Log information detection method and device, electronic equipment and computer readable medium

Abstract

The embodiment of the invention discloses a log information detection method and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the following steps: extracting an entity relationship chain of each piece of historical log information in a historical log information set to obtain an entity relationship chain set; according to the historical log information set and the entity relation chain set, a log information training sample set is constructed, and log information training samples in the log information training sample set comprise historical log information, entity relation chains and sample labels; according to the log information training sample set, performing model training on the initial log information detection model to obtain a log information detection model; in response to the received at least one piece of target log information, the at least one piece of target log information is input into the log information detection model, at least one log information detection result is obtained, and one piece of target log information corresponds to one log information detection result. According to the embodiment, the accuracy and the detection efficiency of log information detection are improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the computer field, and in particular to a log information detection method, device, electronic device, and computer-readable medium. Background Art

[0002] Logs are information that characterizes the operation status of a system and are of great value. The commonly used method for detecting log anomalies is to obtain a large number of historical logs in advance, and then use clustering algorithms to process the historical logs to build a log detection model, and then use the detection model to detect logs. However, in the clustering process using clustering algorithms, the clustering results are strongly dependent on the data set, which may result in different results for the same log text using clustering algorithms, resulting in low accuracy of log detection.

[0003] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0004] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present disclosure provide a log information detection method, an apparatus, an electronic device, and a computer-readable medium to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present disclosure provide a log information detection method, the method comprising obtaining a historical log information set; extracting an entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; constructing a log information training sample set based on the historical log information set and the entity relationship chain set, wherein the log information training samples in the log information training sample set include: historical log information, entity relationship chains and sample labels; performing model training on an initial log information detection model based on the log information training sample set to obtain a trained log information detection model; in response to receiving at least one target log information, inputting the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; in response to the presence of a log information detection result that meets an abnormal condition in the at least one log information detection result, determining the target log information corresponding to the log information detection result as abnormal log information, and sending the abnormal log information to an associated abnormal log processing terminal.

[0007] In a second aspect, some embodiments of the present disclosure provide a log information detection device, the device comprising: an acquisition unit, configured to acquire a historical log information set; an extraction unit, configured to extract an entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; a construction unit, configured to construct a log information training sample set according to the historical log information set and the entity relationship chain set, wherein the log information training samples in the log information training sample set include: historical log information, entity relationship chains and sample labels; a training unit, configured to perform model training on an initial log information detection model according to the log information training sample set to obtain a trained log information detection model; an input unit, configured to, in response to receiving at least one target log information, input the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; a sending unit, configured to, in response to the presence of a log information detection result that satisfies an abnormal condition in the at least one log information detection result, determine the target log information corresponding to the log information detection result as abnormal log information, and send the abnormal log information to an associated abnormal log processing terminal.

[0008] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0009] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0010] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the log information detection method of some embodiments of the present disclosure, the accuracy and detection efficiency of log information detection are improved. Specifically, the reason for the low accuracy of log detection is that in the process of clustering using the clustering algorithm, the clustering result is strongly dependent on the data set, which may cause the same log text to obtain different results using the clustering algorithm, resulting in low accuracy of log detection. Based on this, the log information detection method of some embodiments of the present disclosure first obtains a historical log information set. Secondly, extract the entity relationship chain of each historical log information in the above historical log information set to obtain an entity relationship chain set. Thus, it is convenient to determine the relationship between each entity in the log for identification. Then, according to the above historical log information set and the above entity relationship chain set, a log information training sample set is constructed, wherein the log information training sample in the above log information training sample set includes: historical log information, entity relationship chain and sample label. Afterwards, according to the above log information training sample set, the initial log information detection model is trained to obtain a trained log information detection model. Thus, the log information can be detected by the trained log information detection model. Then, in response to receiving at least one target log information, the at least one target log information is input into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result. Finally, in response to the presence of a log information detection result that satisfies an abnormal condition in at least one log information detection result, the target log information corresponding to the log information detection result is determined as abnormal log information, and the abnormal log information is sent to the associated abnormal log processing terminal. Thus, the accuracy and efficiency of log information detection are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar figure labels represent the same or similar elements. It should be understood that the drawings are schematic and that the components and elements are not necessarily drawn to scale.

[0012] Figure 1 is a flow chart of some embodiments of the log information detection method according to the present disclosure;

[0013] Figure 2 is a flow chart of some embodiments of the log information detection device according to the present disclosure;

[0014] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0015] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0016] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0017] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0018] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0019] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0020] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0021] Figure 1 1 is a flow chart of some embodiments of the log information detection method according to the present disclosure. 100 of some embodiments of the log information detection method according to the present disclosure is shown. The log information detection method comprises the following steps:

[0022] Step 101, obtaining a historical log information set.

