Log anomaly detection method, log anomaly detection model training method and device

Abstract

The present disclosure provides a log anomaly detection method, a training method and device of a log anomaly detection model, which can be applied to the field of computer technology. The log anomaly detection method comprises: in response to receiving a log anomaly detection instruction, processing original log sequences indicated by the log anomaly detection instruction to obtain a part-of-speech vector sequence, wherein the part-of-speech vector sequence comprises at least one part-of-speech vector corresponding to at least one original log; processing the part-of-speech vector sequence to obtain a part-of-speech weight vector sequence, wherein the part-of-speech weight vector sequence comprises a part-of-speech weight vector corresponding to each of the at least one original log; determining a weighted vector sequence according to the part-of-speech vector sequence and the part-of-speech weight vector sequence, wherein the weighted vector sequence comprises a weighted vector corresponding to each of the at least one original log; inputting the weighted vector sequence into a log anomaly detection model to obtain a log anomaly detection result corresponding to each of the at least one original log.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a log anomaly detection method, a training method and apparatus for a log anomaly detection model, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the development of computer technology, in order to ensure the safe operation of the system, logs can be analyzed and anomaly detection can be performed to promptly identify anomalies in the application system and the causes of these anomalies.

[0003] Logs can record information related to hardware, software, and system problems, and can also monitor events occurring in the system. Logs can include system logs, application logs, and security logs.

[0004] In realizing the concept disclosed herein, the inventors discovered at least the following problems in the related technologies: the efficiency and accuracy of log anomaly detection cannot be guaranteed. Summary of the Invention

[0005] In view of this, the present disclosure provides a log anomaly detection method, a log anomaly detection model training method and apparatus, an electronic device, a computer-readable storage medium, and a computer program product.

[0006] According to one aspect of this disclosure, a log anomaly detection method is provided, comprising:

[0007] In response to receiving a log anomaly detection instruction, the original log sequence indicated by the log anomaly detection instruction is processed to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least one original log, and the part-of-speech vector sequence includes at least one part-of-speech vector corresponding to each of the at least one original log.

[0008] The above part-of-speech vector sequence is processed to obtain a part-of-speech weight vector sequence, wherein the above part-of-speech weight vector sequence includes the part-of-speech weight vector corresponding to each of the above at least one original log;

[0009] Based on the aforementioned part-of-speech vector sequence and the aforementioned part-of-speech weight vector sequence, a weighted vector sequence is determined, wherein the aforementioned weighted vector sequence includes the weighted vector corresponding to each of the aforementioned at least one original log entry; and

[0010] Input the above weighted vector sequence into the log anomaly detection model to obtain the log anomaly detection results corresponding to each of the above at least one original log.

[0011] According to embodiments of this disclosure, the above-described processing of the part-of-speech vector sequence to obtain the part-of-speech weight vector sequence includes:

[0012] The above part-of-speech vector sequence is processed to obtain a first intermediate vector sequence, wherein the first intermediate vector sequence includes a first intermediate vector corresponding to each of the above at least one original log.

[0013] The first intermediate vector sequence is processed to obtain a second intermediate vector sequence, wherein the second intermediate vector sequence includes a second intermediate vector corresponding to each of the at least one original log entry; and

[0014] Based on the second intermediate vector sequence, the part-of-speech weight vector sequence is determined.

[0015] According to embodiments of this disclosure, the above-mentioned processing of the part-of-speech vector sequence to obtain the first intermediate vector sequence includes:

[0016] Call N of the M first search threads to process the above part-of-speech vector sequence in parallel, obtaining candidate first intermediate vector sequences corresponding to each of the N first search threads, where M is an integer greater than or equal to 2, N is a positive integer less than or equal to M; and

[0017] The first intermediate vector sequence is determined based on the candidate first intermediate vector sequences corresponding to each of the N first search threads.

[0018] According to embodiments of this disclosure, the above-mentioned invocation of N of the M first search threads to perform parallel processing on the part-of-speech vector sequence to obtain candidate first intermediate vector sequences corresponding to each of the N first search threads includes:

[0019] Determine the search range parameters and search step size parameters for each of the N first search threads; and

[0020] The above N first search threads are invoked, and the above part-of-speech vector sequences are processed in parallel according to the above search range parameters and above search step size parameters of the above N first search threads to obtain the candidate first intermediate vector sequences corresponding to the above N first search threads.

[0021] According to embodiments of this disclosure, the above-mentioned candidate first intermediate vector sequence includes candidate first intermediate vectors corresponding to each of the above-mentioned at least one original log.

[0022] According to embodiments of this disclosure, determining the first intermediate vector sequence based on the candidate first intermediate vector sequences corresponding to each of the N first search threads includes:

[0023] For each of the at least one original log entry mentioned above,

[0024] Based on the candidate first intermediate vector sequences corresponding to the aforementioned N first search threads, determine the N candidate first intermediate vectors corresponding to the aforementioned original log; and

[0025] Based on the N candidate first intermediate vectors corresponding to the original logs, determine the L first intermediate vectors corresponding to the original logs, where L is a positive integer and L is less than or equal to N.

[0026] According to embodiments of this disclosure, the above-described processing of the first intermediate vector sequence to obtain the second intermediate vector sequence includes:

[0027] Call Z of the Y second search threads to process the first intermediate vector corresponding to each of the above-mentioned at least one original log in parallel, to obtain the candidate second intermediate vector corresponding to each of the above-mentioned Z second search threads, where Y is an integer greater than or equal to 2, Z is a positive integer, and Z is less than or equal to Y; and

[0028] The sequence of second intermediate vectors is determined based on the candidate second intermediate vectors corresponding to the Z second search threads.

[0029] According to embodiments of this disclosure, the above-mentioned invocation of Z of the Y second search threads to perform parallel processing on the first intermediate vector corresponding to each of the at least one original log, to obtain the candidate second intermediate vector corresponding to each of the Z second search threads, includes:

[0030] Determine the target first intermediate vector from the first intermediate vectors corresponding to each of the above at least one original log;

[0031] Determine the target second search thread from the aforementioned Z second search threads; and

[0032] The second search thread for the target is invoked to process the first intermediate vector of the target, thereby obtaining the candidate second intermediate vector corresponding to the second search thread for the target.

[0033] According to embodiments of this disclosure, determining the second intermediate vector sequence based on the candidate second intermediate vectors corresponding to each of the Z second search threads includes:

[0034] If the aforementioned candidate second intermediate vector and the first intermediate vector corresponding to the aforementioned candidate second intermediate vector satisfy a preset condition, the aforementioned first intermediate vector in the aforementioned first intermediate vector sequence is replaced with the aforementioned candidate second intermediate vector; and

[0035] If neither the aforementioned candidate second intermediate vector nor the first intermediate vector corresponding to the aforementioned candidate second intermediate vector satisfies the preset conditions, the aforementioned first intermediate vector in the aforementioned first intermediate vector sequence is deleted.

[0036] According to embodiments of this disclosure, determining the part-of-speech weight vector sequence based on the second intermediate vector sequence includes:

[0037] For each of the at least one original log entry mentioned above,

[0038] Based on the second intermediate vector corresponding to the original log above, determine the target second intermediate vector; and

[0039] The aforementioned second intermediate vector of the target is determined as the part-of-speech weight vector corresponding to the aforementioned original log.

[0040] According to embodiments of this disclosure, the above-mentioned response to receiving a log anomaly detection instruction, processing the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech vector sequence includes:

[0041] For each of the aforementioned at least one original log entry, perform log template extraction processing to obtain a log template vector corresponding to each of the aforementioned at least one original log entry; and

[0042] Part-of-speech analysis is performed on the log template vectors corresponding to each of the above-mentioned at least one original log, to obtain the part-of-speech vectors corresponding to each of the above-mentioned at least one original log.

[0043] According to embodiments of this disclosure, determining the weighted vector sequence based on the part-of-speech vector sequence and the part-of-speech weight vector sequence includes:

[0044] For each of the at least one original log entry mentioned above,

[0045] Determine the part-of-speech vector and part-of-speech weight vector corresponding to the original logs; and

[0046] The part-of-speech vector corresponding to the original log and the part-of-speech weight vector corresponding to the original log are weighted to obtain the weighted vector corresponding to the original log.

[0047] According to one aspect of this disclosure, a method for training a log anomaly detection model is provided, comprising:

[0048] Obtain the original log sequence of the sample, wherein the original log sequence of the sample includes at least one original log of the sample, and each of the at least one original log of the sample has label information;

[0049] The above sample original log sequence is processed to obtain a sample part-of-speech vector sequence, wherein the above sample part-of-speech vector sequence includes sample part-of-speech vectors corresponding to each of the above at least one sample original log;

[0050] The above sample part-of-speech vector sequence is processed to obtain a sample part-of-speech weight vector sequence, wherein the above sample part-of-speech weight vector sequence includes the sample part-of-speech weight vector corresponding to each of the above at least one original sample log;

[0051] Based on the aforementioned sample part-of-speech vector sequence and the aforementioned sample part-of-speech weight vector sequence, a sample weighted vector sequence is determined, wherein the aforementioned sample weighted vector sequence includes the sample weighted vector corresponding to each of the aforementioned at least one original log sample; and

[0052] Using the above sample weighted vector sequence and the above label information, a deep learning model is trained to obtain a log anomaly detection model.

[0053] According to embodiments of this disclosure, the aforementioned at least one original sample log includes at least one original log of an abnormal sample and at least one original log of a normal sample, and the aforementioned tag information includes category tags.

[0054] According to embodiments of this disclosure, the above-mentioned method of training a deep learning model using the above-mentioned sample weighted vector sequence and the above-mentioned label information to obtain a log anomaly detection model includes:

[0055] Input the sample weighted vectors of the original logs of at least one abnormal sample and the original logs of at least one normal sample into the deep learning model to obtain the predicted category information of the original logs of at least one abnormal sample and the original logs of at least one normal sample.

[0056] Based on the predicted category information of each of the original logs of at least one abnormal sample and at least one normal sample, and the category labels of each of the original logs of at least one abnormal sample and at least one normal sample, the first loss function value is obtained; and

[0057] The model parameters of the deep learning model are adjusted based on the first loss function value until the predetermined termination condition is met, thus obtaining the log anomaly detection model.

[0058] According to embodiments of this disclosure, the aforementioned at least one original sample log includes at least one original log of an abnormal sample, and the aforementioned tag information includes an anomaly type tag.

[0059] According to embodiments of this disclosure, the above-mentioned method of training a deep learning model using the above-mentioned sample weighted vector sequence and the above-mentioned label information to obtain a log anomaly detection model includes:

[0060] Input the sample weighted vector of each of the original logs of the above-mentioned at least one abnormal sample into the above-mentioned deep learning model to obtain the predicted abnormality type information of each of the original logs of the above-mentioned at least one abnormal sample.

[0061] Based on the anomaly type label of each of the original logs of at least one of the aforementioned anomaly samples and the predicted anomaly type information of each of the original logs of at least one of the aforementioned anomaly samples, the second loss function value is obtained; and

[0062] The model parameters of the deep learning model are adjusted according to the second loss function value until the predetermined termination condition is met, thus obtaining the log anomaly detection model.

