Hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network

Abstract

The present invention provides a hospital self-service terminal log anomaly detection system based on a directed graph convolutional neural network, and relates to the field of smart medical technology. Through terminal log data collection, data mining and processing, the message content in the original log is converted into a structured event template. According to the time series, a log event sequence is formed in segments, and the log events in each log sequence are converted into graph nodes. A time directed graph structure is established, and the time directed graph adjacency matrix, the first-order approximate adjacency matrix, and the second-order approximate adjacency matrix are calculated. They are input into the convolutional neural network model respectively, and the feature vectors are calculated and connected, and the feature results are output. The present invention adopts a GTN attention mechanism based on causal relationship optimization, establishes the causal relationship feature content between this node and other nodes in the graph, and inputs it into the GCN model for adjustment, so that the calculation of the complex spatiotemporal dependency relationship of the system log becomes simpler.

Description

Technical Field

[0001] The present invention relates to the field of smart medical technology, and in particular to a hospital self-service terminal log anomaly detection system based on a directed graph convolutional neural network. Background Art

[0002] The hospital self-service terminal system has the functions of file creation, registration, payment, self-service billing, inquiry, and medical card. It is the application of Internet technology in the field of medical outpatient process. The use of the hospital self-service terminal system has greatly optimized the hospital service process, effectively solved the problem of long waiting time for patients to register and pay at the manual window, provided convenience for patients, and also played a role in reducing the window service load of the hospital and regulating the good medical order of the hospital. However, there are many problems in the operation of the hospital self-service terminal equipment, such as frequent card swallowing, paper jams and system crashes in the self-service equipment, which seriously affect the efficiency of the outpatient service system. According to relevant statistics, the hospital self-service terminal equipment frequently fails after 3 to 6 months of use. The engineers of the hospital information center are powerless, and the self-service terminal becomes a decoration when the maintenance personnel of the manufacturer far away are not in place. On the other hand, the terminal equipment products are spread all over the country. In order to ensure the normal operation of the self-service terminal equipment in hospitals scattered all over the country, the manufacturer needs to maintain a large maintenance team, which is very expensive. There are many and complex reasons for the failure of self-service terminals. Therefore, the remote intelligent abnormality prediction solution allows hospitals and equipment manufacturers to predict the failure of terminal equipment and prevent it before it happens. The terminal equipment system in operation records the log events that occur every day. By identifying and predicting daily events, abnormal operation of terminal equipment can be discovered, providing technical support for timely elimination of equipment failures.

[0003] Although there have been many studies on log anomaly detection in terminal equipment, such as papers on using neural network models such as LSTM, CNN, and GCN to detect and analyze system log information anomalies, these results have basically stopped in the academic field and cannot be applied in the engineering field. The reasons are that they are simplistic or defective: 1) Log statistics in log sequences predict the possibility of future log anomalies, ignoring the causal law between log contents; 2) In the application of graph convolutional neural networks (GCN), log events are simply treated as undirected graph nodes. Even if a directed graph model is established, when mining log event nodes, only the influence of feature information between directly adjacent nodes is considered, and the influence of distant nodes is not considered. In fact, the correlation between log events is relatively complex.

[0004] Based on this, the present invention is proposed. Summary of the invention

[0005] The purpose of the present invention is to provide a hospital self-service terminal log anomaly detection system based on a directed graph convolutional neural network to make the calculation of complex spatiotemporal dependencies of system logs simpler.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] The present invention provides a self-service terminal system log anomaly detection system based on a directed graph convolution neural model (DGCN) of a GTN attention mechanism, the system comprising a self-service terminal operation and maintenance system (i.e., a self-service terminal log remote management system) and a directed graph neural network (DGCN) log anomaly detection algorithm based on an optimized path search GTN attention mechanism. The self-service operation and maintenance system is a terminal equipment management system, and the equipment management system is established on a cloud server. After the system maintenance personnel query the hospital name and input the terminal equipment number, they can know the operation status of the hospital equipment. After the system runs the directed graph neural network DGCN log anomaly detection algorithm for calculation, it predicts the abnormal events of the equipment in the next day, week or month, so that the equipment maintenance engineer can accurately grasp the operation status of the terminal equipment, handle fault accidents in time, improve the efficiency of equipment use, ensure the normal operation of the hospital's self-service appointment, registration, payment and other outpatient process service links, and improve patient satisfaction and medical experience.