[0023] In some embodiments, the execution subject (e.g., computing device) of the log information detection method can obtain the historical log information set by wired connection or wireless connection. The historical log information can refer to the log information of the corresponding target application system collected during the historical preset period. For example, the target application system can be an application system or a database system. For example, the log information can be system log information, application log information, security log information, etc.

[0024] Step 102: extract the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set.

[0025] In some embodiments, the execution subject may extract the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set. The entity relationship chain may represent the relationship chain between each entity and the entity in the log information. The entity relationship chain may also refer to an entity relationship graph. Each entity in the log information may represent a different data object in the record.

[0026] In practice, the execution entity can extract the entity relationship chain of each historical log information in the historical log information set through the following steps:

[0027] The first step is to determine the pre-trained entity relationship chain extraction model. The pre-trained entity relationship chain extraction model includes: a log embedding network and an entity relationship chain feature extraction network. The pre-trained entity relationship chain extraction model may refer to a pre-trained entity relationship chain extraction model. For example, the entity relationship chain extraction model may be a large language model (LLM). The log embedding network may be an embedding network for generating a log information feature vector corresponding to the log information. For example, the log embedding network may be a RoBERTa model. The entity relationship chain feature extraction network may be a feature extraction network for generating entity relationship chain features corresponding to the log information. For example, the entity relationship chain feature extraction network may include: a bidirectional GRU (Gate Recurrent Unit) gated recurrent unit and an attention mechanism layer. The bidirectional GRU (Gate Recurrent Unit) gated recurrent unit is used to obtain the embedding results of each entity relationship in the log information. The attention mechanism layer is used to generate entity relationship chain features from each entity relationship embedding result.

[0028] The second step is to input the above historical log information into the above log embedding network to obtain the log information feature vector.

[0029] The third step is to input the above historical log information into the above entity relationship chain feature extraction network to obtain the entity relationship chain features corresponding to the above historical log information.

[0030] The fourth step is to determine the similarity between the log information feature vector and the entity relationship chain feature. The similarity between the log information feature vector and the entity relationship chain feature can be determined by a cosine similarity formula.

[0031] In a fifth step, in response to determining that the similarity is greater than or equal to a preset similarity, the entity relationship chain feature is determined as the entity relationship chain of the historical log information.

[0032] In step 6, in response to determining that the similarity is greater than or equal to the preset similarity, the entity relationship chain represented by the entity relationship chain feature is adjusted to obtain an adjusted entity relationship chain as the entity relationship chain of the historical log information. For example, the technician can adjust the entity relationship / entity in the entity relationship chain through the operation page.

[0033] Step 103: construct a log information training sample set based on the historical log information set and the entity relationship chain set.

[0034] In some embodiments, the execution subject may construct a log information training sample set based on the historical log information set and the entity relationship chain set. The log information training samples in the log information training sample set include: historical log information, entity relationship chain and sample labels. The sample labels may be labels indicating whether there are abnormal entity relationships and abnormal entities in the log information and entity relationship chain.

[0035] In practice, the execution subject may perform the following processing steps for each historical log information in the historical log information set:

[0036] The first step is to label the sample labels of the historical log information. For example, the technician can label the sample labels of the historical log information by operating the mouse.

[0037] In the second step, the historical log information, the entity relationship chain corresponding to the historical log information and the sample label are combined into a log information training sample.

[0038] Step 104: perform model training on the initial log information detection model based on the log information training sample set to obtain a trained log information detection model.

[0039] In some embodiments, the execution subject may perform model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model. The initial log information detection model may be an untrained log anomaly detection model. For example, the log anomaly detection model may be: DeepLog model, Template2Vec model, Log2Vec model.

[0040] In practice, the above execution entity can train the initial log information detection model through the following steps:

[0041] The first step is to select a target log information training sample from the log information training sample set. A log information training sample can be randomly selected from the log information training sample set as the target log information training sample.