[0063] According to embodiments of this disclosure, the training method for the above-described log anomaly detection model further includes repeating the following operations until the performance test results of the above-described log anomaly detection model meet predetermined performance conditions:

[0064] The performance of the above log anomaly detection model was tested using a verification weighted vector sequence, and the above performance test results were obtained. The above verification weighted vector sequence includes verification sample weighted vectors corresponding to each of the above at least one original log sample, and each of the above at least one verification sample weighted vector has the above label information.

[0065] If the performance test results do not meet the predetermined performance conditions, the hyperparameters of the model corresponding to the log anomaly detection model will be adjusted; and

[0066] Based on the adjusted model hyperparameters, the deep learning model is retrained using the sample weighted vector sequence and the label information to obtain a new log anomaly detection model.

[0067] According to another aspect of this disclosure, a log anomaly detection apparatus is provided, comprising:

[0068] The first processing module is configured to, in response to receiving a log anomaly detection instruction, process the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least one original log, and the part-of-speech vector sequence includes at least one part-of-speech vector corresponding to each of the at least one original log.

[0069] The second processing module is used to process the above part-of-speech vector sequence to obtain a part-of-speech weight vector sequence, wherein the above part-of-speech weight vector sequence includes part-of-speech weight vectors corresponding to each of the above at least one original log.

[0070] The first determining module is configured to determine a weighted vector sequence based on the aforementioned part-of-speech vector sequence and the aforementioned part-of-speech weight vector sequence, wherein the aforementioned weighted vector sequence includes a weighted vector corresponding to each of the aforementioned at least one original log entry; and

[0071] The input module is used to input the above weighted vector sequence into the log anomaly detection model to obtain the log anomaly detection results corresponding to each of the above at least one original log.

[0072] According to another aspect of this disclosure, a training apparatus for a log anomaly detection model is provided, comprising:

[0073] The acquisition module is used to acquire the original log sequence of the sample, wherein the original log sequence of the sample includes at least one original log of the sample, and each of the at least one original log of the sample has label information;

[0074] The third processing module is used to process the above-mentioned sample original log sequence to obtain a sample part-of-speech vector sequence, wherein the above-mentioned sample part-of-speech vector sequence includes sample part-of-speech vectors corresponding to each of the above-mentioned at least one sample original log;

[0075] The fourth processing module is used to process the above sample part-of-speech vector sequence to obtain a sample part-of-speech weight vector sequence, wherein the above sample part-of-speech weight vector sequence includes the sample part-of-speech weight vector corresponding to each of the above at least one sample original log.

[0076] The second determining module is used to determine a sample weighted vector sequence based on the aforementioned sample part-of-speech vector sequence and the aforementioned sample part-of-speech weighted vector sequence, wherein the aforementioned sample weighted vector sequence includes sample weighted vectors corresponding to each of the aforementioned at least one sample original log; and

[0077] The first training module is used to train a deep learning model using the above-mentioned sample weighted vector sequence and label information to obtain a log anomaly detection model.

[0078] According to another aspect of this disclosure, an electronic device is provided, comprising:

[0079] One or more processors;

[0080] Memory, used to store one or more instructions.

[0081] When one or more of the above instructions are executed by one or more processors, the one or more processors cause the one or more processors to implement the method as described in this disclosure.

[0082] According to another aspect of this disclosure, a computer-readable storage medium is provided having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described in this disclosure.

[0083] According to another aspect of this disclosure, a computer program product is provided, which includes computer-executable instructions that, when executed, are used to perform the methods described in this disclosure.

[0084] According to embodiments of this disclosure, since the part-of-speech (POS) vector sequence is obtained by processing the original log sequence, the POS vectors can be used to represent at least one word class included in the original log. Furthermore, since the POS weight vector sequence is obtained by processing the POS vector sequence, the POS weight vectors can be used to represent the weights of each word class included in the original log. Based on this, by determining a weighted vector sequence according to the POS vector sequence and the POS weight vector sequence, and inputting the weighted vector sequence into the log anomaly detection model, log anomaly detection results corresponding to at least one original log are obtained. Therefore, this at least partially overcomes the technical problem in related technologies that cannot guarantee the efficiency and accuracy of log anomaly detection, and can automatically realize anomaly detection of the original log sequence, thereby improving the efficiency of log anomaly detection. In addition, since at least one original log in the original log sequence has a temporal relationship, the accuracy of log anomaly detection is improved by utilizing the log anomaly detection method based on the original log sequence. Attached Figure Description

[0085] The above and other objects, features and advantages of this disclosure will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0086] Figure 1 The illustration schematically shows a system architecture for applying the log anomaly detection method and the training method for the log anomaly detection model according to embodiments of the present disclosure;

[0087] Figure 2 A flowchart illustrating a log anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0088] Figure 3 This schematically illustrates a flowchart of a method for processing a sequence of part-of-speech vectors to obtain a sequence of part-of-speech weight vectors according to an embodiment of the present disclosure;

[0089] Figure 4A This illustration schematically shows an example of a process for processing a part-of-speech vector sequence to obtain a first intermediate vector sequence according to an embodiment of the present disclosure;

[0090] Figure 4BThis illustration schematically shows an example of a process of processing a first intermediate vector sequence to obtain a second intermediate vector sequence according to an embodiment of the present disclosure;

[0091] Figure 4C This illustration schematically shows an example of a process for processing a sequence of part-of-speech vectors to obtain a sequence of part-of-speech weight vectors according to an embodiment of the present disclosure;

[0092] Figure 5 This illustration schematically shows an example diagram of a log anomaly detection process according to an embodiment of the present disclosure;

[0093] Figure 6 A flowchart illustrating a training method for a log anomaly detection model according to an embodiment of the present disclosure is shown schematically.

[0094] Figure 7A The illustration shows an example diagram of the training process of a log anomaly detection model according to an embodiment of the present disclosure;

[0095] Figure 7B The illustration shows an example diagram of the training process of a log anomaly detection model according to an embodiment of the present disclosure;

[0096] Figure 8 A block diagram of a log anomaly detection apparatus according to an embodiment of the present disclosure is shown schematically;

[0097] Figure 9 A block diagram illustrating a training apparatus for a log anomaly detection model according to an embodiment of the present disclosure is shown schematically; and

[0098] Figure 10 A block diagram of an electronic device suitable for implementing a log anomaly detection method and a log anomaly detection model training method according to embodiments of the present disclosure is shown schematically. Detailed Implementation

[0099] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0100] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0101] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0102] When using expressions such as "at least one of A, B, and C," the expression should generally be interpreted in accordance with the meaning commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.). Similarly, when using expressions such as "at least one of A, B, or C," the expression should generally be interpreted in accordance with the meaning commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, or C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0103] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in this disclosed technical solution all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security, network security, and national security.

[0104] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0105] Log anomaly detection is an essential task for detecting system failures, debugging machine performance, and maintaining system security. With the increasing diversity of vulnerabilities and malicious attacks encountered during system operation, the types of log data generated are also increasing, leading to growing challenges for log anomaly detection.

[0106] In related technologies, methods for anomaly detection in logs include: statistical-based anomaly detection, non-deep learning-based anomaly detection, and deep learning-based anomaly detection. However, these methods typically target individual log entries, neglecting the temporal relationships between log entries, leading to a high false positive rate in log anomaly detection.

[0107] Furthermore, in related technologies, methods for setting weights for each word in logs include: equal weighting, weighting for keywords, and searching for the optimal part-of-speech weight allocation set in an exhaustive set. However, these methods ignore the fact that each word has a different weight, resulting in high computational time for anomaly detection and poor transferability.

[0108] In addition, related technologies include methods for searching parameters such as manual parameter tuning, grid search, random search, and Bayesian search. However, these methods typically require traversal, and in parallel execution, they cannot utilize the information provided by each method, resulting in low parallel efficiency.

[0109] To at least partially address the technical problems existing in related technologies, this disclosure provides a log anomaly detection method, a training method for a log anomaly detection model, and an apparatus that can be applied to the field of computer technology. The log anomaly detection method includes: in response to receiving a log anomaly detection instruction, processing the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech (POS) vector sequence, wherein the POS vector sequence includes at least one POS vector corresponding to at least one original log entry; processing the POS vector sequence to obtain a POS weight vector sequence, wherein the POS weight vector sequence includes POS weight vectors corresponding to at least one original log entry; determining a weighted vector sequence based on the POS vector sequence and the POS weight vector sequence, wherein the weighted vector sequence includes weighted vectors corresponding to at least one original log entry; and inputting the weighted vector sequence into a log anomaly detection model to obtain log anomaly detection results corresponding to at least one original log entry.

[0110] It should be noted that the log anomaly detection method, log anomaly detection model training method, and apparatus provided in this disclosure can be used in the field of computer technology, such as for log anomaly detection in computer systems. The log anomaly detection method, log anomaly detection model training method, and apparatus provided in this disclosure can also be used in any field other than computer technology, such as network technology. The application fields of the log anomaly detection method, log anomaly detection model training method, and apparatus provided in this disclosure are not limited.

[0111] Figure 1 The illustration schematically depicts a system architecture for applying the log anomaly detection method and the training method for the log anomaly detection model according to embodiments of this disclosure. It should be noted that... Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0112] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the terminal devices 101, 102, and 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0113] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software, etc. (for example only).

[0114] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0115] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0116] It should be noted that the log anomaly detection method and the log anomaly detection model training method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the log anomaly detection device and the log anomaly detection model training device provided in this disclosure embodiment can generally be located in server 105. The log anomaly detection method and the log anomaly detection model training method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and can communicate with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the log anomaly detection device and the log anomaly detection model training device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and can communicate with terminal devices 101, 102, 103 and / or server 105.

[0117] Alternatively, the log anomaly detection method and the log anomaly detection model training method provided in this disclosure embodiment can also be executed by terminal devices 101, 102, or 103, or by other terminal devices different from terminal devices 101, 102, or 103. Correspondingly, the log anomaly detection device and the log anomaly detection model training device provided in this disclosure embodiment can also be located in terminal devices 101, 102, or 103, or in other terminal devices different from terminal devices 101, 102, or 103.

[0118] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0119] It should be noted that the sequence numbers of the operations in the following methods are for descriptive purposes only and should not be considered as indicating the execution order of the operations. Unless explicitly stated otherwise, the method does not need to be executed in the exact order shown.

[0120] Figure 2 A flowchart illustrating a log anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0121] like Figure 2 As shown, the log anomaly detection method 200 includes operations S210 to S240.

[0122] In operation S2 1 0, in response to receiving a log anomaly detection instruction, the original log sequence indicated by the log anomaly detection instruction is processed to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least one original log, and the part-of-speech vector sequence includes at least one part-of-speech vector corresponding to each of the at least one original log.

[0123] In operation S220, the part-of-speech vector sequence is processed to obtain a part-of-speech weight vector sequence, wherein the part-of-speech weight vector sequence includes part-of-speech weight vectors corresponding to at least one original log.

[0124] In operation S230, a weighted vector sequence is determined based on the part-of-speech vector sequence and the part-of-speech weight vector sequence, wherein the weighted vector sequence includes a weighted vector corresponding to at least one original log entry.

[0125] In operation S240, the weighted vector sequence is input into the log anomaly detection model to obtain log anomaly detection results corresponding to at least one original log.

[0126] According to embodiments of this disclosure, in response to receiving a log anomaly detection instruction, a raw log sequence can be obtained from a data source based on the log anomaly detection instruction. The data source may include at least one of the following: a local database, a cloud database, and network resources. For example, a data interface may be invoked. The raw log sequence is obtained from the data source using the data interface. The raw log sequence may include at least one raw log entry. The at least one raw log entry may have a temporal relationship with each other. Each raw log entry may include at least one word. The at least one word may include content words and function words.

