Log detection method and device

Abstract

The invention discloses a log detection method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of obtaining a to-be-detected code log, and performing feature extraction on the to-be-detected code log; a feature extraction result is input into a pre-constructed log detection model, abnormal code logs existing in the to-be-detected code logs output by the log detection model are obtained, and the log detection model is obtained by fusing a classification model and an abnormal detection model according to a preset fusion strategy, the fusion strategy comes from a preset fusion strategy set; and positioning a corresponding abnormal code according to the abnormal code log. According to the implementation mode, efficient and accurate log detection is achieved, manpower resources are saved, the log detection model is constructed through the optimal fusion strategy, the detection accuracy can be greatly improved, and a friendly and efficient code log detection tool is provided for developers.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a log detection method and device. Background Art

[0002] With the continuous development of computer technology, the amount of code and logs generated by big data platforms are increasing, which poses a huge challenge to the code development and maintenance of big data teams. By analyzing and detecting the code logs during program execution, we can not only monitor the program execution process, but also find code problems in a timely manner, which helps to improve the quality of program code and development efficiency. Most of the existing code log detection is based on the keywords of the code log for analysis and detection.

[0003] In the process of implementing the present invention, the inventors found that the prior art has the following problems:

[0004] The existing code log detection methods still need to rely on the past experience of developers, with low detection efficiency and accuracy that needs to be improved, especially in large-scale big data tasks and complex development scenarios. The massive code logs bring tremendous pressure to log detection work. Summary of the invention

[0005] In view of this, the embodiments of the present invention provide a log detection method and device, which realize efficient and accurate log detection, not only saving human resources, but also adopting an optimal fusion strategy to construct a log detection model, which can greatly improve the detection accuracy, thereby providing developers with a friendly and efficient code log detection tool.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a log detection method is provided, comprising:

[0007] Obtaining a code log to be detected, and performing feature extraction on the code log to be detected;

[0008] Input the result of feature extraction into a pre-built log detection model, obtain the abnormal code log in the code log to be detected output by the log detection model, and obtain the log detection model by fusing the classification model and the abnormal detection model according to a preset fusion strategy, wherein the fusion strategy comes from a preset fusion strategy set;

[0009] According to the abnormal code log, the corresponding abnormal code is located.

[0010] Optionally, the log detection model is constructed in the following manner: collecting code log data, performing feature extraction on the code log data, and constructing a sample set based on the result of the feature extraction; using the sample set to train an initial classification model, and performing performance verification on multiple candidate classification models obtained through training, and selecting a classification model for constructing the log detection model from the multiple candidate classification models based on the performance verification result; determining neighborhood parameter values ​​for model construction based on the features of each sample in the sample set, and thereby obtaining an anomaly detection model; according to a preset fusion strategy set, fusing the classification model and the anomaly detection model to obtain multiple candidate log detection models; based on the sample set, comparing the performance of each of the candidate log detection models, and determining the log detection model from the multiple candidate log detection models based on the performance comparison result.

[0011] Optionally, based on the result of feature extraction, a sample set is constructed, including: based on the result of feature extraction, the code log data is classified, the code log data with the same feature is aggregated, and a code log data set corresponding to each feature is established; a target feature that matches the preset extracted feature is searched from the result of feature extraction, and the code log data set corresponding to the target feature is aggregating into the sample set.

[0012] Optionally, the sample set is used to train an initial classification model, and the performance of multiple candidate classification models obtained through training is verified, including: based on the proportion of preset training sets and test sets in the sample set, stratified sampling is performed on the sample set to obtain a training set and a test set; based on the training set, a sequential minimum optimization algorithm and a distributed computing framework are used in combination with a radial basis kernel function to train the preset initial classification model to obtain multiple candidate classification models; and the test set is used to verify the prediction accuracy and comprehensive performance indicators of each of the candidate classification models.

[0013] Optionally, after selecting a classification model for constructing the log detection model from a plurality of the candidate classification models according to the performance verification results, the method further includes: based on the test set in the sample set, using a grid search method to adjust the penalty parameter value of the classification model, and using the adjusted penalty parameter value to optimize the classification model, so that the optimized classification model is used for constructing the log detection model; after determining the neighborhood parameter value for model construction according to the characteristics of each sample in the sample set, and then obtaining the anomaly detection model, the method further includes: based on the test set in the sample set, using a grid search method to adjust the neighborhood parameter value for model construction, and using the adjusted neighborhood parameter value to optimize the anomaly detection model, so that the optimized anomaly detection model is used for constructing the log detection model.

[0014] Optionally, after obtaining the abnormal code log existing in the code log to be detected output by the log detection model, the method further includes: calculating the model performance index of the log detection model according to the abnormal code log, adjusting the key parameter values ​​in the classification model and the anomaly detection model constituting the log detection model according to the model performance index, and updating the log detection model using the adjusted key parameter values.