[0042] In the second step, according to the above-mentioned target log information training sample, entity alignment loss information and entity alignment information corresponding to the initial entity alignment network are generated. Among them, the above-mentioned initial log information detection model includes: a first initial log information detection network and a second initial log information detection network, the first initial log information detection network includes: an initial entity alignment network, an initial log semantic parsing network, and an initial log detection network, and the second initial log information detection network includes: an initial feature extraction network, an initial information detection network, and the initial feature extraction network includes: an initial convolution model sequence, and the initial convolution model in the initial convolution model sequence includes: an initial sub-convolution model and an initial activation model. The initial entity alignment network may refer to an entity alignment network that has not yet been trained, and may be a neural network model that realizes the alignment of entity relationship chains and entities between log information. The entity alignment network may be a weakly supervised model. For example, the entity alignment network may be a Generative Adversarial Networks (GAN) model. The entity alignment loss information may be the loss value output by the corresponding loss function of the initial entity alignment network. The initial log semantic parsing network may be a natural language question encoder, and may include: two fully connected layers, a ReLU activation function, and a DropOut layer. For example, the initial log detection network can be a CNN (convolutional neural network) or an SLFN (single-layer feedforward neural network).

[0043] Among them, the initial feature extraction network can be a model that takes historical log information as input and takes initial log information features as output. The initial feature extraction network may include: an initial convolution model sequence. The initial convolution model in the initial convolution model sequence may include: an initial convolution sub-model and an initial activation model. Here, the input of the initial convolution sub-model included in the initial convolution model in the initial convolution model sequence may be: the output of the initial activation model included in the previous initial convolution model. The input of the initial convolution sub-model included in the first initial convolution model in the initial convolution model sequence may be: historical log information. The input of the initial activation model of the initial convolution model in the initial convolution model sequence may be: the output of the initial convolution sub-model included in the initial convolution model. For example, the number of initial convolution models in the initial convolution model sequence may be 22. The initial information detection network may be a Template2Vec model and a Log2Vec model.

[0044] The third step may include the following sub-steps:

[0045] In the first sub-step, each entity and entity relationship in the above-mentioned target log information training sample is vectorized to generate entity vectors and entity relationship vectors, and obtain entity vector sets and entity relationship vector sets. Among them, the entity relationship can represent the association relationship between the log information and the two entities in the entity relationship chain. For example, the entity relationship can be an entity belonging relationship. One entity corresponds to an entity vector. One entity relationship corresponds to an entity relationship vector. The entity vector can represent the feature semantics corresponding to the entity. The entity relationship vector can represent the feature semantics corresponding to the entity relationship. Each entity and entity relationship in the target log information training sample can be input into the pre-trained model PTM (Pre-Trained Model, such as BERT) to generate entity vectors and entity relationship vectors, and obtain entity vector sets and entity relationship vector sets.

[0046] In the second sub-step, the entity vector set and the entity relationship vector set are input into the initial entity alignment network to obtain entity alignment information. The initial entity alignment network includes an initial coding layer and an initial alignment reasoning layer, and the initial coding layer includes an initial position coding layer and an initial attention mechanism layer. The initial coding layer is a coding layer that has not yet been trained. The initial coding layer is a coding layer for combining the feature semantics of the graph anchor position, the entity vector set and the entity relationship vector set. The initial alignment reasoning layer may be an alignment reasoning layer that has not yet been trained. The alignment reasoning layer is a network layer used to determine the probability of an alignment relationship between entities based on the feature semantics of each entity, the feature semantics of each entity relationship and the feature semantics of the entity at the anchor position. For example, the alignment reasoning layer may be a fully connected layer. The initial position coding layer may be a network layer that has not yet been trained and is used to encode the position. The initial attention mechanism layer may be a model that has not yet been trained and is used to better capture the information about the influence of the anchor position on entity alignment. For example, the initial position coding layer may be a multi-layer convolutional neural network. The initial attention mechanism layer may be a multi-head attention mechanism model.

[0047] In the third sub-step, entity alignment loss information is generated according to the target log information training sample and the entity alignment information. The entity alignment loss information between the target log information training sample and the entity alignment information can be determined by a cross entropy loss function.

[0048] The third step is to perform the following training steps based on the target log information training sample:

[0049] 1. Generate a reconstructed label based on the above entity alignment information. The reconstructed label set may be a label set that is reselected based on the entity alignment information and represents a higher probability entity alignment relationship. As an example, first, the execution subject may filter out elements whose corresponding element values ​​are greater than the target probability value from the probability matrix corresponding to the entity alignment information to obtain at least one element. The entity alignment information may be information in the form of a matrix in which the corresponding element value is between 0 and 1. The element value represents the entity content matching relationship between the corresponding multiple entities. The larger the element value, the more matching the corresponding entities. Next, determine at least one entity pair corresponding to the above at least one element. Based on the above at least one entity pair, generate a reconstructed label.

[0050] 2. In response to determining that the reconstructed label is consistent with the corresponding sample label, the historical log information included in the target log information training sample is input into the initial log semantic parsing network included in the first initial log information detection network to obtain an initial log semantic vector.