[0127] According to embodiments of this disclosure, after obtaining the original log sequence, the original log sequence can be processed to obtain a part-of-speech (POS) vector sequence. For example, at least one original log entry in the original log sequence can be processed to obtain a POS vector corresponding to each of the at least one original log entry. Based on the POS vectors corresponding to each of the at least one original log entry, a POS vector sequence is determined. The POS vectors corresponding to each of the at least one original log entry can have a temporal relationship with each other. The POS vectors can be used to characterize the part of speech of at least one word included in the original log entry. For example, the POS of content words can include at least one of the following: noun (n), pronoun (pron), verb (verb), adjective (adj), numeral (num), and quantifier (quan). The POS of function words can include at least one of the following: adverb (adv), preposition (prep), conjunction (conj), article (art), auxiliary word (particle), and interjection (int).

[0128] According to embodiments of this disclosure, after obtaining the part-of-speech (POS) vector sequence, the POS vector sequence can be processed to obtain a POS weight vector sequence. For example, at least one POS vector can be processed separately to obtain a POS weight vector corresponding to each of the at least one original log entry. Based on the POS weight vectors corresponding to each of the at least one original log entry, a POS weight vector sequence is determined. The POS weight vector can be used to characterize the weight of each of the at least one word class included in the original log entry. The weight of each of the at least one word class can refer to the degree of influence of that word class on the anomaly detection of the original log entry.

[0129] According to embodiments of this disclosure, after obtaining the part-of-speech tag weight vector sequence, a weighted vector sequence can be determined based on the part-of-speech tag vector sequence and the part-of-speech tag weight vector sequence. For example, the following operations can be repeated: Identify a target original log in at least one original log. Determine the target part-of-speech tag vector corresponding to the target original log based on the part-of-speech tag vector sequence. Determine the target part-of-speech tag weight vector corresponding to the target original log based on the part-of-speech tag weight vector sequence. Perform weighted processing on the target part-of-speech tag vector and the target part-of-speech tag weight vector to obtain a weighted vector corresponding to the target original log. The weighted vector can be used to characterize the weighted result of at least one word class in the target part-of-speech tag vector and the weight corresponding to each of the at least one word class.

[0130] According to embodiments of this disclosure, after obtaining the weighted vector sequence, the weighted vector sequence can be input into a log anomaly detection model to obtain log anomaly detection results corresponding to at least one original log entry. The log anomaly detection results may include at least one of the following: category information and anomaly type information. When the log anomaly detection results include category information, the log anomaly detection results can be used to characterize whether an anomaly exists in the original log. When the log anomaly detection results include anomaly type information, the log anomaly detection results can be used to characterize the anomaly type possessed by the original log entry containing the anomaly.

[0131] According to embodiments of this disclosure, a first deep learning model can be trained using a sequence of sample weighted vectors, category labels, and anomaly type labels to obtain a log anomaly detection model. The first deep learning model may include a Support Vector Machine (SVM), a Decision Tree (DT), a Random Forest (RF), Gradient Boosting (GB), and a Text CNN-LSTM model.

[0132] According to embodiments of this disclosure, since the part-of-speech (POS) vector sequence is obtained by processing the original log sequence, the POS vectors can be used to represent at least one word class included in the original log. Furthermore, since the POS weight vector sequence is obtained by processing the POS vector sequence, the POS weight vectors can be used to represent the weights of each word class included in the original log. Based on this, by determining a weighted vector sequence according to the POS vector sequence and the POS weight vector sequence, and inputting the weighted vector sequence into the log anomaly detection model, log anomaly detection results corresponding to at least one original log are obtained. Therefore, this at least partially overcomes the technical problem in related technologies that cannot guarantee the efficiency and accuracy of log anomaly detection, and can automatically realize anomaly detection of the original log sequence, thereby improving the efficiency of log anomaly detection. In addition, since at least one original log in the original log sequence has a temporal relationship, the accuracy of log anomaly detection is improved by utilizing the log anomaly detection method based on the original log sequence.

[0133] The following is for reference. Figure 3 , Figure 4A , Figure 4B , Figure 4C and Figure 5 The log anomaly detection method 200 according to an embodiment of the present invention will be further described.

[0134] Figure 3 The flowchart illustrates a method for processing a sequence of part-of-speech vectors to obtain a sequence of part-of-speech weight vectors according to an embodiment of the present disclosure.

[0135] like Figure 3 As shown, operation S220 may include operations S321 to S323.

[0136] In operation S321, the part-of-speech vector sequence is processed to obtain a first intermediate vector sequence, wherein the first intermediate vector sequence includes a first intermediate vector corresponding to at least one original log.

[0137] In operation S322, the first intermediate vector sequence is processed to obtain the second intermediate vector sequence, wherein the second intermediate vector sequence includes a second intermediate vector corresponding to at least one original log.

[0138] In operation S323, the part-of-speech weight vector sequence is determined based on the second intermediate vector sequence.

[0139] According to embodiments of this disclosure, after obtaining the part-of-speech (POS) vector sequence, the POS vector sequence can be processed to obtain a first intermediate vector sequence. For example, at least one POS vector in the POS vector sequence can be processed based on a parallel grid search algorithm to obtain a first intermediate vector corresponding to each of the at least one POS vector. Based on the first intermediate vectors corresponding to each of the at least one POS vectors, a first intermediate vector sequence is determined. The first intermediate vector sequence may include a first intermediate vector corresponding to each of at least one original log entry. The first intermediate vector may be a vector representing the result of processing the POS vectors.

[0140] According to embodiments of this disclosure, after obtaining a first intermediate vector sequence, the first intermediate vector sequence can be processed to obtain a second intermediate vector sequence. For example, at least one first intermediate vector in the first intermediate vector sequence can be processed based on a parallel random search algorithm (i.e., Parallel Random Search) to obtain a second intermediate vector corresponding to each of the at least one first intermediate vector. A second intermediate vector sequence is determined based on the second intermediate vectors corresponding to each of the at least one first intermediate vector. The second intermediate vector sequence may include a second intermediate vector corresponding to each of at least one original log entry. The second intermediate vector may be a vector representing the result of processing the first intermediate vectors.

[0141] According to embodiments of this disclosure, after obtaining the second intermediate vector sequence, at least one second intermediate vector in the second intermediate vector sequence can be processed to obtain a part-of-speech weight vector corresponding to each of the at least one second intermediate vector. Based on the part-of-speech weight vectors corresponding to each of the at least one second intermediate vectors, a part-of-speech weight vector sequence is determined. By maintaining an optimal top-k queue in shared memory, a combination of parallel optimization and sequence optimization can be achieved.

[0142] According to embodiments of this disclosure, since the first intermediate vector sequence is obtained by processing the part-of-speech vector sequence and the second intermediate vector sequence is obtained by processing the first intermediate vector sequence, the part-of-speech weight vector sequence is determined based on the second intermediate vector sequence, thereby achieving a combination of parallel optimization and sequence optimization and improving the accuracy of the part-of-speech weight vector.

[0143] According to embodiments of this disclosure, operation S321 may include the following operations.

[0144] The process involves calling N out of M first search threads to process the part-of-speech tag sequence in parallel, resulting in candidate first intermediate vector sequences corresponding to each of the N first search threads. Here, M is an integer greater than or equal to 2, and N is a positive integer less than or equal to M. Based on the candidate first intermediate vector sequences corresponding to each of the N first search threads, the first intermediate vector sequence is determined.

[0145] According to embodiments of this disclosure, at least one part-of-speech vector in a part-of-speech vector sequence can be processed using a parallel grid search algorithm to obtain a first intermediate vector corresponding to each of the at least one part-of-speech vectors. After obtaining the first intermediate vector sequence, the first intermediate vector sequence can be stored in a predetermined queue.

[0146] According to embodiments of this disclosure, a first search thread can refer to the smallest unit of computation scheduling that the operating system can perform. M first search threads can be deployed in the same process. Alternatively, the M first search threads can also be deployed in different processes.

[0147] According to embodiments of this disclosure, N out of M first search threads can be invoked to process at least one part-of-speech vector group in parallel, thereby obtaining candidate first intermediate vector sequences corresponding to each of the N first search threads. The candidate first intermediate vector sequence may include at least one candidate first intermediate vector. A first intermediate vector sequence can be determined based on the candidate first intermediate vector sequences corresponding to each of the N first search threads.

[0148] According to embodiments of this disclosure, since the candidate first intermediate vector sequence is obtained by calling N of the M first search threads to process the part-of-speech vector sequence in parallel, the search efficiency for the part-of-speech vector sequence is improved. Furthermore, by determining the first intermediate vector sequence based on the candidate first intermediate vector sequences corresponding to each of the N first search threads, the accuracy of the first intermediate vector sequence is improved, further improving the accuracy of the second intermediate vector sequence and the part-of-speech weight vector sequence, thereby improving the accuracy of log anomaly detection.

[0149] According to embodiments of this disclosure, calling N of the M first search threads to process the part-of-speech vector sequence in parallel to obtain the candidate first intermediate vector sequence corresponding to each of the N first search threads may include the following operations.

[0150] Determine the search range parameters and search step size parameters for each of the N first search threads. Invoke the N first search threads and, based on their respective search range parameters and search step size parameters, process the part-of-speech vector sequences in parallel to obtain the candidate first intermediate vector sequences corresponding to each of the N first search threads.

[0151] According to embodiments of this disclosure, after obtaining the part-of-speech vector sequence, at least one part-of-speech vector in the sequence can be grouped to obtain at least one part-of-speech vector group. Based on the number of at least one part-of-speech vector group, N first search threads to be invoked are determined. After determining the N first search threads to be invoked, for each of the N first search threads, search range parameters and search step size parameters can be determined.

[0152] According to embodiments of this disclosure, after determining the search range parameter and the search step size parameter, N first search threads can be invoked. Based on the search range parameter and search step size parameter of each of the N first search threads, at least one part-of-speech vector in the part-of-speech vector sequence is processed in parallel using a parallel grid search algorithm, i.e., a multi-core, multi-node parallel large-range grid search, to obtain the first intermediate vector corresponding to each of the at least one part-of-speech vector. Based on the first intermediate vectors corresponding to each of the at least one part-of-speech vectors, a first intermediate vector sequence is determined. After obtaining the first intermediate vector sequence, the first intermediate vector sequence can be stored in a predetermined queue.

[0153] According to embodiments of this disclosure, in the process of parallel processing of at least one part-of-speech vector in a part-of-speech vector sequence based on a parallel grid search algorithm, random perturbation can be added to reduce manually set parameters and increase the probability of finding the optimal point.

[0154] According to embodiments of this disclosure, determining the first intermediate vector sequence based on the candidate first intermediate vector sequences corresponding to each of the N first search threads may include the following operations.

[0155] For each original log entry in at least one original log entry, based on the candidate first intermediate vector sequences corresponding to each of the N first search threads, determine N candidate first intermediate vectors corresponding to the original log entry. Based on the N candidate first intermediate vectors corresponding to the original log entry, determine L first intermediate vectors corresponding to the original log entry, where L is a positive integer and L is less than or equal to N.

[0156] According to embodiments of this disclosure, the candidate first intermediate vector sequence includes candidate first intermediate vectors corresponding to at least one original log file.

