Anomaly detection methods, devices, equipment, storage media, and computer program products

Abstract

This application discloses an anomaly detection method, apparatus, device, storage medium, and computer program product, relating to the field of system operation and maintenance technology. The anomaly detection method includes: acquiring a log to be detected; dividing the log to be detected into multiple log template sequences; inputting each of the log template sequences into a preset vector transformation model to obtain a log template vector for each of the log template sequences; inputting each of the log template vectors into a preset classification model to obtain a log type for each of the log template vectors; and inputting an anomaly template vector into a preset anomaly localization model to obtain anomaly log information in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector among the log template vectors whose log type is an anomaly log type. This application can improve the efficiency of log anomaly detection.

Description

Technical Field

[0001] This application relates to the field of system operation and maintenance technology, and in particular to anomaly detection methods, devices, equipment, storage media and computer program products. Background Technology

[0002] Operational logs, as crucial records generated during system operation, play a vital role in ensuring system stability, timely problem detection, and business continuity. Log anomaly detection involves analyzing past program logs to infer whether errors have occurred in the program or whether errors are likely to occur in the future. The aim is to help operations personnel locate problems and mitigate losses in a timely manner.

[0003] Currently, log anomaly detection solutions mainly include the following methods:

[0004] The first approach is to obtain the raw log data and preprocess it to obtain the log template after dividing the session. Then, extract sentence vectors from the log templates and predict the possible log sequences in the future based on the sentence vectors.

[0005] The second approach is to parse the logs into templates, extract the log template frequency vector set, and then generate a log sequence based on the log template frequency vector set as a prediction of the future. Based on the prediction, it is determined whether the logs are abnormal.

[0006] The third approach is to use word segmentation tools to perform word frequency statistics on the words in the logs. Based on the word frequencies of different words after segmentation, multiple classification models are used to predict anomalies, and the prediction results of each classification model are fused by voting to obtain the anomaly detection results.

[0007] However, all of the above methods require anomaly checks on all log information in the original log, resulting in low anomaly detection efficiency and wasted computing resources.

[0008] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0009] The main objective of this application is to provide an anomaly detection method, apparatus, device, storage medium, and computer program product, which aims to solve the technical problem of low log detection efficiency.

[0010] To achieve the above objectives, this application proposes an anomaly detection method, the method comprising:

[0011] Obtain the log to be detected and divide the log to be detected into multiple log template sequences;

[0012] Each of the log template sequences is input into a preset vector transformation model to obtain the log template vector for each of the log template sequences.

[0013] Each of the log template vectors is input into a preset classification model to obtain the log type of each log template vector.

[0014] The abnormal template vector is input into a preset abnormal location model to obtain the abnormal log information in the log to be detected corresponding to the abnormal template vector, wherein the abnormal template vector is a vector of the log type of abnormal log among the log template vectors.

[0015] In one embodiment, the step of dividing the log to be detected into multiple log template sequences includes:

[0016] The log to be detected is input into the log parsing model to obtain at least one log template;

[0017] The log to be detected is divided into multiple sequences to be detected according to a preset time interval;

[0018] For any target sequence in each of the sequences to be detected, replace each original log message in the target sequence with the at least one log template to obtain a log template sequence.

[0019] In one embodiment, the step of replacing each original log entry in the target test sequence with the at least one log template to obtain a log template sequence includes:

[0020] For any target log information in each of the original log information entries, determine the matching degree between the target log information and the at least one log template;

[0021] The target log information is replaced with a log template whose matching degree is greater than a preset threshold from the at least one log template.

[0022] In one embodiment, the vector transformation model includes an encoder;

[0023] The step of inputting each of the log template sequences into a preset vector transformation model to obtain the log template vector for each of the log template sequences includes:

[0024] For any log template sequence in each of the log template sequences, the log template sequence is segmented to obtain the word vector of each word in the log template sequence, and the position information of each word in the log template sequence is determined;

[0025] The word vectors of each word and the location information are input into the encoder to obtain the location vector and the template vector. The location vector and the template vector are used as the log template vector.

[0026] In one embodiment, the classification model includes convolutional blocks, activation functions, pooling layers, fully connected layers, and normalization functions;

[0027] The step of inputting each of the log template vectors into a preset classification model to obtain the log type of each log template vector includes:

[0028] For any target template vector among the log template vectors, the target template vector is input into the convolutional block to obtain the region features;

[0029] The region features are input into the activation function to obtain the first feature;

[0030] The first feature is input into the pooling layer to obtain the second feature;

[0031] If the sequence length of the second feature is detected to be greater than the preset stride, the second feature is input into the convolutional block until the sequence length of the output feature of the convolutional block is less than or equal to the preset stride, and the target feature is obtained.

[0032] The target features are input into the fully connected layer to obtain the category score vector;

[0033] The category score vector is input into the normalization function to obtain the category probability of each of the log types, and the log type of the target template vector is determined based on the category probability of each of the log types.

[0034] In one embodiment, the anomaly localization model includes a feature extraction layer and a prediction layer;

[0035] The step of inputting the anomaly template vector into a preset anomaly localization model to obtain the anomaly log information in the log to be detected corresponding to the anomaly template vector includes:

[0036] The abnormal template vector is input into the feature extraction layer, and the current window template feature of the abnormal template vector is determined by the sliding window of the feature extraction layer.

[0037] The current window template features are input into the prediction layer to obtain the next window prediction vector;

[0038] If the predicted vector for the next window is inconsistent with the actual vector for the next window determined based on the sliding window, then the log information in the log to be detected that corresponds to the actual vector for the next window is determined to be the abnormal log information.

[0039] Furthermore, to achieve the above objectives, this application also proposes an anomaly detection device, which includes:

[0040] The acquisition module is used to acquire the logs to be detected and divide the logs to be detected into multiple log template sequences;

[0041] The vector conversion module is used to input each of the log template sequences into a preset vector conversion model to obtain the log template vector of each of the log template sequences.

[0042] The classification module is used to input each of the log template vectors into a preset classification model to obtain the log type of each of the log template vectors.

[0043] An anomaly localization module is used to input an anomaly template vector into a preset anomaly localization model to obtain the anomaly portion in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector of log type anomaly log type among the log template vectors.

