the semantic vector matrix of size N×M of the kth log template is V k :

[0051]

[0052] Then the semantic vectors of all log templates in the log template sequence are combined to form a log template semantic vector sequence F of size N×M×K:

[0053]

[0054] S106: Build anomaly detection model:

[0055] Figure 3 It is a structural diagram of the anomaly detection model in the present invention. Figure 3 As shown, the anomaly detection model in the present invention includes N feature extraction modules, N mask modules, 1 transformer network, 1 fully connected layer and 1 softmax layer, wherein:

[0056] The N feature extraction modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i )’s time characteristics T i , time feature T i The dimension is set to H×W×L, which is set according to actual needs and can be achieved by setting the parameters of the feature extraction module, and then the time feature T i The feature extraction module in this embodiment includes two cascaded bidirectional long short-term memory networks (Bi-LSTM), a semantic vector sequence (v 1,i ,v 2,i ,…,v K,i) corresponds to a neuron in the bidirectional long short-term memory network. The bidirectional long short-term memory network divides the hidden neuron layer of the standard long short-term memory network (LSTM) into two directions: feedforward and feedback transmission, so as to capture sufficient temporal features of the input log template sequence in two directions, thereby making the obtained temporal features more accurate. The bidirectional long short-term memory network is a commonly used neural network structure, and its specific working principle and process will not be repeated here.

[0057] The N masking modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i ) position characteristics s i , location features i The dimension is set to H, and then the position feature s i Fill with 0 to get the three-dimensional position feature S with dimension H×W×L i , and then the position feature S i Sent to the converter network. Position characteristics i The hth element s in i [h] is calculated as follows:

[0058]

[0059] in, Indicates rounding down.

[0060] The converter network receives N time features T i and position feature S i , extract the spatiotemporal features X of the log template semantic vector sequence and send it to the fully connected layer. The converter network is an Encoder-Decoder model based on a multi-head attention mechanism, which can extract the spatiotemporal features X of the log template semantic vector sequence and send it to the fully connected layer. i and position feature S i Extract more semantic spatiotemporal features to improve the efficiency of anomaly detection. The transformer network is a commonly used deep learning model, and its specific working principle and process will not be described here.

[0061] The fully connected layer is used to integrate the received spatiotemporal features X, convert them into one-dimensional features and output them to the softmax layer.

[0062] The softmax layer is used to make predictions based on the received features to determine whether the original log sequence has an abnormality.

[0063] S107: Training anomaly detection model:

[0064] The log template semantic vector sequence corresponding to the original log sequence as the training sample is taken as input, and the label corresponding to the original log sequence is taken as the expected output, and the anomaly detection model constructed in step S106 is trained to obtain a trained anomaly detection model.

[0065] S108: Anomaly Detection:

[0066] When it is necessary to perform anomaly detection on a distributed system, first, K consecutive original logs are extracted from the time period to be detected to form an original log sequence to be detected, then the log is parsed using the method in step S103, the log template is preprocessed using the method in step S104, and the log template is semantically vectorized using the method in step S105 to obtain a log template semantic vector sequence corresponding to the original log sequence to be detected, which is input into the trained anomaly detection model to obtain anomaly detection results of the original log sequence to be detected.

[0067] In order to better illustrate the technical effect of the present invention, a specific example is used to experimentally verify the present invention. At the same time, three comparison methods are set up to compare with the technical effect of the present invention, and the three comparison methods are:

[0068] Comparison method 1: DeepLog method, a log anomaly detection method based on LSTM. The vectorization method is based on log template index. For details, see the document "Du M, Li F, Zheng G, et al. Deeplog: Anomaly detection and diagnosis from system logs through deep learning [C] / / Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017: 1285-1298.".

[0069] Comparison method 2: TextCNN method, a log anomaly detection method based on CNN. The vectorization method is based on log template index. For details, see the document "S. Lu, X. Wei, Y. Li, L. Wang, Detecting anomaly in big data system logs using convolutional neural network, in: 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data In telligence and Computing and Cyber ​​Science and Technology Congress (DASC / PiCom / DataCom / CyberSciTech), IEEE, 2018, pp. 151–158.".

[0070] Comparison method 3: LogAnomaly method, a log anomaly detection method based on bidirectional LSTM. The vectorization method is based on log template semantics. For details, see the document "Meng W, Liu Y, Zhu Y, et al. LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs[C] / / IJCAI.2019,19(7):4739-4745.".

[0071] The data sets used in this embodiment are open source HDFS data sets and data sets collected from self-built distributed systems. The production environment of the example used for verification in this embodiment is a distributed machine learning system developed based on the Flower framework, using a two-layer convolutional neural network (CNN) as the task model. Table 1 is a configuration list of the example production environment in this embodiment.

[0072]

[0073] Table 1

[0074] Table 2 is a data set information table in this embodiment.

[0075] Dataset Number of logs Number of abnormal logs Log Type HDFS 104816 1821 30 Collecting the dataset 102530 2512 70

[0076] Table 2

[0077] In this embodiment, the evaluation indicators of anomaly detection of the present invention and three comparative methods on the open source HDFS data set and the collected data set are statistically analyzed, and the evaluation indicators include three, namely, F1-Score (F1 score), Recall (recall rate), and Precision (precision rate). Table 3 is a performance comparison table of the present invention and three comparative methods on two data sets in this embodiment.