[0015] Optionally, the anomaly detection model is mainly used to calculate the local density of each received code log feature, calculate the anomaly score value of each code log feature according to the local density, and then determine the abnormal code log feature from each code log feature according to each anomaly score value, so as to output the abnormal code log corresponding to the abnormal code log feature; the fusion strategy includes a voting mechanism fusion strategy, a weighted average fusion strategy and a stacking fusion strategy.

[0016] According to a second aspect of an embodiment of the present invention, a log detection device is provided, including:

[0017] A log acquisition module, used to acquire the code log to be detected and perform feature extraction on the code log to be detected;

[0018] A log detection module, used for inputting the result of feature extraction into a pre-built log detection model, obtaining the abnormal code log existing in the code log to be detected output by the log detection model, wherein the log detection model is obtained by fusing the classification model and the abnormality detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set;

[0019] The result acquisition module is used to locate the corresponding abnormal code according to the abnormal code log.

[0020] According to a third aspect of an embodiment of the present invention, there is provided an electronic monitoring device for a log, comprising:

[0021] one or more processors;

[0022] a storage device for storing one or more programs,

[0023] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0024] According to a fourth aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0025] According to a fifth aspect of the present embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method provided by the first aspect of the embodiment of the present invention is implemented.

[0026] An embodiment of the invention has the following advantages or beneficial effects: by obtaining the code log to be detected and performing feature extraction on the code log to be detected; inputting the result of the feature extraction into a pre-built log detection model, obtaining the abnormal code log existing in the code log to be detected output by the log detection model, and obtaining the log detection model by fusing the classification model and the abnormal detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set; according to the abnormal code log, a technical solution for locating the corresponding abnormal code is implemented, thereby realizing an efficient and accurate log detection, which not only saves human resources, but also adopts an optimal fusion strategy to construct a log detection model, which can greatly improve the detection accuracy, thereby providing developers with a friendly and efficient code log detection tool. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0028] Figure 1 is a schematic diagram of the main process of the log detection method according to an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of the core architecture of code log detection according to an embodiment of the present invention;

[0030] Figure 3 It is a flow chart of a method for constructing a log detection model according to an embodiment of the present invention;

[0031] Figure 4 Schematic diagram of the construction process of the log detection model according to an embodiment of the present invention;

[0032] Figure 5 is a schematic diagram of main modules of a log detection device according to an embodiment of the present invention;

[0033] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0034] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0035] It should be noted that the acquisition, storage and application of user personal information involved in the technical solution of the present disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0036] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0037] The existing code log detection methods still need to rely on the past experience of developers, with low detection efficiency and accuracy that needs to be improved, especially in large-scale big data tasks and complex development scenarios. The massive code logs bring tremendous pressure to the log detection work and cannot meet the actual application requirements well.

[0038] In order to solve the above problems existing in the prior art, the present invention proposes a log detection method. In view of this, the embodiments of the present invention provide a log detection method and device, which use an intelligent log detection model to automatically detect code logs. The log detection model of the embodiment of the present invention adaptively determines a fusion strategy from the fusion strategy set, and fuses the classification model and the anomaly detection model according to the fusion strategy, thereby realizing an efficient and accurate log detection, which not only saves human resources, but also adopts the preferred fusion strategy to construct the log detection model, which can greatly improve the detection accuracy, and provide developers with a friendly and efficient code log detection tool.

[0039] Figure 1 is a schematic diagram of the main process of the log detection method according to an embodiment of the present invention, such as Figure 1 As shown, the log detection method of the embodiment of the present invention includes the following steps S101 to S103.

[0040] Step S101: Obtain a code log to be detected, and perform feature extraction on the code log to be detected.

[0041] Specifically, in the big data computing scenario, the program code will generate corresponding code logs during the execution of massive computing tasks, such as the Spark logs generated by the big data computing framework Spark during operation, which record the execution process, task scheduling, data processing and other key information of the Spark application, which is very important for development, debugging and performance optimization. The embodiments of the present invention mainly analyze and detect these code logs to timely find and locate the problem code in the program code.

[0042] The detection timing of the embodiment of the present invention is set according to the needs of the specific detection scenario. The request to obtain the code log to be detected can be triggered regularly, or the developer can trigger the request to obtain the code log to be detected according to the needs. After obtaining the code log to be detected, the log to be detected is preprocessed, such as log verification, log screening and other operations, and finally the preprocessed code log is feature extracted. Specifically, feature extraction can be performed through keywords of the code log, such as the error level of the code log, memory resource consumption, etc.

[0043] Step S102: input the result of feature extraction into a pre-built log detection model, obtain the abnormal code log existing in the code log to be detected output by the log detection model, and obtain the log detection model by fusing the classification model and the anomaly detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set.