[0044] In addition, to achieve the above objectives, this application also proposes an anomaly detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the anomaly detection method as described above.

[0045] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the anomaly detection method described above.

[0046] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the anomaly detection method described above.

[0047] In this application, a log to be detected is obtained, and the log to be detected is divided into multiple log template sequences; each log template sequence is input into a preset vector transformation model to obtain a log template vector for each log template sequence; each log template vector is input into a preset classification model to obtain a log type for each log template vector; an anomaly template vector is input into a preset anomaly localization model to obtain anomaly log information in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector of log type with an anomaly log type among the log template vectors.

[0048] In this application, log template vectors are classified, and the abnormal template vectors determined after classification are input into a preset abnormal location model for abnormal detection. Compared with performing abnormal prediction on each log information of the log to be detected, this application can reduce the amount of data processed during abnormal detection, thereby improving the efficiency of log abnormal detection.

[0049] Furthermore, by parsing logs into templates, this application reduces the computational load of analyzing sequence features in the anomaly detection model, thereby reducing the number of times the anomaly detection model is run when processing normal log sequences, and thus improving the efficiency of log anomaly detection.

[0050] Meanwhile, in this application, when performing log classification and anomaly localization, the log template vector of the log template sequence is reused, which can reduce the operation steps of converting the sequence into a vector during log classification and anomaly localization, thereby improving the processing efficiency of log classification and anomaly localization and improving the efficiency of log anomaly detection. Attached Figure Description

[0051] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a flowchart illustrating an embodiment of the anomaly detection method of this application.

[0054] Figure 2 This is a flowchart illustrating Embodiment 2 of the anomaly detection method of this application;

[0055] Figure 3 A simplified flowchart illustrating the anomaly detection method provided in Embodiment 1 of this application;

[0056] Figure 4 A schematic diagram of the structure of a classification model provided in one embodiment of this application;

[0057] Figure 5 A schematic diagram of the attention mechanism structure in an anomaly localization model provided in one embodiment of this application;

[0058] Figure 6 This is a schematic diagram of the module structure of the anomaly detection device according to an embodiment of this application;

[0059] Figure 7This is a schematic diagram of the device structure of the hardware operating environment involved in the anomaly detection method in this application embodiment.

[0060] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0061] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0062] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0063] The main solution of this application embodiment is as follows: acquire the log to be detected, divide the log to be detected into multiple log template sequences; input each of the log template sequences into a preset vector transformation model to obtain the log template vector of each of the log template sequences; input each of the log template vectors into a preset classification model to obtain the log type of each of the log template vectors; input the abnormal template vector into a preset abnormal location model to obtain the abnormal log information in the log to be detected corresponding to the abnormal template vector, wherein the abnormal template vector is the vector of the log type of abnormal log among the log template vectors.

[0064] In this embodiment, for ease of description, the following description uses an anomaly detection device as the execution subject.

[0065] Log anomaly detection analyzes past program logs to infer whether errors have occurred in the program or whether errors are likely to occur in the future. Its purpose is to help operations and maintenance personnel locate problems and mitigate losses in a timely manner. The typical process involves establishing a log template library and extracting templates, metrics, and other data from the logs as analytical material. Then, statistical methods, traditional machine learning, and deep learning can be used to analyze the templates and metrics. Log anomaly detection typically uses self-supervised training models, and the detection method involves judging whether the current number of templates or metrics are abnormal, or predicting future log template and metric conditions and comparing them with the actual situation.

[0066] Current log anomaly detection solutions mainly include:

[0067] Option 1: First, acquire the raw log data and preprocess it to obtain log templates after session segmentation. Then, extract sentence vectors from the log templates using a pre-trained BERT (Bidirectional Encoder Representations from Transformers) method. Use Informer (a Long Short-Term Forecast network based on Transformer architecture) as the anomaly detection model to analyze the template sequence. Next, input the template sequence feature encoding with semantic and positional information into the pre-established anomaly detection model for training to predict possible future log sequences.

[0068] However, this method requires checking the logs segment by segment or sentence by sentence. In reality, the number of abnormal logs is less than the number of normal logs. This method causes the anomaly detection to check unnecessary normal logs, reducing the efficiency of anomaly detection.

[0069] Furthermore, the Informer-Encoder reduces computation by randomly sampling factors to participate in the dot product operation. In scenarios with small datasets, random sampling may cause the model to ignore important features in the sequence, resulting in reduced accuracy of subsequent anomaly detection results.

[0070] Option 2: Parse the logs into templates, then use Bi-GRU (Bidirectional Gated Recurrent Units) to extract the log template frequency vector set, and then use another Bi-GRU to generate a log sequence as a prediction sequence based on the log template frequency vector set. Determine whether the logs are abnormal based on the difference between the prediction sequence and the actual sequence.

[0071] However, this method requires checking the logs segment by segment or sentence by sentence. In reality, the number of abnormal logs is less than the number of normal logs. This method causes the anomaly detection to check unnecessary normal logs, reducing the efficiency of anomaly detection.

[0072] Furthermore, Bi-GRU cannot efficiently acquire long-distance correlations in long log template sequences.

[0073] Option 3: Use word segmentation tools to perform word frequency statistics on the words in the logs. Based on the word frequencies of different words after segmentation, use multiple classification models to predict anomalies, and then perform a voting fusion of the prediction results to obtain the anomaly detection result. For example, the classification method can simultaneously use three traditional machine learning models: xgboost (eXtreme Gradient Boosting), KNN (K-Nearest Neighbor), and Naive Bayes.

[0074] However, this method requires checking the logs segment by segment or sentence by sentence. In reality, the number of abnormal logs is less than the number of normal logs. This method causes the anomaly detection to check unnecessary normal logs, reducing the efficiency of anomaly detection.

[0075] Furthermore, this approach requires complex feature engineering. In addition to conventional log template extraction, it also requires preprocessing operations such as TF-IDF (Term Frequency-Inverse Document Frequency) statistics and PCA (Principal Component Analysis) dimensionality reduction. Moreover, multiple steps require parameter tuning, which affects the efficiency of anomaly detection.

[0076] Furthermore, using word frequency statistics to determine whether logs are abnormal does not take advantage of the characteristics of log order, and cannot determine whether logs are abnormal based on different log orders. At the same time, this method cannot locate abnormal logs.