[0008] The self-service terminal operation and maintenance management system includes a log data collection module, a log data preprocessing and storage module, a log data analysis module, and a log calculation and abnormal alarm module.

[0009] Log data collection module: The log server collects log data from devices or systems and further saves its original data. The log server sends a fetch command to the remote self-service terminal device through the SNMP network management protocol, and sets the daily time 00:00 to input one day's log data to the server.

[0010] Log data preprocessing and storage module: Data cleaning deletes irrelevant data information. After cleaning, log data tables are formed according to terminal name, code, message content, and time format and stored in the log database. Furthermore, data mining is performed on the log data to structure the unstructured log data and form a log information data warehouse.

[0011] Log data parsing module: The log parsing module of the hospital self-service terminal equipment converts the message content in the original log into a structured event template.

[0012] The log data analysis and prediction module is used to analyze and calculate the log data using the directed graph neural network DGCN log anomaly detection algorithm to predict abnormal events in the future self-service terminal system. Specifically:

[0013] Arrange in chronological order, with each group of 100 or 60 logs forming a log sequence. For each log sequence, a time directed graph structure G(V, E) is formed, where V is the node set, E is the node directed edge set, the adjacency matrix is ​​A, and X is the node feature vector. The adjacency matrix A is defined as follows: if node i points to node j, it is represented by the matrix element a(i,j)=1, otherwise, a(i,j)=0; otherwise, node j points to node i, it is represented by the matrix element a(j,i)=1, otherwise, a(j,i)=0. Construct a symmetric matrix for A, which is the first-order neighbor similarity matrix A. F The second-order neighbor similarity matrix is ​​constructed according to the following formula:

[0014]

[0015] Neighborhood Similarity Matrix Convolution for Directed Graph Convolutional Neural Models

[0016]

[0017]

[0018]

[0019] Directed graph degree matrix construction: W is the weight matrix. Here f represents the activation function, such as the ReLU function.

[0020] Using the GTN attention mechanism optimized based on causality, the node feature of node i in the l-1 layer is

[0021]

[0022] The feature matrix of the l-1 layer nodes is

[0023]

[0024] After connection, the feature matrix of the l-layer nodes is

[0025]

[0026] The output is

[0027]

[0028] Error loss function That is, the difference between the training parameter value and the actual parameter value, that is, the difference between the model training parameter value vector and the actual parameter value vector. The model trained by the directed graph neural algorithm is used to detect log abnormal accidents. The judgment standard is based on the Gaussian distribution law of the error between the predicted value and the true value. The MSE with the number of training samples N, the mean is μ, and the standard deviation is σ. The mathematical formula for the confidence interval of 98.21% is If the error falls within the confidence interval, it means the test result is normal, otherwise it is considered abnormal.

[0029] Furthermore, causality optimizes self-attention mechanism

[0030] Causal relationship characteristics between nodes: If a series of causal transmission relationships occur between log sequence nodes, the probability of abnormal logs increases, and an attention mechanism needs to be adopted. i Analysis of causal correlation between feature content, similar to the shortest node path search: i，j Indicates the causal relationship i→j. If a direct causal relationship occurs, p i，j =1, otherwise p ij =0(i≠j); p i，j =0(i=j). If the causal relationship exists and passes through an intermediate node k, that is, i→k→j, then p ij =0.5, and so on.

[0031] In the conventional GCN model, the source attention node only pays attention to the information connection of its neighboring nodes, while based on the causal node feature model, it not only pays attention to the information of neighboring nodes, but also pays attention to the information of other nodes. In order to obtain the correlation information between more distant nodes, it is necessary to superimpose multiple GCN models to perform multiple layers of complex calculations to obtain the correlation information between more distant nodes. In the causal feature model of this patent, each node is globally connected, making the calculation of complex spatiotemporal dependencies simpler.