[0044] Specifically, the embodiment of the present invention utilizes the analysis and detection capabilities of the intelligent large model, analyzes the code log through the large model, and detects and identifies the abnormal code in the code log, thereby improving the intelligence and full automation of code log detection. The embodiment of the present invention builds a log detection model for analyzing and detecting code logs in advance, inputs the code log after the above feature extraction into the log detection model, and jointly identifies the abnormal code log by the classification model and the anomaly detection model in the log detection model. The classification model focuses on maximizing the distinction between normal code logs and abnormal code logs through decision boundaries; the anomaly detection model focuses on identifying anomalies by calculating the local reachable density between each code log and other code logs. It is a computing model, and the two models jointly cooperate to detect the code log, which improves the accuracy and robustness of the detection. In addition, the embodiment of the present invention provides a variety of optional fusion strategies for the fusion strategy of the classification model and the anomaly detection model, forming a fusion strategy set, and selects the fusion strategy with the best performance according to different business scenarios to build a log detection model.

[0045] According to one embodiment of the present invention, after obtaining the abnormal code log existing in the code log to be detected output by the log detection model, the method further includes: calculating the model performance index of the log detection model based on the abnormal code log, adjusting the key parameter values ​​in the classification model and the anomaly detection model constituting the log detection model according to the model performance index, and updating the log detection model using the adjusted key parameter values.

[0046] Specifically, in order to further improve the accuracy of the log detection model and make full use of the iterative optimization capability of the intelligent model, after obtaining the abnormal code log in the code log to be detected output by the log detection model, the abnormal code log can be used to tune the key parameter values ​​in the log detection model. The classification model of the embodiment of the present invention can be a neural network model with classification capability, a deep learning model, a support vector machine SVM model, etc., and the abnormal detection model can be an isolation forest model, a local outlier factor LOF model, etc., and the corresponding tuning parameters of different models are also different.

[0047] Use the abnormal code log to verify the performance of the current log detection model. Specifically, the accuracy, recall, and comprehensive performance index F1 of the log detection model can be calculated. Based on these performance indicators, the key parameter values ​​of the classification model and the anomaly detection model are dynamically adjusted to iteratively optimize the log detection model. Specifically, take the SVM model as the classification model and the LOF model as the anomaly detection model as an example. According to the performance indicators of the log detection model, the penalty parameter C value in the SVM model that constitutes the log detection model and the neighborhood parameter k value in the LOF model are dynamically adjusted.

[0048] Step S103: locate the corresponding abnormal code according to the abnormal code log.

[0049] Specifically, based on the abnormal code log output by the above-mentioned log detection model, the corresponding abnormal code is traced and located, and the abnormal code log and the corresponding abnormal code are sent to the developer for problem review and code modification. Of course, the abnormal code log can also be directly sent to the developer, and the developer pulls the corresponding abnormal code according to the received abnormal code log. It is also possible to carry out further extended analysis based on the abnormal code log and the corresponding abnormal code, and the program code information, the abnormal code log and the corresponding abnormal code are systematically integrated and visually pushed to the developer.

[0050] Figure 2 It is a core architecture diagram of the code log detection of an embodiment of the present invention. It specifically includes an acquisition layer, a model layer and a system layer, wherein the acquisition layer is mainly used to obtain the code log to be detected, and perform data preprocessing and feature extraction on the code log to be detected. The model layer is mainly used for training the classification model and the anomaly detection model, and fuses the classification model and the anomaly detection model according to a preset fusion strategy to obtain a log detection model, and performs parameter tuning on the log detection model. The system layer is mainly used to automate and productize all processes. Abnormal code logs and abnormal codes will be pushed and fed back to big data developers in real time, so as to implement intelligent products for real-time code log analysis, code problem location and monitoring alarm, and continuously iterate and update.

[0051] The construction of the log detection model in the embodiment of the present invention directly determines the result of the log detection. Figure 3 is a flow chart of a method for constructing a log detection model according to an embodiment of the present invention. As another embodiment of the present invention, Figure 3 As shown, the method for constructing the log detection model may include:

[0052] Step S301: Collect code log data, perform feature extraction on the code log data, and construct a sample set based on the result of the feature extraction.

[0053] Specifically, according to business needs, the data source for collecting code logs is determined, and code log data of a specified time is collected from the data source, which can be code log data in the recent period of time or code log data in a specific period of time. Feature extraction is performed based on the keywords of these code log data, and each code log data is screened one by one based on the features of each extracted code log data, and code log data containing abnormal flag words, such as code log data containing warn warning features, are selected, and these code log data are used as sample sets.

[0054] According to one embodiment of the present invention, a sample set is constructed based on the result of feature extraction, including: classifying the code log data based on the result of feature extraction, aggregating the code log data with the same feature, and establishing a code log data set corresponding to each feature; searching for a target feature that matches a preset extracted feature from the result of feature extraction, and aggregating the code log data set corresponding to the target feature into the sample set.