[0157] According to embodiments of this disclosure, after obtaining the candidate first intermediate vector sequences corresponding to each of the N first search threads, for each original log in at least one original log, the predetermined queue can merge the candidate first intermediate vector sequences corresponding to each of the N first search threads to obtain N candidate first intermediate vectors corresponding to the original log.

[0158] According to embodiments of this disclosure, after obtaining N candidate first intermediate vectors corresponding to the original log, a predetermined queue can sort the N candidate first intermediate vectors to obtain a sorting result. L first intermediate vectors corresponding to the original log can be determined based on the sorting result. For example, the top three candidate first intermediate vectors in the sorting result can be determined as the first intermediate vectors corresponding to the original log. After determining the first intermediate vectors corresponding to the original log, the first intermediate vectors and their corresponding original logs can be associated and stored in the predetermined queue.

[0159] According to embodiments of this disclosure, since the candidate first intermediate vector sequence is obtained by calling N first search threads and processing the part-of-speech vector sequence in parallel according to the search range parameters and search step size parameters of each of the N first search threads, it at least partially overcomes the technical problem in related technologies where search parameter methods typically require traversal and cannot utilize the information of each thread in parallel execution, resulting in low parallel efficiency. This improves the versatility of the search parameter method. Furthermore, since the first intermediate vector is determined based on the N candidate first intermediate vectors corresponding to the original log, the accuracy of the part-of-speech weight represented by the first intermediate vector is improved, thereby improving the accuracy of log anomaly detection.

[0160] Figure 4A The illustration shows an example of a process of processing a part-of-speech vector sequence to obtain a first intermediate vector sequence according to an embodiment of the present disclosure.

[0161] like Figure 4A As shown, in 400A, N first search threads can be determined from among M first search threads 401. The N first search threads can include first search thread 401_1, first search thread 401_2, ..., first search thread 401_n, ..., first search thread 401_N. N can be an integer greater than or equal to 1, where n∈{1, 2, ..., (N-1), N}.

[0162] The process involves invoking N first search threads to process the part-of-speech vector sequence 403 in parallel, obtaining candidate first intermediate vector sequences corresponding to each of the N first search threads. This can include: invoking first search thread 401_1 to process part-of-speech vector 403_1, obtaining candidate first intermediate vector sequence 404_1; invoking first search thread 401_2 to process part-of-speech vector 403_2, obtaining candidate first intermediate vector sequence 404_2, and so on, invoking first search thread 401_n to process part-of-speech vector 403_n, obtaining candidate first intermediate vector sequence 404_n, and so on, invoking first search thread 401_N to process part-of-speech vector 403_N, obtaining candidate first intermediate vector sequence 404_N.

[0163] Based on the candidate first intermediate vector sequences corresponding to each of the N first search threads, the first intermediate vector sequence 405 is determined, which may include: determining the first intermediate vector 405_1 based on the candidate first intermediate vector sequence 404_1; determining the first intermediate vector 405_2 based on the candidate first intermediate vector sequence 404_2; and so on, determining the first intermediate vector 405_n based on the candidate first intermediate vector sequence 404_n; and so on, determining the first intermediate vector 405_N based on the candidate first intermediate vector sequence 404_N.

[0164] According to embodiments of this disclosure, operation S322 may include the following operations.

[0165] Call Z of the Y second search threads to process the first intermediate vector corresponding to at least one original log in parallel, obtaining candidate second intermediate vectors corresponding to each of the Z second search threads, where Y is an integer greater than or equal to 2, Z is a positive integer less than or equal to Y. Determine the second intermediate vector sequence based on the candidate second intermediate vectors corresponding to each of the Z second search threads.

[0166] According to embodiments of this disclosure, a first intermediate vector sequence can be obtained from a predetermined queue. At least one first intermediate vector in the first intermediate vector sequence is processed using a parallel random search algorithm to obtain a second intermediate vector corresponding to each of the at least one first intermediate vector. After obtaining the second intermediate vector sequence, it can be stored in the predetermined queue.

[0167] According to embodiments of this disclosure, a second search thread can refer to the smallest unit of computation scheduling that the operating system can perform. Y second search threads can be deployed in the same process. Alternatively, the Y second search threads can also be deployed in different processes.

[0168] According to embodiments of this disclosure, Z of the Y second search threads can be invoked to perform parallel processing on at least one first intermediate vector group, obtaining candidate second intermediate vectors corresponding to each of the Z second search threads. A second intermediate vector sequence can be determined based on the candidate second intermediate vectors corresponding to each of the Z second search threads.

[0169] According to embodiments of this disclosure, since the candidate second intermediate vector is obtained by calling Z of the Y second search threads to process the first intermediate vector sequence in parallel, the search efficiency for the first intermediate vector sequence is improved. Furthermore, by determining the second intermediate vector sequence based on the candidate second intermediate vectors corresponding to each of the Z second search threads, the accuracy of the second intermediate vector sequence is improved, further improving the accuracy of the part-of-speech weight vector sequence, and consequently improving the accuracy of log anomaly detection.

[0170] According to embodiments of this disclosure, calling Z of the Y second search threads to perform parallel processing on the first intermediate vector corresponding to at least one original log to obtain the candidate second intermediate vector corresponding to each of the Z second search threads may include the following operations.

[0171] Determine the target first intermediate vector from the first intermediate vectors corresponding to at least one original log entry. Determine the target second search thread from Z second search threads. Call the target second search thread to process the target first intermediate vector and obtain the candidate second intermediate vector corresponding to the target second search thread.

[0172] According to embodiments of this disclosure, after obtaining a first intermediate vector sequence, at least one first intermediate vector in the first intermediate vector sequence can be grouped to obtain at least one first intermediate vector group. Based on the number of at least one first intermediate vector group, Z second search threads to be invoked are determined. After determining the Z second search threads to be invoked, for each original log in at least one original log, a target first intermediate vector can be determined based on the first intermediate vector corresponding to that original log. The target first intermediate vector can be used to characterize the optimal vector among the first intermediate vectors corresponding to that original log in a predetermined queue. The target second search thread is determined based on the Z second search threads.

[0173] According to embodiments of this disclosure, after determining the first intermediate vector and the second search thread, the second search thread can be invoked to process the first intermediate vector based on a parallel random search algorithm, i.e., a parallel small-range random search with multiple cores and nodes, to obtain the candidate second intermediate vector corresponding to the second search thread.

[0174] According to embodiments of this disclosure, determining a sequence of second intermediate vectors based on candidate second intermediate vectors corresponding to each of the Z second search threads may include the following operations.

[0175] If the candidate second intermediate vector and the corresponding first intermediate vector satisfy a preset condition, the first intermediate vector in the first intermediate vector sequence is replaced with the candidate second intermediate vector. If the candidate second intermediate vector and the corresponding first intermediate vector do not satisfy the preset condition, the first intermediate vector in the first intermediate vector sequence is deleted.

[0176] According to embodiments of this disclosure, after obtaining the candidate second intermediate vectors corresponding to each of the Z second search threads, the relationship between the candidate second intermediate vectors and the first intermediate vectors corresponding to the candidate second intermediate vectors can be determined.

[0177] According to embodiments of this disclosure, when the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector meet preset conditions, that is, when the part-of-speech weight represented by the candidate second intermediate vector is better than the part-of-speech weight represented by the first intermediate vector corresponding to the candidate second intermediate vector, the first intermediate vector in the predetermined queue can be replaced with the candidate second intermediate vector.

[0178] According to embodiments of this disclosure, if the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector do not meet a preset condition, that is, if the part-of-speech weight represented by the first intermediate vector corresponding to the candidate second intermediate vector is better than the part-of-speech weight represented by the candidate second intermediate vector, the first intermediate vector in the predetermined queue can be deleted.

[0179] According to embodiments of this disclosure, since the candidate second intermediate vector is obtained by calling the target second search thread to process the target first intermediate vector, parallel efficiency is improved. Furthermore, by determining whether the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector meet preset conditions, the accuracy of the part-of-speech weight represented by the first intermediate vector is improved, thereby enhancing the accuracy of log anomaly detection.

[0180] Figure 4B The illustration shows an example of a process of processing a first intermediate vector sequence to obtain a second intermediate vector sequence according to an embodiment of the present disclosure.

[0181] like Figure 4B As shown, in 400B, target second search thread 407_1, target second search thread 407_2, ..., target second search thread 407_z, ..., target second search thread 407_Z can be determined from Z second search threads 406. Z can be an integer greater than or equal to 1, z∈{1, 2, ..., (Z-1), Z}.

[0182] The target first intermediate vector 408 can be determined from the first intermediate vectors corresponding to at least one original log entry. The target second search thread is invoked to process the target first intermediate vector, obtaining candidate second intermediate vectors corresponding to the target second search thread. This may include: invoking target second search thread 407_1 to process target first intermediate vector 408_1, obtaining candidate second intermediate vector 409_1 corresponding to target second search thread 407_1; invoking target second search thread 407_2 to process target first intermediate vector 408_2, obtaining candidate second intermediate vector 409_2 corresponding to target second search thread 407_2; and so on, invoking target second search thread 407_z to process target first intermediate vector 408_z, obtaining candidate second intermediate vector 409_z corresponding to target second search thread 407_z; and so on, invoking target second search thread 407_Z to process target first intermediate vector 408_Z, obtaining candidate second intermediate vector 409_Z corresponding to target second search thread 407_Z.

[0183] The second intermediate vector sequence 410 can be determined based on the candidate second intermediate vectors corresponding to each of the Z second search threads.

[0184] According to embodiments of this disclosure, operation S323 may include the following operations.

[0185] For each original log entry in at least one original log entry, determine the target second intermediate vector based on the second intermediate vector corresponding to the original log entry. The target second intermediate vector is then defined as the part-of-speech weight vector corresponding to the original log entry.

[0186] According to embodiments of this disclosure, the second intermediate vector sequence can be stored in a predetermined queue. The second intermediate vector corresponding to the original log can be processed based on a parallel random search algorithm until a first predetermined condition is met. The vector obtained after meeting the first predetermined condition is determined as the target second intermediate vector. The first predetermined condition may include at least one of meeting a predetermined evaluation criterion and reaching a maximum number of processing rounds. After determining the target second intermediate vector, it can be defined as the part-of-speech weight vector corresponding to the original log.

[0187] According to embodiments of this disclosure, since the part-of-speech weight vector corresponding to the original log is determined based on the target second intermediate vector, and the target second intermediate vector is determined based on the second intermediate vector, the accuracy of the part-of-speech weight vector sequence is improved, the accuracy of the weighted vector sequence is further improved, and thus the accuracy of log anomaly detection is improved.

[0188] Figure 4CThe illustration shows an example diagram of the process of processing a sequence of part-of-speech vectors to obtain a sequence of part-of-speech weight vectors according to an embodiment of the present disclosure.

[0189] like Figure 4C As shown, in 400C, the part-of-speech vector sequence 411 may include part-of-speech vector 411_1, part-of-speech vector 411_2, ..., part-of-speech vector 411_p, ..., part-of-speech vector 411_P. P can be an integer greater than or equal to 1, p∈{1, 2, ..., (P-1), P}.

[0190] The part-of-speech vector sequence 411 can be processed in parallel to obtain the candidate first intermediate vector sequence. For example, part-of-speech vector 411_1 can be processed to obtain the candidate first intermediate vector sequence 412_1. Part-of-speech vector 411_2 can be processed to obtain the candidate first intermediate vector sequence 412_2. And so on, part-of-speech vector 411_p can be processed to obtain the candidate first intermediate vector sequence 412_p. And so on, part-of-speech vector 411_P can be processed to obtain the candidate first intermediate vector sequence 412_P.