[0077] Option 4: Use a word segmentation tool to convert multiple original logs into word vectors, then input them into a trained neural network model. The neural network model outputs log anomaly detection results.

[0078] However, this method requires checking the logs segment by segment or sentence by sentence. In reality, the number of abnormal logs is less than the number of normal logs. This method causes the anomaly detection to check unnecessary normal logs, reducing the efficiency of anomaly detection.

[0079] Meanwhile, the model input in this method consists of multiple log sequences, making it impossible to pinpoint which specific log entry is erroneous during anomaly detection.

[0080] In summary, existing log detection methods have high computational complexity, which affects the efficiency of anomaly detection, and some methods cannot locate abnormal logs.

[0081] In this embodiment, by classifying log template vectors, the abnormal template vectors determined after classification are input into a preset abnormal location model for abnormal detection. Compared with performing abnormal prediction on each log information of the log to be detected, this application can reduce the amount of data processed during abnormal detection, thereby improving the efficiency of log abnormal detection.

[0082] Furthermore, in this embodiment of the application, during the anomaly detection process using the anomaly localization model, the anomaly log information in the anomaly log is simultaneously determined, thereby improving the anomaly detection efficiency.

[0083] Furthermore, by parsing logs into templates, this application reduces the computational load of analyzing sequence features in the anomaly detection model, thereby reducing the number of times the anomaly detection model is run when processing normal log sequences, and thus improving the efficiency of log anomaly detection.

[0084] Meanwhile, in this embodiment of the application, when performing log classification and anomaly localization, the log template vector of the log template sequence is reused, which can reduce the operation steps of converting the sequence into a vector during log classification and anomaly localization, thereby improving the processing efficiency of log classification and anomaly localization and improving the efficiency of log anomaly detection.

[0085] Compared to the existing solutions described above, the embodiments of this application employ a simple classification-to-step prediction anomaly detection strategy, filtering out the vast majority of normal log sequences in real-world scenarios from anomaly detection. Simultaneously, anomaly detection can serve as a check; when the classification model determines a sequence is abnormal, but the anomaly detection model does not detect anomalies, the sequence is determined to be normal. This reduces the number of times the anomaly detection model is run when processing normal log sequences, thereby improving the efficiency of log anomaly detection.

[0086] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or anomaly detection device capable of performing the above functions. The following description uses an anomaly detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0087] Based on this, embodiments of this application provide an anomaly detection method, referring to... Figure 1 This is a flowchart illustrating the first embodiment of the anomaly detection method of this application.

[0088] In this embodiment, the anomaly detection method includes steps S10 to S40.

[0089] Step S10: Obtain the log to be detected and divide the log to be detected into multiple log template sequences.

[0090] It should be noted that the log to be detected is the log that needs to be checked for anomalies. The log to be detected can include multiple log messages, and there is no limit to this.

[0091] A log template sequence is a sequence obtained by replacing each date information in the log to be tested with a log template. The order of each template in the log template sequence is the same as the order of the log information corresponding to that template in the log.

[0092] Specifically, the process of dividing the log to be detected into multiple log template sequences can be as follows: extract log templates from the log to be detected and replace the original log information with the log templates. The method of extracting log templates from the log to be detected is not limited here. For example, it can be done by extracting log templates through a log parsing model, or by extracting common information from each log message and generating log templates based on the data type of the common information in each log message.

[0093] Step S20: Input each log template sequence into a preset vector transformation model to obtain the log template vector for each log template sequence.

[0094] In this embodiment, a preset vector transformation model is obtained by using the sample sequence as input data and the sample vector corresponding to the sample sequence as the label. There are no restrictions on the structure of the vector transformation model. For example, it can be the BERT model.

[0095] The log template sequence is input into the vector transformation model, which then transforms the log template sequence into a vector, hereinafter referred to as the log template vector.

[0096] Step S30: Input each log template vector into the preset classification model to obtain the log type of each log template vector.

[0097] In this embodiment, a preset classification model is trained by using sample vectors as input data and the log type of the sample vectors as labels. There are no restrictions on the structure of the vector transformation model here, and it can be set according to actual needs.

[0098] Each log template vector is input into a classification model, which then determines the log type corresponding to each template vector. The log type is either a normal log type or an abnormal log type. The log type indicates whether abnormal log information exists in the log information corresponding to the log template vector. A normal log type indicates that there is no abnormal log information in the log information corresponding to the template vector, while an abnormal log type indicates that there is abnormal log information in the log information corresponding to the template vector.

[0099] Step S40: Input the anomaly template vector into the preset anomaly localization model to obtain the anomaly log information in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is the vector of the log type of anomaly log in each log template vector.

[0100] In this embodiment, a preset anomaly localization model is trained by using anomaly sample vectors as input data and the abnormal parts in the logs corresponding to the anomaly sample vectors as labels. Here, the anomaly sample vector is a vector of log type with anomaly log type in each sample vector. There are no restrictions on the structure of the vector conversion model here, and it can be set according to actual needs.

[0101] The vectors in each log template vector that have the log type of "abnormal log" are referred to as "abnormal template vectors". These abnormal template vectors are then input into the anomaly localization model to obtain the abnormal log information in the log to be detected corresponding to the abnormal template vectors.

[0102] In this embodiment, by classifying the log template vectors, the abnormal template vectors determined after classification are input into a preset abnormal location model for abnormal detection. Compared with performing abnormal prediction on each log information of the log to be detected, this application can reduce the amount of data processed during abnormal detection, thereby improving the efficiency of log abnormal detection.

[0103] Furthermore, the anomaly localization model simultaneously identifies the anomaly log information in the anomaly log during the anomaly detection process, thereby improving the efficiency of anomaly detection.

[0104] Furthermore, this embodiment reduces the computational load of analyzing sequence features in the anomaly detection model by parsing logs into templates, thereby reducing the number of times the anomaly detection model processes normal log sequences and improving the efficiency of log anomaly detection.

[0105] Meanwhile, in this embodiment, when performing log classification and anomaly localization, the log template vector of the log template sequence is reused, which can reduce the operation steps of converting the sequence into a vector during log classification and anomaly localization, thereby improving the processing efficiency of log classification and anomaly localization and improving the efficiency of log anomaly detection.