[0032] is the input node feature matrix, n is the number of nodes, F n is the node feature dimension p is the node pair causal relationship feature matrix, F p is the node causal feature dimension. At each layer, the node features are updated by calculating the weighted average using the learned attention weights. Represents the l-layer node features. m Number of model features, h0 = WX T For linear transformation feature input, the attention score value from node i to node j can be calculated

[0033] Attention probability value When calculating the attention probability value, we exclude the source node itself. With the attention probability, we can calculate the weighted average of the node features. Considering the path features, the node output feature is a function of the node features and the path features, so we have

[0034]

[0035] Compared with the prior art, the above technical solution has the following advantages:

[0036] The present invention proposes a self-service terminal log anomaly detection system based on a directed graph convolutional neural network (DGCN) optimized for causal relationships and an attention mechanism, firstly, the terminal log data is collected, then data mining and processing are performed, and the unstructured log data is structured to form a log information data warehouse. The log parsing module converts the message content in the original log into a structured event template. According to the time series, a log event sequence is formed in segments. The log events in each log sequence are converted into graph nodes to establish a time directed graph structure. Then the time directed graph adjacency matrix, the first-order approximate adjacency matrix, and the second-order approximate adjacency matrix (out-degree and in-degree) are calculated, respectively input into the convolutional neural network model, the feature vector is calculated and connected, and the feature result is output. The error between the training value and the actual value is estimated by the loss function, and the iteration is returned. In order to prevent the previous graph neural network from only considering the influence of feature information between directly adjacent nodes and ignoring the cause-and-effect relationship between the content of each node in the log, the algorithm of the present invention adopts the GTN attention mechanism optimized based on causal relationships, and each node pays attention to the possible causal relationship between all other nodes in the graph. A similar path node search model is used to establish the causal relationship feature content between this node and other nodes in the graph, and input it into the GCN model for adjustment. This method overcomes the shortcomings of the conventional GCN model: in order to obtain the association information between more distant nodes, multiple GCN models need to be superimposed to perform multiple layers of complex calculations to obtain the association information between more distant nodes. Therefore, the method proposed by the present invention makes the calculation of complex spatiotemporal dependencies of system logs simpler. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A directed graph convolutional neural network model DGCN based on causal GTN attention mechanism in a self-service terminal log anomaly detection system and a block diagram of information transmission between the terminal and the management end and a module block diagram provided by a specific embodiment of the present invention;

[0039] Figure 2 A directed graph of log events in a log anomaly detection system of a self-service terminal based on a causal GTN attention mechanism directed graph convolutional neural network model DGCN is provided as a specific embodiment of the present invention;

[0040] Figure 3 A schematic diagram of the structure of a causal relationship optimized GTN attention mechanism directed graph convolutional neural network constructed in a DGCN self-service terminal log anomaly detection system based on a causal relationship GTN attention mechanism directed graph convolutional neural network model provided in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] Please refer to Figure 1 This embodiment provides a hospital self-service terminal log anomaly detection system based on causal relationship optimization GTN attention mechanism directed graph convolution neural model, that is, a self-service terminal log remote management system. The system includes a log data collection module, a log data preprocessing and storage module, a log data prediction module and an abnormal alarm module.

[0043] The log data collection module sends log data collection instructions to the log server regularly through the self-service terminal log remote management system. The log server sends log collection instructions to the telemedicine self-service terminal device through the SNMP network protocol, and the telemedicine self-service terminal returns the log data. Set the daily time 00:00 to input one day's log data to the server. The log server sends the data back to the self-service terminal log remote management system and stores the data.

[0044] Log data preprocessing and storage module: Data cleaning deletes irrelevant data information. After cleaning, a log data table is formed according to the terminal name, code, message content, and time format and stored in the log database, as shown in Table 1.

[0045] Table 1

[0046]

[0047] In this embodiment, the log data preprocessing and storage module further performs data mining on the log data, structures the unstructured log data, and forms a log information data warehouse.