[0191] The first intermediate vector sequence 413 can be determined based on the candidate first intermediate vector sequence. For example, the first intermediate vector 413_1 can be determined based on the candidate first intermediate vector sequence 412_1. The first intermediate vector 413_2 can be determined based on the candidate first intermediate vector sequence 412_2. And so on, the first intermediate vector 413_p can be determined based on the candidate first intermediate vector sequence 412_p. And so on, the first intermediate vector 413_P can be determined based on the candidate first intermediate vector sequence 412_P.

[0192] The first intermediate vector can be processed in parallel to obtain candidate second intermediate vectors. For example, the first intermediate vector 413_1 can be processed to obtain candidate second intermediate vector 414_1. The first intermediate vector 413_2 can be processed to obtain candidate second intermediate vector 414_2. And so on, the first intermediate vector 413_p can be processed to obtain candidate second intermediate vector 414_p. And so on, the first intermediate vector 413_P can be processed to obtain candidate second intermediate vector 414_P.

[0193] The second intermediate vector sequence 415 can be determined based on the candidate second intermediate vector 414_1, candidate second intermediate vector 414_2, candidate second intermediate vector 414_p, ..., candidate second intermediate vector 414_P.

[0194] According to embodiments of this disclosure, operation S210 may include the following operations.

[0195] For each original log entry in at least one original log entry, perform log template extraction processing to obtain a log template vector corresponding to each original log entry. Then, perform part-of-speech tagging processing on the log template vectors corresponding to each original log entry to obtain part-of-speech tag vectors corresponding to each original log entry.

[0196] According to embodiments of this disclosure, a log template extraction model can be used to extract log templates from each of at least one original log entry, resulting in a log template vector corresponding to each of the at least one original log entry. The log template extraction model may include at least one of the following: FT-Tree model, SOW vocabulary set model, BOW bag-of-words model, nBOW normalized bag-of-words model, TF-IDF term frequency-inverse document frequency model, N-Gram multilingual model, LSI / LDA model, Word2vec model, GloVe model, and Doc2vec model.

[0197] For example, the FT-Tree model can be used to extract log templates from each of the at least one original log file, thereby removing the variable parts and retaining the constant parts to obtain the log template vectors corresponding to each of the at least one original log file.

[0198] According to embodiments of this disclosure, a part-of-speech (POS) analysis model can be used to perform POS analysis on log template vectors corresponding to at least one original log entry, thereby obtaining POS vectors corresponding to each of the at least one original log entry. The POS analysis model may include at least one of the following: a cascaded encoder, a Bi-Long Short-Term Memory (Bi-LSTM) network, a Conditional Random Field (CRF) model, and a Stanford Core NLP model, but is not limited to these. The POS analysis model may also include a cascaded encoder, a Bi-Long Short-Term Memory network, and a Conditional Random Field, or the POS analysis model may only include an encoder and a Conditional Random Field.

[0199] According to embodiments of this disclosure, the type of encoder is not limited. For example, it can be a BERT (Bidirectional Encoder Representation from Transformers) encoder, an ERNIE (Enhanced Language Representation with Informative Entities) encoder, or a Log2vec encoder, as long as it is a network that can encode keywords into feature vectors.

[0200] For example, the Stanford Core NLP model can be used to perform part-of-speech analysis on the log template vectors corresponding to at least one original log, so as to classify non-natural English words or words composed of several letters such as special names and abbreviations as specific word attributes, and obtain the part-of-speech vectors corresponding to at least one original log.

[0201] According to embodiments of this disclosure, since the log template vector corresponding to each of the at least one original log is obtained by performing log template extraction processing on each original log, the log template vector can retain the constant parts of the original log. Furthermore, since the part-of-speech vector corresponding to each of the at least one original log is obtained by performing part-of-speech analysis on the log template vector, the involvement of human rules in the log anomaly detection process is reduced, thereby improving the accuracy of subsequent log anomaly detection.

[0202] According to embodiments of this disclosure, operation S230 may include the following operations.

[0203] For each original log entry in at least one original log entry, determine the part-of-speech vector and the part-of-speech weight vector corresponding to the original log entry. Then, weight the part-of-speech vector and the part-of-speech weight vector corresponding to the original log entry to obtain a weighted vector.

[0204] According to embodiments of this disclosure, part-of-speech vectors and part-of-speech weight vectors corresponding to the original log can be determined in a predetermined queue. After determining the part-of-speech weight vectors corresponding to the original log, the part-of-speech vectors and part-of-speech weight vectors corresponding to the original log can be weighted to obtain a weighted vector corresponding to the original log. For example, if the part-of-speech vectors corresponding to the original log 1 are [part-of-speech 1, part-of-speech 2, part-of-speech 3, part-of-speech 4], and the part-of-speech weight vectors corresponding to the original log 1 are [part-of-speech weight 1, part-of-speech weight 2, part-of-speech weight 3, part-of-speech weight 4], then the weighted vectors corresponding to the original log 1 can be determined as [part-of-speech 1 * part-of-speech weight 1, part-of-speech 2 * part-of-speech weight 2, part-of-speech 3 * part-of-speech weight 3, part-of-speech 4 * part-of-speech weight 4].

[0205] According to embodiments of this disclosure, since the weighted vector corresponding to the original log is obtained by weighting the part-of-speech vector corresponding to the original log and the part-of-speech weight vector corresponding to the original log, the accuracy of subsequent log anomaly detection using the weighted vector is improved.

[0206] Figure 5 The illustration shows an example schematic diagram of a log anomaly detection process according to an embodiment of the present disclosure.

[0207] like Figure 5As shown, in step 500, in response to receiving a log anomaly detection command, the original log sequence can be obtained. The original log sequence may include at least one original log. For each original log 501 that includes at least one original log, log template extraction processing can be performed on the original log 501 to obtain a log template vector 502. Part-of-speech analysis processing is performed on the log template vector 502 to obtain a part-of-speech vector 503.

[0208] After obtaining the part-of-speech vector 503, it can be processed to obtain the first intermediate vector 504. The first intermediate vector 504 is then processed to obtain the second intermediate vector 505. Based on the second intermediate vector 505, the part-of-speech weight vector 506 is determined.

[0209] After obtaining the part-of-speech weight vector 506, the part-of-speech vector 503 and the part-of-speech weight vector 506 can be weighted to obtain the weighted vector 507.

[0210] After obtaining the weighted vector 507, the weighted vector 507 can be input into the log anomaly detection model 508 to obtain the log anomaly detection result 509 corresponding to the original log 501.

[0211] The above are merely exemplary embodiments, but are not limited thereto. Other log anomaly detection methods known in the art may also be included, as long as they can improve the efficiency and accuracy of log anomaly detection.

[0212] Figure 6 A flowchart illustrating a training method for a log anomaly detection model according to an embodiment of the present disclosure is shown.

[0213] like Figure 6 As shown, the training method 600 for the log anomaly detection model includes operations S610 to S650.

[0214] In operation S610, a sample raw log sequence is obtained, wherein the sample raw log sequence includes at least one sample raw log, and each sample raw log has label information.

[0215] In operation S620, the original log sequence of the sample is processed to obtain the sample part-of-speech vector sequence, wherein the sample part-of-speech vector sequence includes the sample part-of-speech vector corresponding to at least one original log sample.

[0216] In operation S630, the sample part-of-speech vector sequence is processed to obtain the sample part-of-speech weight vector sequence, wherein the sample part-of-speech weight vector sequence includes the sample part-of-speech weight vector corresponding to at least one original sample log.

[0217] In operation S640, a sample weighted vector sequence is determined based on the sample part-of-speech vector sequence and the sample part-of-speech weight vector sequence, wherein the sample weighted vector sequence includes the sample weighted vector corresponding to at least one original log sample.

[0218] By operating the S650, a deep learning model is trained using sample weighted vector sequences and label information to obtain a log anomaly detection model.

[0219] According to embodiments of this disclosure, the sample raw log sequence may include at least one sample raw log. For example, the sample raw log sequence may be characterized as L: [l1, l2, l3, ..., l n After obtaining the original log sequence of the sample, log template extraction processing can be performed on the original log sequence to obtain a log template vector sequence. The log template vector sequence can include log template vectors corresponding to at least one original log. For example, the log template vector sequence can be represented as T: [t1, t2, t3, ..., t n After obtaining the log template vector sequence, part-of-speech (POS) analysis can be performed on the log template vector sequence to obtain the sample POS vector sequence. The sample POS vector sequence can include the sample POS vectors corresponding to at least one original sample log. For example, the sample POS vector corresponding to original sample log 1 can be represented as (pos vector): [NNP, VB, NN, IN, NN, NNP].

[0220] According to embodiments of this disclosure, after obtaining the sample part-of-speech vector sequence, it can be processed using a parallel grid search algorithm and a parallel random search algorithm to obtain a sample part-of-speech weight vector sequence. The sample part-of-speech weight vector sequence may include sample part-of-speech weight vectors corresponding to at least one original sample log file. For example, the sample part-of-speech weight vector corresponding to original sample log file 1 can be represented as w i [0.05, 0.1, 0.025, 0.1, 0.025, 1.0].

[0221] According to embodiments of this disclosure, after obtaining the sample part-of-speech weight vector sequence, the sample part-of-speech vector and sample part-of-speech weight vector corresponding to at least one original sample log can be weighted to obtain a sample weighted vector sequence. The sample weighted vector sequence may include the sample weighted vector corresponding to at least one original sample log. For example, the sample weighted vector corresponding to original sample log 1 can be represented as q. i : [NNP*0.05, VB*0.1, NN*0.025, IN*0.1, NN*0.025, NNP*1.0].

[0222] According to embodiments of this disclosure, after obtaining the sample weighted vector sequence, the sample weighted vector sequence can be input into a deep learning model to output a prediction result sequence. The prediction result sequence may include the prediction result corresponding to at least one original sample log.

[0223] According to embodiments of this disclosure, a deep learning model is trained by processing the original log sequence of the sample to obtain the weighted vector sequence, thereby enabling the obtained log anomaly detection model to automatically detect anomalies in the log sequence, thus improving the efficiency and accuracy of log anomaly detection.

[0224] The following is for reference. Figure 7A and Figure 7B The training method 600 for the log anomaly detection model according to an embodiment of the present invention will be further described.

[0225] According to embodiments of this disclosure, operation S650 may include the following operations.

[0226] The weighted vectors of at least one abnormal original log sample and at least one normal original log sample are input into a deep learning model to obtain the predicted category information for each of the at least one abnormal original log sample and at least one normal original log sample. Based on the predicted category information and category labels of each of the at least one abnormal original log sample and at least one normal original log sample, a first loss function value is obtained. The model parameters of the deep learning model are adjusted based on the first loss function value until a predetermined termination condition is met, resulting in a log anomaly detection model.

[0227] According to embodiments of this disclosure, at least one original sample log includes at least one original log of an abnormal sample and at least one original log of a normal sample, and the tag information includes a category tag.