[0106] In some feasible implementations, step S10 includes steps S101 to S103.

[0107] Step S101: Input the log to be detected into the log parsing model to obtain at least one log template.

[0108] It should be noted that a log template is a framework for recording and organizing log entries. Log templates can help users collect, organize, store, and analyze log data in a consistent and efficient manner.

[0109] In this embodiment, log templates are extracted using the Drain (Depth Tree based Online LogParsing) log parsing model. The specific process is as follows: First, the log data to be detected is divided into constant and variable parts. The constant part contains template information describing system running events, while the variable part carries other marker information of the system's dynamic operation. Then, a parse tree with a set depth is constructed. By matching the log data to be detected with the nodes in the parse tree layer by layer, the parse tree can be dynamically updated and the log parsing results can be generated, thereby obtaining the log template.

[0110] Step S102: Divide the log to be detected into multiple sequences to be detected according to a preset time interval.

[0111] It should be noted that the preset time interval can be set according to actual needs. For example, it can be set to make the length of each detected sequence obtained by division average.

[0112] For example, in one feasible implementation, the log to be detected may be divided into multiple sequences to be detected by using a time window.

[0113] Step S103: For any target sequence to be tested in each sequence to be tested, replace each original log information in the target sequence to be tested with at least one log template to obtain a log template sequence.

[0114] It should be noted that each original log message in the target test sequence can correspond to the same log template or different log templates; no restriction is imposed here.

[0115] When replacing each original log entry in the target test sequence with a log template, you can use the log template with the highest matching degree to replace the original log entry.

[0116] It should be noted that the raw log information also includes a variable section, and the date information in the variable section can be represented by placeholders in the log template.

[0117] In some feasible implementations, step S103 includes steps S1031 to S1032.

[0118] Step S1031: For any target log information in each original log information, determine the matching degree between the target log information and at least one log template.

[0119] There are no restrictions on how the matching degree is calculated. For example, it can be determined based on the regular expression between the target log information and the log template, or it can be based on the character similarity between the target log information and the log template.

[0120] Step S1032: Replace the target log information with at least one log template whose matching degree is greater than a preset threshold.

[0121] In this embodiment, by extracting a log template and replacing the original log information with the log template, compared to processing each original log message, this embodiment reduces the computational load of analyzing sequence features during anomaly detection and improves the efficiency of anomaly detection.

[0122] In this embodiment, by classifying the log template vectors, the abnormal template vectors determined after classification are input into a preset abnormal location model for abnormal detection. Compared with performing abnormal prediction on each log information of the log to be detected, this application can reduce the amount of data processed during abnormal detection, thereby improving the efficiency of log abnormal detection.

[0123] Furthermore, in this embodiment, during the anomaly detection process using the anomaly localization model, the anomaly log information in the anomaly log is simultaneously determined, thereby improving the anomaly detection efficiency.

[0124] Furthermore, this embodiment reduces the computational load of analyzing sequence features in the anomaly detection model by parsing logs into templates, thereby reducing the number of times the anomaly detection model processes normal log sequences and improving the efficiency of log anomaly detection.

[0125] Meanwhile, in this embodiment, the log template vector of the log template sequence is reused when performing log classification and anomaly location. This can reduce the operation steps of converting the sequence into a vector during log classification and anomaly location, thereby improving the processing efficiency of log classification and anomaly location, and improving the efficiency of log anomaly detection.

[0126] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 The vector transformation model includes an encoder, and step S20 includes steps S201 to S202.

[0127] Step S201: For any log template sequence in each log template sequence, perform word segmentation on the log template sequence to obtain the word vector of each word in the log template sequence, and determine the position information of each word in the log template sequence.

[0128] In this embodiment, the vector transformation model can be the BERT model, which uses the encoder layer of the Transformer model to extract features. The training process of the BERT model includes two stages: pre-training and fine-tuning. In the pre-training stage, the BERT model learns word-level and sentence-level features by performing the Masked Language Model task and the Next Sentence Prediction task, and represents the features as vectors.

[0129] In this embodiment, during the vector transformation process using the BERT model, the log template sequence is first segmented to obtain word vectors for each word in the log template sequence, providing a foundation for subsequent template vectors. The positional information of each word in the log template sequence is then determined, providing a foundation for subsequent positional vectors.

[0130] Step S202: Input the word vectors and position information of each word into the encoder to obtain position vectors and template vectors, and use the position vectors and template vectors as log template vectors.

[0131] It should be noted that an encoder can contain multiple self-attention mechanisms and feedforward neural network layers. The self-attention mechanisms and feedforward neural network layers work together to capture contextual information in the input sequence.

[0132] During the pre-training phase, in the Masked Language Model task, the BERT model randomly selects some templates and replaces them with a mask, then predicts these masked templates based on the context. In this way, the model can learn the contextual relationships between words. In the Next Sentence Prediction task, the BERT model performs a sentence-level task, determining whether two template sequences are consecutive, to capture the correlation between sequences. After pre-training, the BERT model can output sentence vectors corresponding to the template sequences. These sentence vectors contain information about the template vectors and position vectors, reflecting the contextual relationships of the templates in the sequence.

[0133] During the fine-tuning phase, the BERT model is trained using a labeled, task-specific dataset that contains label information relevant to the specific log anomaly detection task. Based on the objective function of the specific task, the model parameters are optimized during the fine-tuning phase to enable the model to better adapt to the log anomaly detection task.

[0134] Therefore, in this embodiment, the sentence vector obtained by feature extraction through the BERT model includes a template vector (LogKey Embedding) and a position vector between templates (Position Embedding). The template vector represents the semantic information of each template, while the position vector provides the position information of the template in the sequence.

[0135] In some feasible implementations, the classification model includes convolutional blocks, activation functions, pooling layers, fully connected layers, and normalization functions, and step S30 includes steps S301 to S306.

[0136] Step S301: For any target template vector in each log template vector, input the target template vector into the convolutional block to obtain the region features.

[0137] Convolutional layers are the core of convolutional neural networks, responsible for extracting features from the input data. During convolution, each convolutional kernel slides across the input data, performing dot product operations to generate feature maps. These feature maps capture the regional features of the target template vector. In this implementation, the specifications of the convolutional kernels are not limited.