[0048] The log data parsing module, in this embodiment, the log parsing module of the hospital ZYY304 self-service terminal device converts the message content in the original log into a structured event template, as shown in Table 2.

[0049] Table 2

[0050]

[0051]

[0052] The log parsing module of this embodiment arranges logs in chronological order, and forms a log sequence in groups of 100 or 60 logs. For each log sequence, a time directed graph structure G(V,Ed) is formed, where V is a node set and Ed is a node directed edge set. For the sake of clarity, the hospital outpatient self-service machine ZYY304 is used as an example. Taking the start time as 2020-01-01 00:00:00, within the first 10 minutes, the log sequence formed is [E1, E1, E2, E3, E3, E4, E2, E4, E5]. Each log sequence is regarded as an event node. According to the order of occurrence, this log sequence is transformed into a time directed graph, such as Figure 2 As shown. In a directed graph, the adjacency matrix A is a matrix element a(i,j) = 1 when there is a node i pointing to node j; if not, a(i,j) = 0. Conversely, when node j points to node i, it is represented by a matrix element a(j,i) = 1; if not, a(j,i) = 0. According to Figure 1 As shown, A = [1,1,0,0,0; 0,0,1,1,0; 0,0,1,1,0; 0,1,0,0,1; 0,0,0,0,0], construct a symmetric matrix for A, which is the first-order neighbor similarity matrix A F .

[0053] A F =Asys=[1 1 0 0 0 1 0 1 1 0 0 1 1 1 0 0 1 1 0 1 0 0 0 1 0]

[0054] Second-order neighbor similarity matrix

[0055] Constructed according to the following formula:

[0056]

[0057] For the second-order neighbor similarity matrix A 入 Unit A 入 (i, j), there exists a node k that has directed edges connecting nodes i and j and pointing to itself, and the edge weights are accumulated. k,irepresents the weight value of the k→i edge. If there is a directed edge, A k,i =1, otherwise A k,i =0; similarly, A k,j Represents the weight value of the k→j edge.

[0058] For the second-order neighbor similarity matrix A 出 Unit A 出 (i,j), there are directed edges connecting node k and pointing to nodes i and j respectively, and the edge weights are accumulated. i,k Represents the weight value of the i→k edge. If there is a directed edge, A i,k =1, otherwise A i,k =0; similarly, A j,k Represents the weight value of the j→k edge.

[0059] A k,v Indicates whether there is a directed edge from any node v in the node set to the common node k. If so, the weight is 1, otherwise it is 0, and then the sum is accumulated. v，k Indicates whether there is a directed edge from a common node k to any node v in the node set. If so, the weight is 1, otherwise it is 0, and then the sum is accumulated.

[0060] A 入 =[0.5 0 0 0 0; 0 0 0 0 0; 0 0 1 0.5 0; 0 0 0.5 0 0; 0 0 0 0 0]

[0061] A 出 =[1 0 0 0 0; 0 0 0.5 0 0; 0 0.5 1 0 0; 0 0 0 0 0; 0 0 0 0 0]

[0062] One-hot encoding is used for event node features, and node events are normal and abnormal: normal [1,0], abnormal [0,1].

[0063] The content of the node event log is consistent with the node ID. For a normal log sequence [E1, E1, E2, E3, E3, E4, E2, E4, E5], the one-hot encoding of each node is:

[0064] The E1 log content is expressed as [1,0,1,0,0,0,0]

[0065] The E2 log content is represented as [1,0,0,1,0,0,0]

[0066] The E3 log content is represented as [1,0,0,0,1,0,0]

[0067] E4 log content is represented as [1,0,0,0,0,1,0]

[0068] E5 log content is represented as [1,0,0,0,0,0,1]

[0069] The feature matrix X is formed as: [1 0 1 0 0 0 0 1 0 0 1 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 1 0 1 0 0 0 0 0 1]

[0071] The multi-layer neighbor similarity matrix convolution is

[0072]

[0073]

[0074]

[0075] Similar to the undirected graph degree matrix,

[0076] D 入 represents the degree matrix of the in-degree directed graph, D 出 Represents the degree matrix of a directed graph.