[0228] According to embodiments of this disclosure, the sample weighted vectors of at least one original log of an anomaly sample can be input into a first deep learning model to obtain the predicted category information of each of the at least one original log of an anomaly sample. Based on a first loss function, using the predicted category information and the category label of each of the at least one original log of an anomaly sample, a first loss function value is obtained. The model parameters of the first deep learning model can be adjusted according to the first loss function value until a predetermined condition is met.

[0229] According to embodiments of this disclosure, the log anomaly detection model can be obtained by training a first deep learning model using the weighted vectors of at least one abnormal original log sample and at least one normal original log sample. For example, the weighted vectors of at least one normal original log sample can be input into the first deep learning model to obtain the predicted category information of each of the at least one normal original log sample. Based on a first loss function, the predicted category information and category labels of each of the at least one normal original log sample are used to obtain the value of the first loss function. The model parameters of the first deep learning model can be adjusted according to the value of the first loss function until predetermined conditions are met. The first deep learning model can be configured according to actual business needs, as long as it can achieve binary classification of whether the original log sample is abnormal or not, and is not limited here.

[0230] For example, the model parameters of the first deep learning model can be adjusted using backpropagation or stochastic gradient descent algorithms until predetermined conditions are met. The first deep learning model obtained under these predetermined conditions is then identified as the log anomaly detection model. These predetermined conditions may include at least one of the following: convergence of the loss function value and reaching the maximum number of training epochs.

[0231] According to embodiments of this disclosure, a first deep learning model is trained using the sample weighting vectors of at least one abnormal sample original log and at least one normal sample original log, as well as the category labels of at least one abnormal sample original log and at least one normal sample original log, to obtain a log anomaly detection model. This model can be used to identify abnormal sample original logs and normal sample original logs, achieving binary classification of whether the sample original logs are abnormal or not, thereby improving the efficiency of log anomaly detection.

[0232] According to embodiments of this disclosure, operation S650 may include the following operations.

[0233] The sample weighted vectors of at least one original log sample from an anomaly are input into the deep learning model to obtain the predicted anomaly type information for each of the original log samples. Based on the anomaly type labels and the predicted anomaly type information of each original log sample, a second loss function value is obtained. The model parameters of the deep learning model are adjusted based on the second loss function value until a predetermined termination condition is met, resulting in the log anomaly detection model.

[0234] According to embodiments of this disclosure, at least one original sample log includes at least one original log of an abnormal sample, and the tag information includes an abnormality type tag.

[0235] According to embodiments of this disclosure, the log anomaly detection model can be obtained by training a second deep learning model using the sample weighted vectors of at least one original log sample from an anomaly sample. For example, the sample weighted vectors of at least one original log sample from anomaly samples can be input into the second deep learning model to obtain the predicted anomaly type information of each of the at least one original log sample from anomaly samples. Based on a second loss function, the predicted anomaly type information and the anomaly type label of each of the at least one original log sample from anomaly samples are used to obtain the value of the second loss function. The model parameters of the second deep learning model can be adjusted according to the value of the second loss function until a predetermined condition is met. The second loss function may include at least one of the following: cross-entropy loss function, hinge loss function, or exponential loss function, etc. The second deep learning model can be configured according to actual business needs, as long as it can realize the multi-classification function for the anomaly type of the original log sample from anomaly samples, and is not limited here.

[0236] For example, a second deep learning model may include at least one model structure. The model structure may include at least one model substructure and the connections between these substructures. The model structure may be a structure obtained by connecting at least one model substructure based on the connections between them. The at least one model substructure included in the model structure may be a structure derived from at least one operational layer. For example, the model structure may be a structure obtained by connecting at least one model substructure from at least one operational layer based on the connections between them. For example, at least one operational layer may include at least one of the following: input layer, convolutional layer, hidden layer, transcription layer, pooling layer, unpooling layer, deconvolutional layer, feedforward neural network layer, attention layer, residual layer, fully connected layer, batch normalization layer, linear embedding layer, and nonlinear layer, etc.

[0237] For example, the model parameters of the first deep learning model can be adjusted using backpropagation or stochastic gradient descent algorithms until predetermined conditions are met. The second deep learning model obtained under these predetermined conditions is then identified as the log anomaly detection model. These predetermined conditions may include at least one of the following: convergence of the loss function value and reaching the maximum number of training epochs.

[0238] According to embodiments of this disclosure, a third deep learning model can be trained using a sample weighted vector sequence and label information to obtain a log anomaly detection model. In this case, the sample weighted vector sequence may include the sample weighted vectors of at least one abnormal sample original log and at least one normal sample original log, and the label information may include a category label and an anomaly type label. The third deep learning model can be configured according to actual business needs, and it only needs to be able to implement binary classification of whether the sample original log is abnormal or not, and multi-class classification of the anomaly type of the abnormal sample original log, which is not limited here.

[0239] According to embodiments of this disclosure, a log anomaly detection model is obtained by training a third deep learning model using sample weighted vector sequences and label information. This enables the identification of whether the original log samples are abnormal and the type of abnormality using a single model, thereby reducing model deployment costs and saving computing resources.

[0240] According to embodiments of this disclosure, a second deep learning model is trained using the sample weighting vector of each of at least one original log of an anomaly sample and the anomaly type label of each of the original logs of anomaly samples, to obtain a log anomaly detection model. The model can be used to identify the anomaly type of the original log of anomaly samples, thereby achieving multi-classification of the anomaly type of the original log of anomaly samples and improving the efficiency of log anomaly type detection.

[0241] Figure 7A The illustration shows an example diagram of the training process of a log anomaly detection model according to an embodiment of the present disclosure.

[0242] like Figure 7A As shown, in 700A, at least one sample original log may include at least one abnormal sample original log and at least one normal sample original log. At least one abnormal sample original log has a category label, and at least one normal sample original log has a category label.

[0243] The sample weighted vector 701 of the original log of the abnormal sample can be input into the deep learning model 705, which outputs the predicted category information 706 of the original log of the abnormal sample. Based on the first loss function 708, the first loss function value 709 corresponding to the original log of the abnormal sample is obtained according to the category label 703 of the original log of the abnormal sample and the predicted category information 706 of the original log of the abnormal sample.

[0244] The sample weighted vector 702 of the original normal sample logs can be input into the deep learning model 705, which outputs the predicted category information 707 of the original normal sample logs. Based on the first loss function 708, and according to the category label 704 and the predicted category information 707 of the original normal sample logs, the first loss function value 710 corresponding to the original normal sample logs is obtained.

[0245] After obtaining the first loss function value 709 and the first loss function value 710, the model parameters of the deep learning model 705 can be adjusted according to the first loss function value 709 and the first loss function value 710 until the predetermined termination condition is met, thus obtaining the log anomaly detection model.

[0246] According to embodiments of this disclosure, the training method 600 for the log anomaly detection model may further include repeatedly performing the following operations until the performance test results of the log anomaly detection model meet predetermined performance conditions.

[0247] The performance of the log anomaly detection model is tested using a validation weighted vector sequence, yielding performance test results. The validation weighted vector sequence includes validation sample weighted vectors corresponding to at least one original log sample, and each validation sample weighted vector contains label information. If the performance test results do not meet predetermined performance conditions, the model hyperparameters corresponding to the log anomaly detection model are adjusted. Based on the adjusted model hyperparameters, the deep learning model is retrained using the sample weighted vector sequence and label information to obtain a new log anomaly detection model.

[0248] According to embodiments of this disclosure, model performance can be characterized by model performance evaluation values. Performance test results may include model performance evaluation values. Model performance evaluation values ​​may include at least one of the following: precision, recall, accuracy, error rate, and F-function value. A predetermined performance condition may refer to a model performance evaluation value being greater than or equal to a predetermined model performance evaluation threshold. The predetermined model performance evaluation threshold can be configured according to actual business needs and is not limited herein. Model hyperparameters may include at least one of the following: learning rate and the number of layers in the deep learning model, etc.

[0249] According to embodiments of this disclosure, the second sample weighted vector sequence may include a second sample weighted vector corresponding to at least one original second sample log. At least one second sample weighted vector may be determined from the second sample weighted vectors corresponding to at least one original second sample log based on a search strategy. A validation sample weighted vector sequence is determined based on the at least one second sample weighted vector. The search strategy may include one of the following: a full search strategy, a heuristic search strategy, and a recursive feature elimination strategy.

[0250] According to embodiments of this disclosure, the performance of a log anomaly detection model can be tested using a validation sample weighted vector sequence to obtain performance test results. For example, the log anomaly detection model can be used to process the log anomaly detection model to obtain prediction results. Based on the prediction results, a performance test result is determined. It is then determined whether the performance test result meets predetermined performance conditions. If the performance test result meets the predetermined performance conditions, the optimization operation on the validation sample weighted vector sequence ends. If the performance test result does not meet the predetermined performance conditions, at least one second sample weighted vector can be determined from the second sample weighted vectors corresponding to at least one second sample original log, based on a search strategy. A new validation sample weighted vector sequence is determined based on the at least one second sample weighted vector. The performance of the log anomaly detection model is tested using the new validation sample weighted vector sequence to obtain performance test results. The above operations are repeated until the performance test result meets the predetermined performance conditions.

[0251] According to embodiments of this disclosure, the performance of a log anomaly detection model is tested by repeatedly executing a weighted vector sequence of validation samples to obtain performance test results. If the performance test results do not meet predetermined performance conditions, the hyperparameters of the model corresponding to the log anomaly detection model are adjusted until the performance test results of the log anomaly detection model meet the predetermined performance conditions, thereby improving the accuracy of the log anomaly detection results.

[0252] Figure 7B The illustration shows an example diagram of the training process of a log anomaly detection model according to an embodiment of the present disclosure.

[0253] like Figure 7B As shown, in 700B, at least one sample original log includes at least one abnormal sample original log, and each of the at least one abnormal sample original log has an abnormal type label.

[0254] The sample weighted vector 711 of the original log of the abnormal sample can be input into the deep learning model 713, which outputs the predicted abnormality type information 714 of the original log of the abnormal sample. Based on the second loss function 715, the second loss function value 715 corresponding to the original log of the abnormal sample is obtained according to the abnormality type label 712 of the original log of the abnormal sample and the predicted abnormality type information 714 of the original log of the abnormal sample.

[0255] After obtaining the second loss function value 715, the model parameters of the deep learning model 713 can be adjusted according to the second loss function value 715 until the predetermined termination condition is met, thus obtaining the log anomaly detection model.

[0256] The above are merely exemplary embodiments, but are not limited thereto. Other training methods for log anomaly detection models known in the art may also be included, as long as they can improve the accuracy of the log anomaly detection results of the log anomaly detection model.

[0257] Figure 8 A block diagram of a log anomaly detection apparatus according to an embodiment of the present disclosure is shown schematically.

[0258] like Figure 8 As shown, the log anomaly detection device 800 may include a first processing module 810, a second processing module 820, a first determination module 830, and an input module 840.

[0259] The first processing module 810 is configured to, in response to receiving a log anomaly detection instruction, process the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least one original log, and the part-of-speech vector sequence includes at least one part-of-speech vector corresponding to each of the at least one original log.

[0260] The second processing module 820 is used to process the part-of-speech vector sequence to obtain a part-of-speech weight vector sequence, wherein the part-of-speech weight vector sequence includes part-of-speech weight vectors corresponding to at least one original log.

[0261] The first determining module 830 is used to determine a weighted vector sequence based on the part-of-speech vector sequence and the part-of-speech weight vector sequence, wherein the weighted vector sequence includes a weighted vector corresponding to at least one original log.