[0138] It should be noted that, in one feasible implementation, the target template vector may include a position vector and a template vector. In this implementation, the position vector and the template vector may be summed into a single vector before convolutional layer.

[0139] Step S302: Input the region features into the activation function to obtain the first feature.

[0140] It should be noted that after the convolution operation, an activation function is used to perform a nonlinear transformation on the output of the convolutional layer. The activation function can be ReLU (Rectified Linear Unit), sigmoid (logistic function), tanh (Hyperbolic Tangent function), etc. There are no restrictions here. The activation function can increase the nonlinear expressive power of the network.

[0141] Step S303: Input the first feature into the pooling layer to obtain the second feature.

[0142] After the activation function, a pooling layer is used to downsample the feature map to reduce the spatial resolution of the data, thereby reducing the number of parameters and preventing overfitting. In one feasible implementation, a max pooling layer can be used, where the max pooling layer takes the maximum value in each pooling window as the output.

[0143] Step S304: If the sequence length of the second feature is detected to be greater than the preset stride, the second feature is input into the convolutional block until the sequence length of the output feature of the convolutional block is less than or equal to the preset stride, and the target feature is obtained.

[0144] It should be noted that in this embodiment, by controlling the sequence length of the target features, the granularity of the information is controlled. A shorter sequence length helps to reduce the subsequent amount of computation and storage space usage, thereby improving the efficiency of anomaly detection.

[0145] In specific implementations, the preset step size can be set according to actual needs, and no restrictions are imposed here.

[0146] Step S305: Input the target features into the fully connected layer to obtain the category score vector.

[0147] It should be noted that each element in the category score vector represents the score corresponding to different log types, and the score can represent the probability that the target template vector is the corresponding log type.

[0148] Step S306: Input the category score vector into the normalization function to obtain the category probability of each log type, and determine the log type of the target template vector based on the category probability.

[0149] It should be noted that the log type with the highest probability among all types can be determined as the log type of the target template vector.

[0150] In one feasible embodiment, the anomaly localization model includes a feature extraction layer and a prediction layer; step S40 includes steps S401 to S402.

[0151] Step S401: Input the abnormal template vector into the feature extraction layer to obtain the current window template features within the preset sliding window.

[0152] The abnormal template vector is input into the feature extraction layer. The feature extraction layer slides a preset sliding window over the normal template vector, extracting the feature representation of the data within the window each time. This is referred to as the current window template feature for distinction.

[0153] In specific implementations, the length of the sliding window can be set according to actual needs and is not limited here.

[0154] Step S402: Input the current window template features into the prediction layer to obtain the prediction vector for the next window.

[0155] Based on the features of the current window template, a neural network is used for prediction, such as a fully connected layer, LSTM (Long Short-Term Memory), or GRU (Gated Recurrent Unit), to output a prediction candidate set, which represents the probability of each log template appearing in the next window. The template vector corresponding to the log template with the highest probability is then used as the prediction vector for the next window.

[0156] Step S403: If the predicted vector of the next window is inconsistent with the actual vector of the next window of the sliding window, then the log information corresponding to the actual vector of the next window is determined to be abnormal log information.

[0157] It should be noted that the actual vector of the next window refers to the template vector corresponding to the actual log template that appears in the next window.

[0158] If the predicted vector for the next window is inconsistent with the actual vector for the next window of the sliding window, it indicates that the actual vector for the next window is inconsistent with the expected result, and the log information corresponding to the actual vector for the next window is determined to be abnormal log information.

[0159] If the predicted vector for the next window is consistent with the actual vector for the next window of the sliding window, then the log information corresponding to the actual vector for the next window is determined to be normal log information.

[0160] In this embodiment, by parsing logs into templates, the computational load of analyzing sequence features in the anomaly detection model is reduced, thereby reducing the number of times the anomaly detection model processes normal log sequences, and thus improving the efficiency of log anomaly detection.

[0161] For example, to help understand the technical concept or principle of log anomaly detection in combination with Embodiments 1 and 2 above, refer to Figure 3 The anomaly detection process can be as follows:

[0162] Step S1: Obtain the raw log data and preprocess it to obtain the template sequence.

[0163] In the preprocessing step S1, the raw log data is manipulated to perform log parsing and session segmentation, thereby generating a log template sequence. Specifically, the Drain log parsing model is used, and log parsing includes the following process: First, the raw log data is divided into two parts: a constant part and a variable part. The constant part contains template information describing system runtime events, while the variable part carries other marker information about the dynamic operation of the system. Then, a parse tree with a set depth is constructed. By matching the raw log data with nodes in the parse tree layer by layer, the parse tree can be dynamically updated, and the parsing results of the logs can be generated, thereby obtaining the log template information.

[0164] In terms of session segmentation, logs are divided into multiple sequences based on time windows and then replaced using log templates to form multiple log template sequences. The selection of time windows mainly considers the ability to encompass as much of the system's periodic operation as possible, while ensuring that the average sequence length is relatively long.

[0165] Step S2: Input the template sequence into the pre-trained BERT model to obtain sentence vectors.

[0166] The log templates obtained from the session segmentation in step S1 are input into the BERT language model for pre-training. This yields sentence vectors corresponding to the template sequences. For a log template sequence within a session, the encoder layer of the Transformer model is used to extract features. This process involves two training phases: pre-training and fine-tuning. During pre-training, it learns word-level and sentence-level features by performing the Masked Language Model task and the Next Sentence Prediction task, and represents these features as vectors. Specifically, the sentence vectors contain template vectors (LogKey Embedding) and position vectors between templates (Position Embedding).

[0167] Step S3: Classify and predict the template sequence using a classification model.

[0168] Logs are divided into normal logs and abnormal logs, which can be further categorized based on system operation functions or applications. For example, logs might be categorized as: Application 1 Normal, Application 1 Abnormal 1, Application 1 Abnormal 2, Application 1 Abnormal 3, Application 2 Normal, Application 2 Abnormal 1, Application 2 Abnormal 2, and Application 2 Abnormal 3. This implementation uses DPCNN (Deep Pyramid Convolutional Neural Networks for Text Categorization) to train the log template sequence for classification. Specifically, the vectorized model from the anomaly detection model can be reused, saving computational resources. The selection of the classification model is based on the following considerations: lower runtime complexity and time compared to the anomaly detection model; and since the input to the anomaly detection model is a long sequence with complete periodicity, the classification model must have a certain long-distance correlation analysis capability.