[0077] Log sequence node E i Analysis of causal correlation between feature content, similar to the shortest node path search: Causal relationship between nodes: If a series of causal transmission relationships occur between log sequence nodes, the probability of abnormal logs increases, and an attention mechanism needs to be used. Please refer to Figure 3 . Log sequence node E i Analysis of causal correlation between feature content, similar to the shortest node path search: i，j Indicates the causal relationship i→j. If a direct causal relationship occurs, p i，j = 0, otherwise p ij =0(i≠j); p i，j =0(i=j). If the causal relationship exists and passes through an intermediate node k, that is, i→k→j, then p ij =0.5, and so on.

[0078] For the above log sequence [E1,E1,E2,E3,E3,E4,E2,E4,E5], its causal probability matrix is

[0079] p=[0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0]

[0080]

[0081]

[0082]

[0083] For the two-layer graph convolutional neural network model,

[0084]

[0085] The graph convolutional neural network model uses the optimized path search GTN attention mechanism to calculate the attention score from node i to node j. Attention probability value When calculating the attention probability value, the source node itself is excluded. With the attention probability, the weighted average of the node features can be calculated. Considering the path features, the node output feature is a function of the node features and the path features, so we have

[0086]

[0087] Calculate the error loss function That is, the difference between the training parameter value and the actual parameter value.

[0088] Implement the graph neural network model based on Python 3.8.5, set the graph encoder size to 1, the feedforward network size of the encoder layer output to 1024, use AdamW to optimize the training model, use linear learning rate decrease, and start learning rate 3×10 -4 , the final learning rate is 3×10 -9 The batch size is 64, the drop rate is 0.3, and the cross entropy is used as the loss function. The number of iterations is 100. This was done on an AMD Ryzen 3.5GHz CPU, 96GB of memory, and a LINUX server with an operating system version of Ubuntu 20.04.

[0089] This embodiment performs an abnormality detection test on the hospital cabinet inpatient self-service terminal device ZYY304 and the hospital wall-mounted self-service terminal device ZTT501. The test results are shown in Table 3.

[0090] Hospital cabinet inpatient self-service terminal equipment ZYY304

[0091] 1) Starting from the current time, input the log data from the previous week and predict the abnormal situation of the terminal equipment in the next hour.

[0092] 2) Starting from the present time, input the log data of the previous 12 months to predict the abnormal situation of terminal equipment in the next month.

[0093] Hospital wall-mounted self-service terminal equipment ZTT501

[0094] 1) Starting from the present time, input the log data of the previous week and predict the abnormal situation of the wall-mounted equipment in the next hour.

[0095] 2) Starting from the present time, input the log data of the previous year for 12 months and predict the abnormal situation of the wall-mounted terminal equipment in the next month.

[0096] Table 3

[0097]

[0098]