[0055] Specifically, in order to quickly and efficiently build a high-quality sample set, in the process of building the sample set, each code log can be classified according to the features extracted from each code log, and the code log data with the same features can be aggregated under one category, so that each feature corresponds to a code log data set. Then, combined with the preset extracted features, the target feature that matches it is searched from each feature, and finally the code log data sets corresponding to these target features are aggregated into a sample set.

[0056] Exemplarily, the preset extraction feature is error level, and the code log with error level feature needs to have timestamp, resource loss and code running time data, where error level: identifies each error level in the code log entry, such as ERROR, INFO, WARN; timestamp: identifies the timestamp generated by the code log entry to confirm the time pattern of abnormal behavior; resource loss: identifies the real-time memory consumption, memory utilization and file throughput; code running time: identifies the execution completion time to determine whether it is abnormal. Based on the preset extraction features, when constructing the sample set, it is necessary to find the target features that meet the extraction feature requirements, and summarize and combine the code log data sets corresponding to these target features into a sample set.

[0057] Step S302: Use the sample set to train an initial classification model, and perform performance verification on multiple candidate classification models obtained through training, and select a classification model for constructing the log detection model from the multiple candidate classification models according to the performance verification results.

[0058] Specifically, firstly, an initial classification model is preset, and the sample set constructed above is used to train the initial classification model. Usually, multiple candidate classification models are obtained through training. Then, the sample set is used to perform performance verification on each candidate classification model, and the performance index of each candidate classification model is calculated. According to the calculated performance index, the best candidate classification model is selected from all the candidate classification models as the classification model for constructing the log detection model of the embodiment of the present invention.

[0059] According to one embodiment of the present invention, the sample set is used to train an initial classification model, and the performance of multiple candidate classification models obtained through training is verified, including: based on the proportion of preset training sets and test sets in the sample set, the sample set is stratified sampled to obtain a training set and a test set; based on the training set, a sequential minimum optimization algorithm and a distributed computing framework are used in combination with a radial basis kernel function to train the preset initial classification model to obtain multiple candidate classification models; and the test set is used to verify the prediction accuracy and comprehensive performance indicators of each of the candidate classification models.

[0060] Specifically, the embodiment of the present invention takes the SVM model as an example. In order to ensure that the sample distribution in the training set is similar to the overall data distribution, thereby improving the generalization ability and accuracy of the model, the embodiment of the present invention divides each sample in the sample set into different layers, and extracts samples from each layer according to the preset proportions of the training set and the test set, for example, 70% of the training set and 30% of the test set, to obtain the training set and the test set.

[0061] Furthermore, in the scenario of big data computing framework, the amount of code is usually extremely large, and accordingly, the data scale of the generated code log is also large, and the features of the above-mentioned preset extracted features are nonlinear features without obvious distribution, so the radial basis kernel function is selected for training in the SVM model. In addition, considering that the code log data scale is large, the number of features is large, and the log analysis is relatively complex, under the condition of sufficient computing resources, this solution selects the sequential minimum optimization algorithm to complete the model training, that is, to decompose a large number of algorithm modules into several minimum modules to complete the training, and then combine the distributed computing framework to distribute them to multiple nodes for processing. For business scenarios using Spark, Spark's Kubernetes resource manager can also be used to dynamically allocate resources to maximize resource utilization.

[0062] Based on obtaining multiple alternative classification models, the test set is used to obtain the output of each alternative classification model. According to the output of each alternative classification model, the performance of each alternative classification model is verified, and the prediction accuracy A, recall rate R, precision rate P and comprehensive performance index F1 of the model can be calculated. However, considering that in the code log detection scenario, a higher recall rate is required to ensure that all possible problem codes are detected, and in this case, a lower precision rate will be obtained, that is, there may be more false alarms, which will increase the workload of big data developers. Therefore, the embodiment of the present invention recommends using the prediction accuracy rate and the comprehensive performance index F1 (F1=2*(recall rate*precision rate) / (recall rate+precision rate)) as core indicators to perform performance verification on each alternative classification model.

[0063] According to another embodiment of the present invention, after selecting a classification model for constructing the log detection model from a plurality of the alternative classification models according to the performance verification results, the method further includes: based on the test set in the sample set, using a grid search method, adjusting the penalty parameter value of the classification model, and using the adjusted penalty parameter value to optimize the classification model, so as to use the optimized classification model for constructing the log detection model.

[0064] Specifically, for the SVM model constructed above, in order to improve the generalization ability of the model, thereby improving the classification accuracy of the model. For the key penalty parameter C in the SVM model, it controls the degree of penalty for misclassified samples during the training process. A larger C value will cause the model to punish misclassified samples more strictly, which may lead to overfitting; while a smaller C value will allow more misclassified samples, which may lead to underfitting. Based on the value range of the C parameter, different C values ​​are tried within the C parameter range through methods such as grid search, and the optimal C value is found by trying all possible parameter combinations to achieve the purpose of significantly improving the performance and generalization ability of the SVM.