[0262] The input module 840 is used to input the weighted vector sequence into the log anomaly detection model to obtain the log anomaly detection result corresponding to at least one original log.

[0263] According to embodiments of this disclosure, the second processing module 820 may include a first processing submodule, a second processing submodule, and a first determining submodule.

[0264] The first processing submodule is used to process the part-of-speech vector sequence to obtain a first intermediate vector sequence, wherein the first intermediate vector sequence includes a first intermediate vector corresponding to at least one original log.

[0265] The second processing submodule is used to process the first intermediate vector sequence to obtain a second intermediate vector sequence, wherein the second intermediate vector sequence includes a second intermediate vector corresponding to at least one original log.

[0266] The first determining submodule is used to determine the part-of-speech weight vector sequence based on the second intermediate vector sequence.

[0267] According to embodiments of this disclosure, the first processing submodule may include a first processing unit and a first determining unit.

[0268] The first processing unit is used to call N of the M first search threads to perform parallel processing on the part-of-speech vector sequence to obtain the candidate first intermediate vector sequence corresponding to each of the N first search threads, where M is an integer greater than or equal to 2, N is a positive integer, and N is less than or equal to M.

[0269] The first determining unit is used to determine the first intermediate vector sequence based on the candidate first intermediate vector sequences corresponding to each of the N first search threads.

[0270] According to embodiments of this disclosure, the first processing unit may include a first determining subunit and a first processing subunit.

[0271] The first determining subunit is used to determine the search range parameters and search step size parameters of each of the N first search threads.

[0272] The first processing subunit is used to call N first search threads and perform parallel processing on the part-of-speech vector sequence according to the search range parameters and search step size parameters of each of the N first search threads to obtain the candidate first intermediate vector sequence corresponding to each of the N first search threads.

[0273] According to embodiments of this disclosure, the candidate first intermediate vector sequence includes candidate first intermediate vectors corresponding to at least one original log file.

[0274] According to embodiments of this disclosure, the first determining unit may include a second determining subunit and a third determining subunit.

[0275] For each raw log entry in at least one raw log entry,

[0276] The second determining subunit is used to determine N candidate first intermediate vectors corresponding to the original log based on the candidate first intermediate vector sequences corresponding to each of the N first search threads.

[0277] The third determining subunit is used to determine L first intermediate vectors corresponding to the original log based on N candidate first intermediate vectors corresponding to the original log, where L is a positive integer and L is less than or equal to N.

[0278] According to embodiments of this disclosure, the second processing submodule may include a second processing unit and a second determining unit.

[0279] The second processing unit is used to call Z of the Y second search threads to perform parallel processing on the first intermediate vector corresponding to at least one original log, and obtain the candidate second intermediate vector corresponding to each of the Z second search threads, where Y is an integer greater than or equal to 2, Z is a positive integer, and Z is less than or equal to Y.

[0280] The second determining unit is used to determine the second intermediate vector sequence based on the candidate second intermediate vectors corresponding to each of the Z second search threads.

[0281] According to embodiments of this disclosure, the second processing unit may include a fourth determining subunit, a fifth determining subunit, and a second processing subunit.

[0282] The fourth determining subunit is used to determine the target first intermediate vector from the first intermediate vectors corresponding to at least one original log.

[0283] The fifth determining subunit is used to determine the target second search thread from Z second search threads.

[0284] The second processing subunit is used to call the target second search thread to process the target first intermediate vector and obtain the candidate second intermediate vector corresponding to the target second search thread.

[0285] According to embodiments of this disclosure, the second determining unit may include a replacement subunit and a deletion subunit.

[0286] The replacement subunit is used to replace the first intermediate vector in the first intermediate vector sequence with the candidate second intermediate vector when the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector meet the preset conditions.

[0287] The deletion sub-unit is used to delete the first intermediate vector in the first intermediate vector sequence when the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector do not meet the preset conditions.

[0288] According to embodiments of this disclosure, the first determining submodule may include a third determining unit and a fourth determining unit.

[0289] For each raw log entry in at least one raw log entry,

[0290] The third determining unit is used to determine the target second intermediate vector based on the second intermediate vector corresponding to the original log.

[0291] The fourth determining unit is used to determine the target second intermediate vector as the part-of-speech weight vector corresponding to the original log.

[0292] According to embodiments of this disclosure, the first processing module 810 may include a third processing submodule and a fourth processing submodule.

[0293] The third processing submodule is used to extract log templates from each of the at least one original logs to obtain log template vectors corresponding to each of the at least one original logs.

[0294] The fourth processing submodule is used to perform part-of-speech analysis on the log template vectors corresponding to at least one original log, and obtain the part-of-speech vectors corresponding to at least one original log.

[0295] According to embodiments of this disclosure, the first determining module 830 may include a second determining submodule and a fifth processing submodule.

[0296] For each raw log entry in at least one raw log entry,

[0297] The second determination submodule is used to determine the part-of-speech vector and the part-of-speech weight vector corresponding to the original log.

[0298] The fifth processing submodule is used to perform weighted processing on the part-of-speech vector and the part-of-speech weight vector corresponding to the original log, so as to obtain the weighted vector corresponding to the original log.

[0299] Figure 9 A block diagram of a training apparatus for a log anomaly detection model according to an embodiment of the present disclosure is shown schematically.

[0300] like Figure 9 As shown, the training device 900 for the log anomaly detection model may include an acquisition module 910, a third processing module 920, a fourth processing module 930, a second determination module 940, and a first training module 950.

[0301] The acquisition module 910 is used to acquire the original log sequence of the sample, wherein the original log sequence of the sample includes at least one original log of the sample, and each original log of the sample has label information.

[0302] The third processing module 920 is used to process the original sample log sequence to obtain a sample part-of-speech vector sequence, wherein the sample part-of-speech vector sequence includes sample part-of-speech vectors corresponding to at least one original sample log.

[0303] The fourth processing module 930 is used to process the sample part-of-speech vector sequence to obtain the sample part-of-speech weight vector sequence, wherein the sample part-of-speech weight vector sequence includes the sample part-of-speech weight vector corresponding to at least one original sample log.

[0304] The second determining module 940 is used to determine a sample weighted vector sequence based on the sample part-of-speech vector sequence and the sample part-of-speech weight vector sequence, wherein the sample weighted vector sequence includes sample weighted vectors corresponding to at least one original log sample.

[0305] The first training module 950 is used to train a deep learning model using sample weighted vector sequences and label information to obtain a log anomaly detection model.

[0306] According to embodiments of this disclosure, at least one original sample log includes at least one original log of an abnormal sample and at least one original log of a normal sample, and the tag information includes a category tag.

[0307] According to embodiments of this disclosure, the first training module 950 may include a first acquisition submodule, a second acquisition submodule, and a first adjustment submodule.

[0308] The first acquisition submodule is used to input the sample weighted vectors of at least one abnormal sample original log and at least one normal sample original log into the deep learning model to obtain the predicted category information of at least one abnormal sample original log and at least one normal sample original log.

[0309] The second acquisition submodule is used to obtain the first loss function value based on the predicted category information of at least one abnormal sample original log and at least one normal sample original log, and the category label of at least one abnormal sample original log and at least one normal sample original log; and

[0310] The first adjustment submodule is used to adjust the model parameters of the deep learning model according to the first loss function value until the predetermined termination condition is met, so as to obtain the log anomaly detection model.

[0311] According to embodiments of this disclosure, at least one original sample log includes at least one original log of an abnormal sample, and the tag information includes an abnormality type tag.

[0312] According to embodiments of this disclosure, the first training module 950 may include a third acquisition submodule, a fourth acquisition submodule, and a second adjustment submodule.

[0313] The third submodule is used to input the sample weighted vector of each of the original logs of at least one abnormal sample into the deep learning model to obtain the predicted abnormality type information of each of the original logs of at least one abnormal sample.

[0314] The fourth submodule is used to obtain the second loss function value based on the anomaly type label of each of the original logs of at least one anomaly sample and the predicted anomaly type information of each of the original logs of at least one anomaly sample.

[0315] The second adjustment submodule is used to adjust the model parameters of the deep learning model according to the second loss function value until the predetermined termination condition is met, thus obtaining the log anomaly detection model.

[0316] According to embodiments of this disclosure, the training apparatus 900 for the log anomaly detection model may further include a testing module, an adjustment module, and a second training module.

[0317] The testing module is used to test the performance of the log anomaly detection model using a verification weighted vector sequence and obtain performance test results. The verification weighted vector sequence includes verification sample weighted vectors corresponding to at least one original log sample, and each verification sample weighted vector has label information.

[0318] The adjustment module is used to adjust the hyperparameters of the model corresponding to the log anomaly detection model when the performance test results do not meet the predetermined performance conditions.

[0319] The second training module is used to retrain the deep learning model based on the adjusted model hyperparameters, using the sample weighted vector sequence and label information, to obtain a new log anomaly detection model.

[0320] Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure, or at least part of the functions of any one or more of them, can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be at least partially implemented as hardware circuitry, such as Field Programmable Gate Arrays (FPGAs), Programmable Logic Arrays (PLAs), Systems-on-Chip, Systems-on-Substrate, Systems-on-Package, Application-Specific Integrated Circuits (ASICs), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, one or more of the modules, submodules, units, and subunits according to embodiments of the present disclosure can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0321] For example, any plurality of the first processing module 810, the second processing module 820, the first determining module 830, and the input module 840 can be combined into one module / unit / subunit, or any one of these modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least part of the functionality of one or more of these modules / units / subunits can be combined with at least part of the functionality of other modules / units / subunits and implemented in one module / unit / subunit. According to embodiments of this disclosure, at least one of the first processing module 810, the second processing module 820, the first determining module 830, and the input module 840 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the first processing module 810, the second processing module 820, the first determining module 830, and the input module 840 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0322] It should be noted that the log anomaly detection device part in the embodiments of this disclosure corresponds to the log anomaly detection method part in the embodiments of this disclosure. For a detailed description of the log anomaly detection device part, please refer to the log anomaly detection method part, which will not be repeated here.

[0323] For example, any multiple of the acquisition module 910, the third processing module 920, the fourth processing module 930, the second determination module 940, and the first training module 950 can be combined into one module / unit / subunit, or any one of these modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least part of the functionality of one or more of these modules / units / subunits can be combined with at least part of the functionality of other modules / units / subunits and implemented in one module / unit / subunit. According to embodiments of this disclosure, at least one of the acquisition module 910, the third processing module 920, the fourth processing module 930, the second determination module 940, and the first training module 950 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 910, the third processing module 920, the fourth processing module 930, the second determination module 940, and the first training module 950 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0324] It should be noted that the training device part of the log anomaly detection model in the embodiments of this disclosure corresponds to the training method part of the log anomaly detection model in the embodiments of this disclosure. For a detailed description of the training device part of the log anomaly detection model, please refer to the training method part of the log anomaly detection model, which will not be repeated here.

[0325] Figure 10 A block diagram of an electronic device suitable for implementing a log anomaly detection method and a log anomaly detection model training method according to embodiments of the present disclosure is shown schematically. Figure 10 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0326] like Figure 10As shown, a computer electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1009 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0327] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0328] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 10010 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0329] According to embodiments of this disclosure, the method flow according to embodiments of this disclosure can be implemented as a computer software program. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of embodiments of this disclosure. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0330] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0331] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium. Examples include, but are not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0332] For example, according to embodiments of this disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0333] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods provided in the embodiments of this disclosure. When the computer program product is run on an electronic device, the program code is used to enable the electronic device to implement the log anomaly detection method and the log anomaly detection model training method provided in the embodiments of this disclosure.