[0051] 3. Input the above initial log semantic vector into the initial log detection network included in the first initial log information detection network to obtain an initial log detection result.

[0052] 4. Determine the loss value between the initial log detection result and the corresponding sample label. For example, the loss value between the initial log detection result and the corresponding sample label can be determined by a preset loss function. The preset loss function can be a hinge loss function.

[0053] 5. In response to determining that the above loss value is less than or equal to the preset loss value, the first initial log information detection network is determined as the trained first log information detection network.

[0054] 6. Input the historical log information included in the target log information training sample into the initial feature extraction network to obtain the initial log information features.

[0055] 7. Input the initial log information features into the initial information detection network to obtain the initial log information detection results.

[0056] 8. Based on a preset loss function, determine the difference between the initial log information detection result and the corresponding sample label. For example, the preset loss function may be a hinge loss function or a cross entropy loss function.

[0057] 9. In response to determining that the difference value is less than or equal to the preset difference value, determine the second initial log information detection network as the trained second log information detection network.

[0058] 10. In response to determining that the above loss value is greater than the preset loss value, adjust the model parameters of the first initial log information detection network, reselect the target log information training samples from the unselected log information training samples, and perform model training on the adjusted first initial log information detection network.

[0059] Step 105 , in response to receiving at least one target log information, inputting the at least one target log information into the log information detection model to obtain at least one log information detection result.

[0060] In some embodiments, the above-mentioned execution subject can respond to receiving at least one target log information by inputting the above-mentioned at least one target log information into the above-mentioned log information detection model to obtain at least one log information detection result. Among them, one target log information corresponds to one log information detection result. For example, the log information detection model can be a pre-trained neural network model with log information as input and log information detection result as output. For example, the log information detection model mainly includes a deep learning model and a traditional machine learning model. Deep learning model: DeepLog model: This is a log anomaly detection model based on deep learning, which processes and analyzes log data through deep learning methods to detect abnormal situations. The DeepLog model uses deep learning algorithms to automatically extract features of log data, thereby realizing automatic detection and classification of anomalies. Template2Vec model and Log2Vec model: These models are also log anomaly detection models based on deep learning. They identify and classify abnormal events by learning the patterns and features of log data. These models can process large amounts of log data and extract useful information from them to support anomaly detection. Traditional machine learning models: K-nearest neighbor (KNN), support vector machine (SVM), Naive Bayes and other algorithms are also applied to log anomaly detection. The target log information can be the log information just received. The log information detection result can indicate whether the log information is abnormal.

[0061] Step 106, in response to at least one log information detection result having a log information detection result that meets the abnormal condition, determining the target log information corresponding to the log information detection result as abnormal log information, and sending the abnormal log information to the associated abnormal log processing terminal.

[0062] In some embodiments, the execution subject may determine the target log information corresponding to the log information detection result as abnormal log information in response to the presence of a log information detection result that satisfies an abnormal condition in at least one log information detection result, and send the abnormal log information to an associated abnormal log processing terminal. The abnormal condition may be: the log information detection result indicates an abnormality. The abnormal log processing terminal may be a terminal that processes abnormal logs.

[0063] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a log information detection device. These log information detection device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the log information detection device can be specifically applied to various electronic devices.

[0064] like Figure 2 As shown, the log information detection device 200 of some embodiments includes: an acquisition unit 201, an extraction unit 202, a construction unit 203, a training unit 204, an input unit 205 and a sending unit 206. The acquisition unit 201 is configured to acquire a historical log information set; the extraction unit 202 is configured to extract the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; the construction unit 203 is configured to construct a log information training sample set according to the historical log information set and the entity relationship chain set, wherein the log information training samples in the log information training sample set include: historical log information, entity relationship chains and sample labels; the training unit 204 is configured to perform model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model; the input unit 205 is configured to, in response to receiving at least one target log information, input the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; the sending unit 206 is configured to, in response to the presence of a log information detection result that satisfies an abnormal condition in at least one log information detection result, determine the target log information corresponding to the log information detection result as abnormal log information, and send the abnormal log information to the associated abnormal log processing terminal.

[0065] It is understandable that the units recorded in the log information detection device 200 are similar to the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the log information detection device 200 and the units included therein, and will not be described in detail here.