[0065] Step S303: Determine neighborhood parameter values ​​for model construction based on the characteristics of each sample in the sample set, and then obtain an anomaly detection model.

[0066] Specifically, the embodiment of the present invention takes the local outlier factor LOF model as an example, and identifies the code logs with normal execution and the code logs with abnormal execution, such as error stack, warning message, execution delay, etc., according to the sample characteristics of each sample in the sample set. According to the characteristics of the code logs with abnormal execution, the possible size of the abnormal group is estimated. The size of the group refers to the scale or number of abnormal logs. If the abnormality is relatively independent or small in scope, a smaller neighborhood parameter k value is selected, such as k=3; if the abnormal scale is large, a larger neighborhood parameter k value is selected, such as k=25. After determining the neighborhood parameter value used for model construction, a LOF model that can be used to judge abnormal points is obtained.

[0067] According to one embodiment of the present invention, the anomaly detection model is mainly used to calculate the local density of each received code log feature, calculate the anomaly score value of each code log feature based on the local density, and then determine the abnormal code log feature from each code log feature based on each anomaly score value, thereby outputting the abnormal code log corresponding to the abnormal code log feature.

[0068] Specifically, the LOF model is a computational model that determines whether a given sample is an outlier by measuring the local deviation of the density of a given sample relative to its neighbors. The LOF model determines whether a data point is abnormal by comparing the density of each point with its neighborhood points. The lower the density of a point, the more likely it is to be considered an outlier. The density is calculated by the distance between points. The closer the distance, the higher the density. Specifically, the point distance between each code log feature can be calculated using the Euclidean distance. For each code log feature point, based on the point distance, its k nearest local densities are calculated. The specific calculation method is: for feature point i, calculate the distance from feature point i to its k nearest neighbors; calculate a neighborhood radius based on these distances, and take the average distance of the k nearest neighbors; calculate the number of points that fall within the neighborhood radius, which are the local density of feature point i; repeat the above steps to obtain the local density value of each feature point. Based on the local density, the anomaly score value is obtained by calculating the local density of each code log feature point and the average of its neighboring local densities. For specific calculations, see the following formula: LOF(X) = ∑(density(Neighbor) / density(X)) / k , Where: X is a feature point, density(X) is its local density, and density(Neighbor) is the local density of the neighbors of data point X.

[0069] Furthermore, according to the calculated abnormal score value LOF of each code log feature, the code log feature with LOF greater than 1 is selected as the abnormal feature, and then the corresponding abnormal code log is obtained.

[0070] In addition, although the LOF score can be used directly to identify abnormal features, considering that in practical applications, there may be other factors that cause the LOF score to deviate from the theoretical normal value, so in order to better meet the needs of practical applications, the detection and recognition accuracy of the model is improved. Preferably, based on the LOF score of each code log feature calculated above, each LOF score is distributed, and the recognition threshold of the corrected abnormal point is updated according to the size distribution characteristics of all LOF scores, so as to determine the abnormal code log feature from each code log feature according to the corrected recognition threshold. For example, the recognition threshold of the abnormal point is usually 1, and in the LOF calculation results of this time, most of the LOF scores are around 1.2~1.3, so the recognition threshold can be corrected to 1.3, and the LOF score greater than 1.3 is determined as an abnormal point.

[0071] Through the secondary determination of the recognition threshold in the embodiment of the present invention, the practical application needs are better met, the detection and recognition accuracy of the LOF model is improved, and the detection accuracy of the log detection model is further improved.

[0072] According to one embodiment of the present invention, after determining the neighborhood parameter values ​​for model construction based on the characteristics of each sample in the sample set and then obtaining the anomaly detection model, the method further includes: based on a test set in the sample set, using a grid search method to adjust the neighborhood parameter values ​​for model construction, and using the adjusted neighborhood parameter values ​​to optimize the anomaly detection model, so that the optimized anomaly detection model is used for the construction of the log detection model.

[0073] Specifically, for the LOF model constructed above, in order to improve the generalization ability of the model, thereby improving the accuracy of the model's anomaly detection. For the key neighborhood parameter k in the LOF model, k determines the number of neighbors to be considered around each point, thereby affecting the calculation range of the local density. Using the test set in the sample set, within a certain range of values, the grid search method is used to use cross-validation technology to evaluate the performance of the LOF model under different k values, and the k value corresponding to the best performance is selected as the optimal k value, and then the optimal neighborhood parameter k value is used to optimize the LOF model, and the optimized LOF model is applied to the construction of subsequent log detection models.

[0074] Step S304: According to a preset fusion strategy set, the classification model and the anomaly detection model are fused to obtain a plurality of candidate log detection models.