[0334] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0335] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0336] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0337] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. Those skilled in the art will understand that the features recited in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not expressly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0338] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for detecting log anomalies, comprising: In response to receiving a log anomaly detection instruction, the original log sequence indicated by the log anomaly detection instruction is processed to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least two original logs with a temporal relationship, and the part-of-speech vector sequence includes part-of-speech vectors with a temporal relationship corresponding to each of the original logs; Parallel large-scale grid search and parallel small-scale random search are performed on the part-of-speech vector sequence to combine parallel optimization and sequence optimization, thereby obtaining a part-of-speech weight vector sequence, wherein the part-of-speech weight vector sequence includes part-of-speech weight vectors corresponding to the original logs respectively; Based on the part-of-speech vector sequence and the part-of-speech weight vector sequence, a weighted vector sequence is determined, wherein the weighted vector sequence includes weighted vectors corresponding to the original log entries; and The weighted vector sequence is input into the log anomaly detection model to obtain log anomaly detection results corresponding to the original logs.

2. The method according to claim 1, wherein, The process of processing the part-of-speech vector sequence to obtain the part-of-speech weight vector sequence includes: The part-of-speech vector sequence is processed to obtain a first intermediate vector sequence, wherein the first intermediate vector sequence includes a first intermediate vector corresponding to each of the original logs; The first intermediate vector sequence is processed to obtain a second intermediate vector sequence, wherein the second intermediate vector sequence includes second intermediate vectors corresponding to the original logs; and The part-of-speech weight vector sequence is determined based on the second intermediate vector sequence.

3. The method according to claim 2, wherein, The process of processing the part-of-speech vector sequence to obtain the first intermediate vector sequence includes: The part-of-speech tag sequence is processed in parallel by calling N of the M first search threads to obtain candidate first intermediate vector sequences corresponding to each of the N first search threads, where M is an integer greater than or equal to 2, N is a positive integer less than or equal to M; and The first intermediate vector sequence is determined based on the candidate first intermediate vector sequences corresponding to each of the N first search threads.

4. The method according to claim 3, wherein, The step of calling N of the M first search threads to perform parallel processing on the part-of-speech vector sequence to obtain candidate first intermediate vector sequences corresponding to each of the N first search threads includes: Determine the search range parameters and search step size parameters for each of the N first search threads; and The N first search threads are invoked, and the part-of-speech vector sequence is processed in parallel according to the search range parameter and the search step size parameter of each of the N first search threads to obtain the candidate first intermediate vector sequence corresponding to each of the N first search threads.

5. The method according to claim 3 or 4, wherein, The candidate first intermediate vector sequence includes candidate first intermediate vectors corresponding to each of the original logs; Wherein, determining the first intermediate vector sequence based on the candidate first intermediate vector sequences corresponding to each of the N first search threads includes: For each of the original log entries, Based on the candidate first intermediate vector sequences corresponding to the N first search threads, determine the N candidate first intermediate vectors corresponding to the original log; and Based on the N candidate first intermediate vectors corresponding to the original log, determine L first intermediate vectors corresponding to the original log, where L is a positive integer and L is less than or equal to N.

6. The method according to claim 2, wherein, The process of processing the first intermediate vector sequence to obtain the second intermediate vector sequence includes: Call Z of the Y second search threads to process the first intermediate vector corresponding to each of the original logs in parallel, obtaining candidate second intermediate vectors corresponding to each of the Z second search threads, where Y is an integer greater than or equal to 2, Z is a positive integer, and Z is less than or equal to Y; and The second intermediate vector sequence is determined based on the candidate second intermediate vectors corresponding to the Z second search threads.

7. The method according to claim 6, wherein, The step of calling Z of the Y second search threads to perform parallel processing on the first intermediate vector corresponding to each of the original logs, and obtaining the candidate second intermediate vector corresponding to each of the Z second search threads, includes: Determine the target first intermediate vector from the first intermediate vector corresponding to each of the original logs; Determine the target second search thread from the Z second search threads; and The second search thread of the target is invoked to process the first intermediate vector of the target to obtain the candidate second intermediate vector corresponding to the second search thread of the target.

8. The method according to claim 6 or 7, wherein, The step of determining the second intermediate vector sequence based on the candidate second intermediate vectors corresponding to each of the Z second search threads includes: If the candidate second intermediate vector and the first intermediate vector corresponding to the candidate second intermediate vector satisfy a preset condition, the first intermediate vector in the first intermediate vector sequence is replaced with the candidate second intermediate vector; and If neither the candidate second intermediate vector nor the first intermediate vector corresponding to the candidate second intermediate vector satisfies the preset conditions, the first intermediate vector in the first intermediate vector sequence is deleted.

9. The method according to claim 2, wherein, Determining the part-of-speech weight vector sequence based on the second intermediate vector sequence includes: For each of the original log entries, Based on the second intermediate vector corresponding to the original log, determine the target second intermediate vector; and The target second intermediate vector is determined as the part-of-speech weight vector corresponding to the original log.

10. The method according to claim 1, wherein, The step of processing the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech tag sequence in response to receiving the log anomaly detection instruction includes: For each original log entry in the original log, a log template extraction process is performed to obtain a log template vector corresponding to each original log entry; and Part-of-speech tagging is performed on the log template vectors corresponding to the original logs to obtain the part-of-speech vectors corresponding to the original logs.

11. The method according to claim 1, wherein, The step of determining the weighted vector sequence based on the part-of-speech vector sequence and the part-of-speech weight vector sequence includes: For each of the original log entries, Determine the part-of-speech vector and the part-of-speech weight vector corresponding to the original log; and The part-of-speech vector corresponding to the original log and the part-of-speech weight vector corresponding to the original log are weighted to obtain the weighted vector corresponding to the original log.

12. A training method for a log anomaly detection model, comprising: Obtain a sample original log sequence, wherein the sample original log sequence includes at least two sample original logs with a temporal relationship, and each sample original log has tag information; The original log sequence of the sample is processed to obtain a sample part-of-speech vector sequence, wherein the sample part-of-speech vector sequence includes sample part-of-speech vectors that have a temporal relationship with each of the original logs of the sample; Parallel large-scale grid search and parallel small-scale random search are performed on the sample part-of-speech vector sequence to combine parallel optimization and sequence optimization, thereby obtaining the sample part-of-speech weight vector sequence, wherein the sample part-of-speech weight vector sequence includes the sample part-of-speech weight vectors corresponding to the original sample logs; Based on the sample part-of-speech vector sequence and the sample part-of-speech weight vector sequence, a sample weighted vector sequence is determined, wherein the sample weighted vector sequence includes sample weighted vectors corresponding to each of the original sample logs; and Using the sample weighted vector sequence and the label information, a deep learning model is trained to obtain a log anomaly detection model.

13. The method according to claim 12, wherein, The original sample logs include original logs of abnormal samples and original logs of normal samples, and the label information includes category labels; The step of training a deep learning model using the sample weighted vector sequence and the label information to obtain a log anomaly detection model includes: The sample weighted vectors of the original logs of the abnormal samples and the original logs of the normal samples are input into the deep learning model to obtain the predicted category information of the original logs of the abnormal samples and the original logs of the normal samples. Based on the predicted category information and category labels of the original logs of the abnormal samples and the original logs of the normal samples, a first loss function value is obtained; and The model parameters of the deep learning model are adjusted according to the first loss function value until a predetermined termination condition is met, thereby obtaining the log anomaly detection model.

14. The method according to claim 12, wherein, The original sample logs include original logs of abnormal samples, and the tag information includes abnormal type tags; The step of training a deep learning model using the sample weighted vector sequence and the label information to obtain a log anomaly detection model includes: The sample weighted vectors of the original logs of the abnormal samples are input into the deep learning model to obtain the predicted anomaly type information of the original logs of the abnormal samples. Based on the anomaly type labels of the original logs of the anomaly samples and the predicted anomaly type information of the original logs of the anomaly samples, the second loss function value is obtained; and The model parameters of the deep learning model are adjusted according to the second loss function value until a predetermined termination condition is met, thereby obtaining the log anomaly detection model.

15. The method according to any one of claims 12 to 14, further comprising repeating the following operations until the performance test results of the log anomaly detection model meet predetermined performance conditions: The performance of the log anomaly detection model was tested using a validation weighted vector sequence, and the performance test results were obtained, wherein... The verification weighted vector sequence includes verification sample weighted vectors corresponding to each of the original sample logs, and each verification sample weighted vector has the label information; If the performance test results do not meet the predetermined performance conditions, the hyperparameters of the model corresponding to the log anomaly detection model are adjusted. as well as Based on the adjusted model hyperparameters, the deep learning model is retrained using the sample weighted vector sequence and the label information to obtain a new log anomaly detection model.

16. A log anomaly detection device, comprising: The first processing module is configured to, in response to receiving a log anomaly detection instruction, process the original log sequence indicated by the log anomaly detection instruction to obtain a part-of-speech vector sequence, wherein the original log sequence includes at least two original logs with a temporal relationship, and the part-of-speech vector sequence includes part-of-speech vectors with a temporal relationship corresponding to each of the original logs; The second processing module is used to perform parallel large-scale grid search and parallel small-scale random search on the part-of-speech vector sequence, so as to combine parallel optimization and sequence optimization to obtain a part-of-speech weight vector sequence, wherein the part-of-speech weight vector sequence includes part-of-speech weight vectors corresponding to the original logs respectively. The first determining module is configured to determine a weighted vector sequence based on the part-of-speech vector sequence and the part-of-speech weight vector sequence, wherein the weighted vector sequence includes weighted vectors corresponding to each of the original logs; and The input module is used to input the weighted vector sequence into the log anomaly detection model to obtain log anomaly detection results corresponding to the original logs.

17. A training device for a log anomaly detection model, comprising: The acquisition module is used to acquire the original sample log sequence, wherein the original sample log sequence includes at least two original sample logs with a temporal relationship, and each original sample log has tag information; The third processing module is used to process the original log sequence of the sample to obtain a sample part-of-speech vector sequence, wherein the sample part-of-speech vector sequence includes sample part-of-speech vectors that have a temporal relationship with each of the original logs of the sample; The fourth processing module is used to perform parallel large-scale grid search and parallel small-scale random search on the sample part-of-speech vector sequence, so as to combine parallel optimization and sequence optimization to obtain the sample part-of-speech weight vector sequence, wherein the sample part-of-speech weight vector sequence includes the sample part-of-speech weight vector corresponding to each of the original sample logs; The second determining module is configured to determine a sample weighted vector sequence based on the sample part-of-speech vector sequence and the sample part-of-speech weight vector sequence, wherein the sample weighted vector sequence includes sample weighted vectors corresponding to each of the original sample logs; and The first training module is used to train a deep learning model using the sample weighted vector sequence and the label information to obtain a log anomaly detection model.

18. An electronic device comprising: One or more processors; Memory, used to store one or more instructions. Wherein, when the one or more instructions are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method of any one of claims 1 to 11 or claims 12 to 15.

19. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method of any one of claims 1 to 11 or claims 12 to 15.

20. A computer program product comprising computer-executable instructions, which, when executed, are used to implement the method of any one of claims 1 to 11 or 12 to 15.

Images