[0169] Specifically, DPCNN uses stacked convolutional layers to capture long-range associations in a sequence. For example... Figure 4 As shown, a convolutional block contains two convolutional layers. Whether to cycle through the convolutional block again is determined by whether the length of the sequence entering the convolutional block is greater than 2.

[0170] The training process for a DPCNN model can be as follows:

[0171] Step S31: First, the template vector and the position vector are added together, and then the multiple ordinary single vectors (word embeddings) are transformed into region vectors (region embeddings) through a convolution kernel. Each time, residual connections are used within the convolution block to prevent gradient vanishing and gradient explosion.

[0172] Step S32: Each convolution in the convolutional block must be activated and padded with ReLU before each convolution. The MaxPooling layer in the convolutional block has a stride of 2, and the sequence length is halved during each loop. The convolutional block loop stops when the sequence length reaches 1.

[0173] Step S33: Finally, the class of the output sequence is determined by the fully connected layer, and the probability of each class is calculated using Softmax (Soft Maximum, normalized exponential function). After processing the log data to be detected according to step S1, classification training is performed, and the classification loss is Softmax.

[0174] Step S4: Use an anomaly detection model to locate and predict anomaly logs.

[0175] The anomaly detection model employs a Masked Language Model based on an autocorrelation Transformer (i.e., Autoformer), using the Autoformer encoder to extract features from the template sequence. The autocorrelation mechanism allows the model to learn features of periodic subsequences, thus improving its ability to predict normal sequences. The anomaly detection model is trained using self-supervised training, learning only to predict normal logs. During prediction, a sliding window is used, inputting a portion of the logs to predict subsequent logs. If the actual logs received later differ from the predictions, an anomaly is considered to have occurred at that location. This implementation includes multiple encoder-decoder blocks, one of which has the following structure: Figure 5 As shown.

[0176] Step S41: Construct an anomaly detection model based on autocorrelation mechanism. The anomaly detection model consists of the following modules: an embedding layer, attention layer, residual connection and layer normalization module, feedforward layer, another residual connection and layer normalization module, and a linear layer. The input to this anomaly detection model is the position vector and template vector obtained from the BERT vectorization model in step S2, and its output is the candidate set of possible next log templates.

[0177] First, the sum of the position vector and template vector is transformed into three matrices—QueryQ, KeyK, and ValueV—using a learnable matrix. Since the autocorrelation mechanism focuses on the relationships between subsequences, specifically, for the t-th input sequence, the V matrix comes from the (t-1)-th input sequence, thus leveraging the periodicity of the sequences to analyze their autocorrelation across sequences.

[0178] The anomaly detection model in this implementation uses these three matrices to implement the autocorrelation mechanism in Autoformer. Unlike the self-attention mechanism, which represents the correlation between points, the autocorrelation mechanism represents the correlation between subsequences. Specifically, the autocorrelation mechanism uses Fast Fourier Transform (FFT) to transform Q and K into frequency domain feature matrices, then performs dot product, and the product is then subjected to Inverse Fast Fourier Transform (IFFT) to obtain the autocorrelation coefficient. The formula is as follows:

[0179]

[0180]

[0181]

[0182] in, This represents finding the conjugate tensor. This is the frequency domain feature matrix obtained by performing a Fast Fourier Transform on query Q. R is the frequency domain characteristic matrix obtained by performing a fast Fourier transform on the key K, and R is the autocorrelation coefficient.

[0183] Suppose a sequence contains log templates. To reduce computational complexity, the top k largest autocorrelation coefficients are selected and aggregated with V for time delay information. The aim is to explore the correlation between important subsequences. First, the selection method is to accumulate the elements in the autocorrelation coefficient tensor R. A larger sum indicates a higher autocorrelation score, which is more representative of the sequence's features. This preserves information from the log sequence while reducing computational cost. The formula is as follows:

[0184]

[0185] Wherein, K is calculated as follows: Where c is a hyperparameter. For small autocorrelation coefficients, we use... To replace it.

[0186] Subsequently, since smaller autocorrelation coefficients were replaced, the k largest ones were selected. The location To scroll This aligns the two pairs when their autocorrelation is strongest. Then, the autocorrelation coefficient is used as the weighting factor. Update to obtain the template sequence encoding. Let the sequence from the previous sequence Align this process with the autocorrelation coefficients in this sequence. During the rolling process, It is treated as a circular queue, meaning that when scrolling once, the first and second elements move to the tail. The formula is as follows:

[0187]

[0188]

[0189] in, Represents normalization. This represents the length by which the tensor rolls.

[0190] Next, a two-layer perceptron is used to make predictions based on the template sequence encoding AC described above. The specific formula is as follows:

[0191]

[0192] in, , It is a learnable fully connected layer, output The dimensions are kept consistent with the input template vector and position vector, in order to stack the encoder-decoder blocks to obtain better training results.

[0193] Step S42: After processing the log data to be detected according to steps S1 to S2, perform self-supervised training for occluding the partial sequence and then predicting. The prediction target is the template candidate set that may appear at the occlusion position. The loss for self-supervised training is negative log-likelihood loss.

[0194] Step S43: The trained anomaly detection model can then be used to predict the template sequence. A fixed-length sliding window is used to slide across the sentence vector of the template sequence, and then the predicted candidate set of the next template in the sequence is output. If every predicted template is within the predicted candidate set during the sliding process, the log sequence is still considered a normal sequence. Otherwise, an anomaly is considered to have been detected at a location where the predicted candidate set does not contain the actual template.

[0195] This implementation employs an anomaly detection strategy that progresses from simple classification to stepwise prediction. First, the overall log sequence is binary-classified to determine if it is an anomaly. Then, anomaly detection is performed stepwise on the abnormal log sequences. A less complex model is used to filter normal logs, thus reducing the overall computational load.

[0196] Furthermore, the same pre-trained BERT is reused to extract sentence vectors; both classification models can technically extract long-distance associations, thereby improving the overall efficiency of the method.