[0075] Specifically, based on the classification model and anomaly detection model constructed above, taking into account that the effects of adopting different model fusion strategies in different business scenarios will be different, in order to improve the adaptability of log detection in the embodiment of the present invention, a variety of fusion strategies are preset in advance. These fusion strategies constitute a fusion strategy set. According to each fusion strategy in the fusion strategy set, the classification model and the anomaly detection model are fused to obtain corresponding multiple alternative log detection models.

[0076] According to an embodiment of the present invention, the fusion strategy includes a voting mechanism fusion strategy, a weighted average fusion strategy and a stacking fusion strategy.

[0077] Specifically, the embodiment of the present invention mainly presets three fusion strategies, namely, voting mechanism fusion strategy, weighted average fusion strategy and stacking fusion strategy. Among them, the voting mechanism fusion strategy is to detect the abnormality or normality of the code log features through the classification model and the anomaly detection model respectively, and finally determine whether the code log features are abnormal according to the majority vote principle. The weighted average fusion strategy is to give different weight factors to the classification model and the anomaly detection model according to their performance (accuracy and recall rate), and finally make a decision based on the weighted average score. The stacking fusion strategy is to process the prediction results of the classification model and the anomaly detection model for the code log features into a new feature set, and then use the decision tree algorithm to train the new feature set. The decision tree can make more accurate classification or anomaly detection decisions based on the combination of these features.

[0078] Correspondingly, the various candidate log detection models mentioned above are log detection models constructed using a voting mechanism fusion strategy, log detection models constructed using a weighted average fusion strategy, and log detection models constructed using a stacking fusion strategy.

[0079] Step S305: Based on the sample set, compare the performance of each of the candidate log detection models, and determine the log detection model from the multiple candidate log detection models according to the performance comparison result.

[0080] Specifically, the test set in the sample set is used to evaluate the accuracy, recall and other performance indicators of each candidate log detection model. According to the performance indicators of each candidate log detection model and the actual needs of the current business scenario, the most suitable fusion strategy and its corresponding log detection model are selected.

[0081] It can be understood that if the weighted average fusion strategy is selected, after obtaining the abnormal code log existing in the code log to be detected output by the log detection model, according to the abnormal code log, in addition to adjusting the key parameter values ​​in the classification model and the abnormal model, the weight can also be adjusted.

[0082] The determination of the fusion strategy of the log detection model in the embodiment of the present invention realizes the dynamic and adaptive selection of a suitable fusion strategy according to the actual needs of different business scenarios at any time based on the performance of the model, thereby achieving the best code log detection effect.

[0083] Figure 4 Schematic diagram of the construction process of the log detection model of the embodiment of the present invention. The process is mainly divided into three stages: model training stage, model fusion stage and model parameter tuning stage. In this figure, the SVM model is used as the classification model and the LOF model is used as the anomaly detection model.

[0084] In the model training phase, for the construction of the SVM model, firstly, the code logs are classified according to the results of feature extraction of the code logs to construct a sample set; the SVM initial model is trained using the sample set, and the performance of multiple candidate SVM models obtained by training is verified, and the SVM model used to construct the log detection model is selected from the multiple candidate SVM models according to the performance verification results. For the LOF model, the LOF model used to construct the log detection model is determined by determining the neighborhood parameter values ​​for model construction.

[0085] In the model fusion stage, the SVM model and the LOF model are fused according to the preset voting mechanism fusion strategy, weighted average fusion strategy and stacking fusion strategy to obtain the corresponding three candidate log detection models; based on the sample set, the performance of each candidate log detection model is compared, and according to the performance comparison result, one of the three fusion strategies is adaptively selected to fuse the SVM model and the LOF model to construct the log detection model of the embodiment of the present invention.

[0086] In the parameter tuning stage, based on the penalty parameter C value tuning when building the SVM model and the neighborhood parameter k value tuning when building the LOF model, the fused log detection model is balanced and tuned. According to the real-time model performance feedback, the C parameter in the SVM and the neighborhood parameter k value in the LOF are dynamically adjusted. Of course, if the weighted average fusion strategy is used, the weights are also tuned. The parameter tuning in this stage can effectively improve the detection accuracy and robustness of the log detection model.

[0087] Figure 5 FIG. 1 is a schematic diagram of the main modules of a log detection device according to an embodiment of the present invention. Figure 5As shown, the log detection device 500 mainly includes a log acquisition module 501 , a log detection module 502 and a result acquisition module 503 .

[0088] The log acquisition module 501 is used to acquire the code log to be detected and perform feature extraction on the code log to be detected;

[0089] The log detection module 502 is used to input the result of feature extraction into a pre-built log detection model, and obtain the abnormal code log existing in the code log to be detected output by the log detection model, wherein the log detection model is obtained by fusing the classification model and the abnormality detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set;

[0090] The result acquisition module 503 is used to locate the corresponding abnormal code according to the abnormal code log.