[0099] The above is a detailed introduction to the hospital self-service terminal log anomaly detection system based on a directed graph convolutional neural network provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network, characterized in that: include A log data collection module, used to collect log data from the self-service terminal system; The log data preprocessing and storage module is used for data cleaning and deletion of irrelevant data information. After the cleaning is completed, the log data is stored in a table; Used to structure unstructured log data to form a log information data warehouse; Log data parsing module, used to convert the message content in the original log into a structured event template; The log data analysis and prediction module is used to predict abnormal events of the self-service terminal system in the future after analyzing and calculating the log data using the directed graph neural network DGCN log anomaly detection algorithm; The log exception alarm module is used to alarm for predicted abnormal events; After analyzing and calculating the log data using the directed graph neural network DGCN log anomaly detection algorithm, the abnormal events of the future self-service terminal system are predicted, specifically including the following: (1) Establish a time directed graph structure: Arrange the logs in time order and divide them into segments to form log sequences. For each log sequence, establish a time directed graph structure. (2) Construct the adjacency matrix, first-order neighbor similarity matrix and second-order neighbor similarity matrix of the time directed graph; (3) Neighborhood similarity matrix convolution of directed graph convolutional neural network model: The first-order neighbor similarity matrix and the second-order neighbor similarity matrix are respectively input into the directed graph convolutional neural network model to obtain the corresponding neighbor similarity matrix convolution results; (4) The convolution result of the neighbor similarity matrix constructs the directed graph degree matrix: Among them, A F (i,j) is the first-order neighbor similarity matrix unit, A 入 (i,j) is the second-order neighbor similarity matrix unit, A 出 (i,j) second-order neighbor similarity matrix unit; (5) Use the GTN attention mechanism based on causality optimization to calculate the feature matrix and connect it to output the feature results: The node characteristics of node i in layer l-1 are The feature matrix of the l-1 layer nodes is After connection, the feature matrix of the l-layer nodes is For the two-layer graph convolutional neural network model, the output is In the GTN attention mechanism based on causal relationship optimization, if a series of causal transmission relationships occur between log sequence nodes, the probability of abnormal logs increases, and the GTN attention mechanism needs to be adopted; the log sequence node E i Analysis of causal correlation between characteristic content: p i，j Indicates the causal relationship i→j. If a direct causal relationship occurs, p i，j =1, otherwise p i，j =0(i≠j); p i，j =0(i=j); if the causal relationship exists, it passes through an intermediate node k, that is, i→k→j, p i，j =0.5, and so on; in the optimization of GTN attention mechanism based on causality, is the input node feature matrix, n is the number of nodes, F n is the node feature dimension, p is the node pair causal relationship feature matrix, F p is the node causal feature dimension; at each layer, the node features are updated by calculating the weighted average using the learned attention weights; let Indicates the features of the l-layer nodes; F m Number of model features, h0 = WX T For the linear transformation feature input, calculate the attention score value from node i to node j Attention probability value Calculate the weighted average of the node features. The node output feature is a function of the node feature and the path feature. Then we have (6) Use the error loss function to estimate the error between the training parameter value and the actual parameter value, and return the iteration.

2. According to claim 1, the hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network is characterized in that: The (1) establishing a time directed graph structure is specifically as follows: arranging the logs in time order, with each 100 logs or 60 logs forming a log sequence; for each log sequence, forming a time directed graph structure G(V, Fd), where V is a node set and Fd is a node directed edge set.

3. According to claim 2, the hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network is characterized in that: The (2) constructs the adjacency matrix, the first-order adjacency similarity matrix and the second-order adjacency similarity matrix of the time directed graph, specifically: the adjacency matrix is ​​A; the adjacency matrix A is defined as: if node i points to node j, it is represented by matrix element a(i, j)=1, if not, then a(i, j)=0; conversely, if node j points to node i, it is represented by matrix element a(j, i)=1, if not, then a(j, i)=0; construct a symmetric matrix for A as the first-order adjacency similarity matrix A F , the second-order neighbor similarity matrix is ​​constructed according to the following formula Among them, A k，i Represents the weight value of the k→i edge, A k，j Represents the weight value of the k→j edge, A i，k Represents the weight value of the i→k edge, A j，k Represents the weight value of the j→k edge, A k，v Indicates whether there is a directed edge from any node v in the node set to the common node k. If so, the weight is 1, otherwise it is 0; A v,k Indicates whether there is a directed edge from a common node k to any node v in the node set. If so, the weight is 1, otherwise it is 0.

4. The hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network according to claim 3 is characterized in that: The neighbor similarity matrix convolution of the directed graph convolutional neural network model (3) is specifically: X is the node feature vector, W is the weight matrix, and f is the activation function.

5. According to claim 4, the hospital self-service terminal log anomaly detection system based on directed graph convolutional neural network is characterized in that: The error loss function in (6) is used to estimate the error between the training parameter value and the actual parameter value, and the error loss function in the returned iteration is: The trained directed graph convolution neural model is used to detect log anomalies. The judgment standard is based on the Gaussian distribution law of the error between the predicted value and the true value. The number of training samples is N, the mean is μ, and the standard deviation is σ. The mathematical formula for the confidence interval of 98.21% is: If the error falls within the confidence interval, it means the test result is normal, otherwise it is considered abnormal.

Images