[0197] Meanwhile, an autocorrelation mechanism was applied when performing anomaly detection on the log template sequence, extracting the periodic characteristics of the log sequence by analyzing subsequence-subsequence correlations. To optimize computation, the magnitude of the autocorrelation coefficient was used to filter the parameters involved in the calculation.

[0198] Compared to the prior art solution 1 described above, this embodiment reduces the number of times the anomaly detection model is run when processing normal log sequences. This embodiment can capture the autocorrelation between subsequences when analyzing log sequence features and can better preserve important features in the sequence.

[0199] Reasons: 1. A simple classification-to-stepwise prediction anomaly detection strategy was adopted, filtering out the vast majority of normal log sequences in real-world scenarios from anomaly detection. Anomaly detection also serves as a check; if the classification model determines a sequence is abnormal, but the anomaly detection model does not, the sequence is considered normal. 2. The autocorrelation mechanism in Autoformer was used to analyze periodic features. Furthermore, when analyzing the autocorrelation between subsequences, the most representative and highly correlated factors were selected, reducing computational complexity while preserving sequence features as much as possible.

[0200] Compared to the prior art solution two described above, this embodiment reduces the number of times the anomaly detection model is run when processing normal log sequences. When analyzing log sequence features, this embodiment analyzes the autocorrelation score between a given template and every other template, thus better extracting long-distance correlations between sequences.

[0201] Reasons: 1. A simple classification-to-step prediction anomaly detection strategy was adopted, filtering out the majority of normal log sequences in real-world scenarios from anomaly detection. 2. The autocorrelation mechanism in Autoformer was used to analyze periodic features; Autoformer performs better when predicting long sequences.

[0202] Compared to the prior art solution three described above, this implementation can detect anomalies that occur when the same logs are in different orders. This implementation can analyze specific erroneous logs step by step within a long log sequence.

[0203] Reasons: 1. Considering the context between words, it captures complex patterns and remote dependencies in the log sequence. 2. The anomaly detection model can progressively detect whether each log entry in the anomaly log sequence is abnormal.

[0204] Compared to the prior art solution four described above, this embodiment reduces the computational load of processing log input. This embodiment reduces the computational load of analyzing sequence features in the anomaly detection model. This embodiment reduces the number of times the anomaly detection model is run when processing normal log sequences.

[0205] Reasons: 1. Logs are parsed into templates. 2. The self-attention mechanism is optimized using an autocorrelation mechanism. When analyzing the autocorrelation between subsequences, the most representative and highly correlated factors are selected, reducing computational complexity while preserving sequence features as much as possible. 3. An anomaly detection strategy from simple classification to stepwise prediction is adopted, filtering out the majority of normal log sequences in real-world scenarios from anomaly detection. Anomaly detection also serves as a check; if the classification model determines a sequence is abnormal, but the anomaly detection model does not detect anomalies, the sequence is considered normal.

[0206] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the anomaly detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0207] This application also provides an anomaly detection device; please refer to [reference needed]. Figure 6 The anomaly detection device includes:

[0208] The acquisition module 10 is used to acquire the log to be detected and divide the log to be detected into multiple log template sequences;

[0209] The vector conversion module 20 is used to input each of the log template sequences into a preset vector conversion model to obtain the log template vector of each of the log template sequences.

[0210] The classification module 30 is used to input each of the log template vectors into a preset classification model to obtain the log type of each of the log template vectors.

[0211] The anomaly localization module 40 is used to input the anomaly template vector into a preset anomaly localization model to obtain the anomaly part in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector of log type anomaly log type among the log template vectors.

[0212] Furthermore, the acquisition module 10 is also used for:

[0213] The log to be detected is input into the log parsing model to obtain at least one log template;

[0214] The log to be detected is divided into multiple sequences to be detected according to a preset time interval;

[0215] For any target sequence in each of the sequences to be detected, replace each original log message in the target sequence with the at least one log template to obtain a log template sequence.

[0216] Furthermore, the acquisition module 10 is also used for:

[0217] For any target log information in each of the original log information entries, determine the matching degree between the target log information and the at least one log template;

[0218] The target log information is replaced with a log template whose matching degree is greater than a preset threshold from the at least one log template.

[0219] Furthermore, the vector transformation model includes an encoder; and a vector transformation module 20, used for:

[0220] For any log template sequence in each of the log template sequences, the log template sequence is segmented to obtain the word vector of each word in the log template sequence, and the position information of each word in the log template sequence is determined;

[0221] The word vectors of each word and the location information are input into the encoder to obtain the location vector and the template vector. The location vector and the template vector are used as the log template vector.

[0222] Furthermore, the classification model includes convolutional blocks, activation functions, pooling layers, fully connected layers, and normalization functions; the classification module 30 is also used for:

[0223] For any target template vector among the log template vectors, the target template vector is input into the convolutional block to obtain the region features;

[0224] The region features are input into the activation function to obtain the first feature;

[0225] The first feature is input into the pooling layer to obtain the second feature;

[0226] If the sequence length of the second feature is detected to be greater than the preset stride, the second feature is input into the convolutional block until the sequence length of the output feature of the convolutional block is less than or equal to the preset stride, and the target feature is obtained.

[0227] The target features are input into the fully connected layer to obtain the category score vector;

[0228] The category score vector is input into the normalization function to obtain the category probability of each of the log types, and the log type of the target template vector is determined based on the category probability of each of the log types.

[0229] Furthermore, the anomaly localization model includes a feature extraction layer and a prediction layer; the anomaly localization module 30 and anomaly localization module 40 are also used for:

[0230] The abnormal template vector is input into the feature extraction layer, and the current window template feature of the abnormal template vector is determined by the sliding window of the feature extraction layer.

[0231] The current window template features are input into the prediction layer to obtain the next window prediction vector;

[0232] If the predicted vector for the next window is inconsistent with the actual vector for the next window determined based on the sliding window, then the log information in the log to be detected that corresponds to the actual vector for the next window is determined to be the abnormal log information.

[0233] The anomaly detection device provided in this application, employing the anomaly detection method in the above embodiments, can solve the technical problem of low efficiency in log anomaly detection. Compared with the prior art, the beneficial effects of the anomaly detection device provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and other technical features in the anomaly detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0234] This application provides an anomaly detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the anomaly detection method in Embodiment 1 above.