[0091] According to an embodiment of the present invention, the log detection device 500 also includes a model construction module (not shown in the figure), which is used to: collect code log data, perform feature extraction on the code log data, and construct a sample set based on the result of the feature extraction; use the sample set to train the initial classification model, and perform performance verification on multiple candidate classification models obtained through training, and select a classification model for constructing the log detection model from the multiple candidate classification models based on the performance verification result; determine the neighborhood parameter value for model construction based on the characteristics of each sample in the sample set, and then obtain an anomaly detection model; according to a preset fusion strategy set, fuse the classification model and the anomaly detection model to obtain multiple candidate log detection models; based on the sample set, compare the performance of each candidate log detection model, and determine the log detection model from the multiple candidate log detection models based on the performance comparison result.

[0092] According to another embodiment of the present invention, the model building module (not shown in the figure) is also used to: classify the code log data according to the result of feature extraction, aggregate the code log data with the same features, and establish a code log data set corresponding to each feature; search for target features that match preset extracted features from the result of feature extraction, and aggregate the code log data sets corresponding to the target features into the sample set.

[0093] According to another embodiment of the present invention, the model building module (not shown in the figure) is also used to: perform stratified sampling on the sample set based on the proportion of the preset training set and test set in the sample set to obtain a training set and a test set; based on the training set, use the sequence minimum optimization algorithm and the distributed computing framework, combined with the radial basis kernel function, to train the preset classification initial model to obtain multiple alternative classification models; use the test set to verify the prediction accuracy and comprehensive performance indicators of each of the alternative classification models.

[0094] According to another embodiment of the present invention, the log detection device 500 also includes a single model parameter tuning module (not shown in the figure), which is used to: after selecting a classification model for constructing the log detection model from the multiple candidate classification models according to the performance verification result, based on the test set in the sample set, use a grid search method to adjust the penalty parameter value of the classification model, and use the adjusted penalty parameter value to optimize the classification model, so that the optimized classification model is used for constructing the log detection model; after determining the neighborhood parameter value of the model construction according to the characteristics of each sample in the sample set and then obtaining the anomaly detection model, based on the test set in the sample set, use a grid search method to adjust the neighborhood parameter value of the model construction, and use the adjusted neighborhood parameter value to optimize the anomaly detection model, so that the optimized anomaly detection model is used for constructing the log detection model.

[0095] According to another embodiment of the present invention, the log detection device 500 also includes a fusion model parameter tuning module (not shown in the figure), after obtaining the abnormal code log existing in the code log to be detected output by the log detection model, the model performance index of the log detection model is calculated according to the abnormal code log, and the key parameter values ​​in the classification model and the anomaly detection model constituting the log detection model are adjusted according to the model performance index, and the log detection model is updated using the adjusted key parameter values.

[0096] According to another embodiment of the present invention, the anomaly detection model is mainly used to calculate the local density of each received code log feature, calculate the anomaly score value of each code log feature based on the local density, and then determine the abnormal code log feature from each code log feature based on each anomaly score value, so as to output the abnormal code log corresponding to the abnormal code log feature; the fusion strategy includes a voting mechanism fusion strategy, a weighted average fusion strategy and a stacking fusion strategy.

[0097] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention can be applied.

[0098] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0099] Users can use terminal devices 601, 602, 603 to interact with server 605 through network 604 to receive or send messages, etc. Various communication client applications, such as log detection applications, etc., can be installed on terminal devices 601, 602, 603 (only as an example).

[0100] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0101] Server 605 can be a server that provides various services, such as a background management server that provides support for the logs performed by users using terminal devices 601, 602, and 603 (only as an example). The background management server can obtain the code log to be detected and perform feature extraction on the code log to be detected; input the result of the feature extraction into a pre-built log detection model, obtain the abnormal code log existing in the code log to be detected output by the log detection model, and obtain the log detection model by fusing the classification model and the abnormal detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set; according to the abnormal code log, locate the corresponding abnormal code and other processing, and feed back the processing result to the terminal device.

[0102] It should be noted that the log detection method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the log detection device is generally disposed in the server 605 .

[0103] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0104] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 7 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0105] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0106] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0107] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0108] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0109] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes: a log acquisition module, a log detection module and a result acquisition module.

[0111] The names of these modules do not, in some cases, limit the modules themselves. For example, the log acquisition module can also be described as a "module for acquiring the code log to be detected and performing feature extraction on the code log to be detected."

[0112] On the other hand, the present invention also provides a computer-readable medium, which may be included in the device described in the embodiment; or it may exist independently without being assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by a device, the device includes: obtaining a code log to be detected, and performing feature extraction on the code log to be detected; inputting the result of the feature extraction into a pre-built log detection model, obtaining an abnormal code log existing in the code log to be detected output by the log detection model, and the log detection model is obtained by fusing the classification model and the abnormal detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set; according to the abnormal code log, locating the corresponding abnormal code.