[0078]

[0079] Table 3

[0080] As shown in Table 3, the performance of the present invention on the HDFS data set is higher than that of the comparison method 3, which is also based on log template semantic modeling, and higher than the comparison methods 2 and 3 based on log template index, with an F1-Score of up to 98.04%. And the performance of the present invention on the collection data set is higher than that of the other three methods, with an F1-Score of up to 97.40%. After analysis, the reason why the performance of the present invention on the HDFS data set is higher than that of the comparison method 3 is that the present invention extracts the time and space characteristics of the log, and the reason why it is higher than that of the comparison methods 1 and 2 is that the present invention is vectorized based on the semantics of the log template. In contrast, the vectorization method based on the log template index adopted by the other two methods cannot obtain the log template semantic information, let alone extract the time characteristics or space characteristics of the log. In addition, the method of the present invention performs better than the other three methods on the collection data set because the method of the present invention also extracts the time characteristics and space characteristics of the distributed system log, thereby improving the accuracy of anomaly detection.

[0081] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A distributed system anomaly detection method based on log spatiotemporal feature analysis, characterized in that include: S1: Collect the original logs of the distributed system, including the timestamp, level, code location, and detailed information text of the distributed system operation process recorded in the log, and store the collected original logs; S2: Extract several original log sequences from the historical operation process of the distributed system as training samples. Each original log sequence contains K consecutive original logs. The value of K is set according to actual needs. Label each original log sequence. If the original log sequence contains an abnormal situation, the label is 1, otherwise the label is 0. S3: parse each original log in the original log sequence, remove the "timestamp", "level", and "code location" information in each original log, and match the IP address parameter in the detailed information with a wildcard <*> to obtain the log template corresponding to the original log, and then obtain the log template sequence corresponding to the original log sequence; S4: For each log template sequence, replace the punctuation marks and wildcards in each log template with spaces, and then obtain the number of words in the log template as the log template length. When the log template length is less than the preset unified log template length N, the preset default string is used to fill the log template to the length N. When the log template length is greater than the preset unified log template length N, the last word is removed to shorten the log template length to N, otherwise no operation is performed; S5: Semantic feature embedding and statistical feature embedding are combined to semantically vectorize the log template subsequence. The specific method is as follows: The kth log template in the log template sequence is (a k,1 ,a k,2 ,…,a k,N ), a k,i represents the i-th word in the k-th log template, k = 1, 2, ..., K, i = 1, 2, ..., N; the words in the log template are embedded using the word2vec algorithm, denoted by e k,i For word a k,i The M-dimensional vector is obtained by word embedding; then the weight t of each word is obtained based on the TF-IDF method k,i :Statistical word a k,i Word frequency and tf in log template k,i and inverse document frequency idf k,i , calculate the weight t k,i =tf k,i ×idf k,i ; According to the word embedding vector e k,i and weight t k,i , get the semantic vector v of the i-th word in the k-th log template k,i =e k,i ×t k,i , so that the semantic vector matrix of size N×M of the kth log template is V k : Then the semantic vectors of all log templates in the log template sequence are combined to form a log template semantic vector sequence F of size N×M×K: S6: Construct an anomaly detection module, including K feature extraction modules, K mask modules, 1 transformer network, 1 fully connected layer and 1 softmax layer, where: The N feature extraction modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i )’s time characteristics T i , time feature T i The dimension is set to H×W×L, and then the time feature T i sent to the converter network; The N masking modules respectively extract the semantic vector sequence corresponding to the nth word in the log template semantic vector sequence (v 1,i ,v 2,i ,…,v K,i ) position characteristics s i , location features i The dimension is set to H, and then the position feature s k Fill with 0 to get the three-dimensional position feature S with dimension H×W×L i , and then the position feature S i sent to the converter network; The converter network receives N time features T i and position feature S i , extract the spatiotemporal features X of the log template semantic vector sequence and send it to the fully connected layer; The fully connected layer is used to integrate the received spatiotemporal features X, convert them into one-dimensional features and output them to the softmax layer; The softmax layer is used to predict whether the original log sequence is abnormal based on the received features; S7: taking the log template semantic vector sequence corresponding to the original log sequence as the training sample as input and the label corresponding to the original log sequence as the expected output, training the anomaly detection model constructed in step S6 to obtain a trained anomaly detection model; S8: When it is necessary to perform anomaly detection on the distributed system, first extract K consecutive original logs from the time period to be detected to form an original log sequence to be detected, then use the method in step S3 to perform log parsing, use the method in step S4 to perform log template preprocessing, and use the method in step S5 to perform log template semantic vectorization to obtain a log template semantic vector sequence corresponding to the original log sequence to be detected, input it into the trained anomaly detection model, and obtain the anomaly detection result of the original log sequence to be detected.

2. The distributed system anomaly detection method according to claim 1, characterized in that: In step S1, blockchain is used to store original logs. The specific method is: the collected original logs are sent to the blockchain storage client, the blockchain storage client hashes the original logs and uploads them to the alliance chain node, and the alliance chain node stores the original logs in the key-value pair database on the service node.

3. The distributed system anomaly detection method according to claim 1, characterized in that: The feature extraction module in step S6 includes two cascaded bidirectional long short-term memory networks, a semantic vector sequence (v 1,i ,v 2,i ,…,v K,i ) corresponds to a neuron in the bidirectional long short-term memory network.

4. The distributed system anomaly detection method according to claim 1, characterized in that: In step S6, the position feature s in the shielding module i The hth element s in i [h] is calculated as follows: in, Indicates rounding down.

Images