[0235] The following is for reference. Figure 7 The diagram illustrates a structural schematic suitable for implementing an anomaly detection device in the embodiments of this application. The anomaly detection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The anomaly detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0236] like Figure 7As shown, the anomaly detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the anomaly detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the anomaly detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show anomaly detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0237] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0238] The anomaly detection device provided in this application, employing the anomaly detection method described in the above embodiments, can solve the technical problem of low efficiency in log anomaly detection. Compared with the prior art, the beneficial effects of the anomaly detection device provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and other technical features of this anomaly detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0239] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0240] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0241] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the anomaly detection method in the above embodiments.

[0242] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0243] The aforementioned computer-readable storage medium may be included in the anomaly detection device; or it may exist independently and not be assembled into the anomaly detection device.

[0244] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by an anomaly detection device, the anomaly detection device causes the following: to acquire a log to be detected; to divide the log to be detected into multiple log template sequences; to input each of the log template sequences into a preset vector transformation model to obtain a log template vector for each of the log template sequences; to input each of the log template vectors into a preset classification model to obtain a log type for each of the log template vectors; and to input an anomaly template vector into a preset anomaly localization model to obtain anomaly log information in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector among the log template vectors whose log type is an anomaly log type.

[0245] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0246] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0247] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0248] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described anomaly detection method, thereby solving the technical problem of low efficiency in log anomaly detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and will not be repeated here.

[0249] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the anomaly detection method described above.

[0250] The computer program product provided in this application can solve the technical problem of low efficiency in log anomaly detection. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the anomaly detection method provided in the above embodiments, and will not be repeated here.

[0251] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtain the log to be detected and divide the log to be detected into multiple log template sequences; Each of the log template sequences is input into a preset vector transformation model to obtain the log template vector for each of the log template sequences. Each of the log template vectors is input into a preset classification model to obtain the log type of each log template vector. The abnormal template vector is input into a preset abnormal location model to obtain the abnormal log information in the log to be detected corresponding to the abnormal template vector, wherein the abnormal template vector is a vector of the log type of abnormal log among the log template vectors; The step of dividing the log to be detected into multiple log template sequences includes: The log to be detected is input into the log parsing model to obtain at least one log template; The log to be detected is divided into multiple sequences to be detected according to a preset time interval; For any target sequence to be tested in each of the sequences to be tested, replace each original log information in the target sequence to be tested with the at least one log template to obtain a log template sequence; The vector transformation model includes an encoder; The step of inputting each of the log template sequences into a preset vector transformation model to obtain the log template vector for each of the log template sequences includes: For any log template sequence in each of the log template sequences, the log template sequence is segmented to obtain the word vector of each word in the log template sequence, and the position information of each word in the log template sequence is determined; The word vectors of each word and the location information are input into the encoder to obtain the location vector and the template vector. The location vector and the template vector are used as the log template vector.

2. The method as described in claim 1, characterized in that, The step of replacing each original log entry in the target test sequence with the at least one log template to obtain a log template sequence includes: For any target log information in each of the original log information entries, determine the matching degree between the target log information and the at least one log template; The target log information is replaced with a log template whose matching degree is greater than a preset threshold from the at least one log template.

3. The method as described in claim 1, characterized in that, The classification model includes convolutional blocks, activation functions, pooling layers, fully connected layers, and normalization functions; The step of inputting each of the log template vectors into a preset classification model to obtain the log type of each log template vector includes: For any target template vector among the log template vectors, the target template vector is input into the convolutional block to obtain the region features; The region features are input into the activation function to obtain the first feature; The first feature is input into the pooling layer to obtain the second feature; If the sequence length of the second feature is detected to be greater than the preset stride, the second feature is input into the convolutional block until the sequence length of the output feature of the convolutional block is less than or equal to the preset stride, and the target feature is obtained. The target features are input into the fully connected layer to obtain the category score vector; The category score vector is input into the normalization function to obtain the category probability of each log type, and the log type of the target template vector is determined based on the category probability.

4. The method according to any one of claims 1 to 3, characterized in that, The anomaly localization model includes a feature extraction layer and a prediction layer; The step of inputting the anomaly template vector into a preset anomaly localization model to obtain the anomaly log information in the log to be detected corresponding to the anomaly template vector includes: The abnormal template vector is input into the feature extraction layer, and the current window template feature of the abnormal template vector is determined by the sliding window of the feature extraction layer. The current window template features are input into the prediction layer to obtain the next window prediction vector; If the predicted vector for the next window is inconsistent with the actual vector for the next window determined based on the sliding window, then the log information in the log to be detected that corresponds to the actual vector for the next window is determined to be the abnormal log information.

5. An anomaly detection device, characterized in that, The device includes: The acquisition module is used to acquire the logs to be detected and divide the logs to be detected into multiple log template sequences; The vector conversion module is used to input each of the log template sequences into a preset vector conversion model to obtain the log template vector of each of the log template sequences. The classification module is used to input each of the log template vectors into a preset classification model to obtain the log type of each of the log template vectors. An anomaly localization module is used to input an anomaly template vector into a preset anomaly localization model to obtain the anomaly part in the log to be detected corresponding to the anomaly template vector, wherein the anomaly template vector is a vector of log type anomaly log type among the log template vectors; The acquisition module is further configured to input the log to be detected into a log parsing model to obtain at least one log template; divide the log to be detected into multiple sequences to be detected according to a preset time interval; and for any target sequence to be tested in each of the sequences to be detected, replace each original log information in the target sequence to be tested with the at least one log template to obtain a log template sequence. The vector transformation model includes an encoder; the vector transformation module is further configured to perform word segmentation on any log template sequence in each log template sequence to obtain word vectors of each word in the log template sequence, and determine the position information of each word in the log template sequence; input the word vectors of each word and the position information into the encoder to obtain position vectors and template vectors, and use the position vectors and template vectors as the log template vectors.

6. An anomaly detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the anomaly detection method as described in any one of claims 1 to 4.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the anomaly detection method as described in any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the anomaly detection method as described in any one of claims 1 to 4.

Images