[0113] The technical solution according to the embodiment of the present invention has the following advantages or beneficial effects: by obtaining the code log to be detected and performing feature extraction on the code log to be detected; inputting the result of the feature extraction into a pre-built log detection model, obtaining the abnormal code log existing in the code log to be detected output by the log detection model, and obtaining the log detection model by fusing the classification model and the abnormal detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set; according to the abnormal code log, the technical solution of locating the corresponding abnormal code realizes an efficient and accurate log detection, which not only saves human resources, but also adopts the preferred fusion strategy to construct the log detection model, which can greatly improve the detection accuracy, and provide developers with a friendly and efficient code log detection tool.

[0114] The specific implementation methods described herein do not constitute limitations on the scope of protection of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A log detection method, characterized in that: include: Obtaining a code log to be detected, and performing feature extraction on the code log to be detected; Input the result of feature extraction into a pre-built log detection model, obtain the abnormal code log in the code log to be detected output by the log detection model, and obtain the log detection model by fusing the classification model and the abnormal detection model according to a preset fusion strategy, wherein the fusion strategy comes from a preset fusion strategy set; According to the abnormal code log, the corresponding abnormal code is located.

2. The method according to claim 1, characterized in that The log detection model is constructed in the following way: Collecting code log data, performing feature extraction on the code log data, and constructing a sample set according to the result of the feature extraction; Using the sample set to train an initial classification model, and performing performance verification on multiple candidate classification models obtained through training, and selecting a classification model for constructing the log detection model from the multiple candidate classification models according to the performance verification results; Determine the neighborhood parameter value of the model construction according to the characteristics of each sample in the sample set, and then obtain the anomaly detection model; According to a preset fusion strategy set, the classification model and the anomaly detection model are fused to obtain multiple candidate log detection models; Based on the sample set, the performances of the candidate log detection models are compared, and according to the performance comparison result, the log detection model is determined from the plurality of candidate log detection models.

3. The method according to claim 2, characterized in that According to the results of feature extraction, a sample set is constructed, including: According to the result of feature extraction, the code log data is classified, the code log data with the same features are aggregated, and a code log data set corresponding to each feature is established; A target feature matching a preset extracted feature is searched from the feature extraction result, and the code log data set corresponding to the target feature is aggregated into the sample set.

4. The method according to claim 2, characterized in that: The sample set is used to train an initial classification model, and the performance of multiple candidate classification models obtained through training is verified, including: Based on the proportion of the preset training set and the test set in the sample set, the sample set is stratified sampled to obtain a training set and a test set; Based on the training set, a sequential minimum optimization algorithm and a distributed computing framework are used in combination with a radial basis kernel function to train a preset initial classification model to obtain multiple candidate classification models; The test set is used to verify the prediction accuracy and comprehensive performance indicators of each of the candidate classification models.

5. The method according to claim 2, characterized in that: After selecting a classification model for constructing the log detection model from a plurality of candidate classification models according to the performance verification result, the method further includes: Based on the test set in the sample set, a grid search method is used to adjust the penalty parameter value of the classification model, and the classification model is optimized using the adjusted penalty parameter value, so that the optimized classification model is used for constructing the log detection model; After determining the neighborhood parameter value for model construction according to the features of each sample in the sample set, and then obtaining the anomaly detection model, the method further includes: Based on the test set in the sample set, a grid search method is used to adjust the neighborhood parameter values ​​of the model construction, and the adjusted neighborhood parameter values ​​are used to optimize the anomaly detection model, so that the optimized anomaly detection model is used for the construction of the log detection model.

6. The method according to claim 1, characterized in that After obtaining the abnormal code log existing in the code log to be detected output by the log detection model, the method further includes: According to the abnormal code log, the model performance index of the log detection model is calculated, and according to the model performance index, the key parameter values ​​in the classification model and the abnormality detection model constituting the log detection model are adjusted, and the adjusted key parameter values ​​are used to update the log detection model.

7. The method according to claim 1, characterized in that The anomaly detection model is mainly used to calculate the local density of each received code log feature, calculate the anomaly score value of each code log feature according to the local density, and then determine the abnormal code log feature from each code log feature according to each abnormal score value, so as to output the abnormal code log corresponding to the abnormal code log feature; The fusion strategies include voting mechanism fusion strategy, weighted average fusion strategy and stacking fusion strategy.

8. A log detection device, characterized in that: include: A log acquisition module, used to acquire the code log to be detected and perform feature extraction on the code log to be detected; A log detection module, used for inputting the result of feature extraction into a pre-built log detection model, obtaining the abnormal code log existing in the code log to be detected output by the log detection model, wherein the log detection model is obtained by fusing the classification model and the abnormality detection model according to a preset fusion strategy, and the fusion strategy comes from a preset fusion strategy set; The result acquisition module is used to locate the corresponding abnormal code according to the abnormal code log.

9. A mobile electronic device terminal, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images