[0066] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device (e.g., a computing device) 300 suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0067] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0068] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0069] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0070] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0071] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0072] The computer-readable medium may be included in the electronic device; or it may exist independently without being assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains a historical log information set; extracts the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; constructs a log information training sample set according to the historical log information set and the entity relationship chain set, wherein the log information training sample in the log information training sample set includes: historical log information, entity relationship chain and sample label; performs model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model; in response to receiving at least one target log information, inputs the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; in response to the presence of a log information detection result that satisfies an abnormal condition in the at least one log information detection result, determines the target log information corresponding to the log information detection result as abnormal log information, and sends the abnormal log information to the associated abnormal log processing terminal.

[0073] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0074] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0075] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising: an acquisition unit, an extraction unit, a construction unit, a training unit, an input unit, and a sending unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the acquisition unit may also be described as a "unit for acquiring a set of historical log information".

[0076] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0077] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A log information detection method, comprising: Get the historical log information set; Extracting the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; Constructing a log information training sample set according to the historical log information set and the entity relationship chain set, wherein the log information training samples in the log information training sample set include: historical log information, entity relationship chains and sample labels; Performing model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model; In response to receiving at least one target log information, inputting the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; In response to the presence of a log information detection result satisfying an abnormal condition in at least one log information detection result, target log information corresponding to the log information detection result is determined as abnormal log information, and the abnormal log information is sent to an associated abnormal log processing terminal.

2. The method according to claim 1, wherein: The step of constructing a log information training sample set according to the historical log information set and the entity relationship chain set includes: For each historical log information in the historical log information set, the following processing steps are performed: A sample label for marking the historical log information; The historical log information, the entity relationship chain corresponding to the historical log information and the sample label are combined into a log information training sample.

3. The method according to claim 1, wherein: The extracting the entity relationship chain of each historical log information in the historical log information set includes: Determine a pre-trained entity relationship chain extraction model, wherein the pre-trained entity relationship chain extraction model includes: a log embedding network and an entity relationship chain feature extraction network; Inputting the historical log information into the log embedding network to obtain a log information feature vector; Inputting the historical log information into the entity relationship chain feature extraction network to obtain entity relationship chain features corresponding to the historical log information; Determine the similarity between the log information feature vector and the entity relationship chain feature; In response to determining that the similarity is greater than or equal to a preset similarity, determining the entity relationship chain feature as the entity relationship chain of the historical log information; In response to determining that the similarity is greater than or equal to a preset similarity, an entity relationship adjustment is performed on the entity relationship chain represented by the entity relationship chain feature to obtain an adjusted entity relationship chain as the entity relationship chain of the historical log information.

4. The method according to claim 1, wherein: The step of performing model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model includes: Selecting a target log information training sample from the log information training sample set; According to the target log information training sample, entity alignment loss information and entity alignment information corresponding to the initial entity alignment network are generated, wherein the initial log information detection model includes: a first initial log information detection network and a second initial log information detection network, the first initial log information detection network includes: an initial entity alignment network, an initial log semantic parsing network, and an initial log detection network, the second initial log information detection network includes: an initial feature extraction network and an initial information detection network, the initial feature extraction network includes: an initial convolutional model sequence, and the initial convolutional model in the initial convolutional model sequence includes: an initial sub-convolutional model and an initial activation model; Based on the target log information training sample, perform the following training steps: Generate a reconstruction label according to the entity alignment information; In response to determining that the reconstructed label is consistent with the corresponding sample label, inputting the historical log information included in the target log information training sample into an initial log semantic parsing network included in the first initial log information detection network to obtain an initial log semantic vector; Inputting the initial log semantic vector into an initial log detection network included in the first initial log information detection network to obtain an initial log detection result; Determine a loss value between the initial log detection result and the corresponding sample label; In response to determining that the loss value is less than or equal to the preset loss value, the first initial log information detection network is determined as the trained first log information detection network.

5. A log information detection device, comprising: An acquisition unit, configured to acquire a historical log information set; An extraction unit is configured to extract the entity relationship chain of each historical log information in the historical log information set to obtain an entity relationship chain set; A construction unit is configured to construct a log information training sample set according to the historical log information set and the entity relationship chain set, wherein the log information training samples in the log information training sample set include: historical log information, entity relationship chains and sample labels; A training unit is configured to perform model training on the initial log information detection model according to the log information training sample set to obtain a trained log information detection model; an input unit, configured to, in response to receiving at least one target log information, input the at least one target log information into the log information detection model to obtain at least one log information detection result, wherein one target log information corresponds to one log information detection result; The sending unit is configured to determine the target log information corresponding to the log information detection result as abnormal log information in response to the presence of a log information detection result that meets the abnormal condition in at least one log information detection result, and send the abnormal log information to the associated abnormal log processing terminal.

6. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

7. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images