Log anomaly detection method, graph neural network training method and related equipment

Abstract

The invention discloses a log anomaly detection method, a graph neural network training method and related equipment, and the method comprises the steps: obtaining a plurality of log sequences and a semantic vector of each log sequence, each log sequence comprises a plurality of pieces of semantically related log data, the semantic vector of each log sequence comprises a plurality of sub-vectors, and each sub-vector comprises a plurality of sub-vectors; the plurality of log sequences comprise a first log sequence and a second log sequence, and the first log sequence has a label representing an abnormal category; based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, creating a relation graph which is used for describing a semantic relation of the plurality of log sequences; and predicting the abnormal category of the second log sequence based on the relation graph and the label of the first log sequence through a graph neural network.

Description

Technical Field

[0001] The present application relates to the field of log data processing, and in particular to a log anomaly detection method, a graph neural network training method, and related equipment. Background Art

[0002] With the rapid development of information technology, various information systems generate a large amount of log data in daily operations. These data not only record the operating status of the system, but also contain rich fault information and potential security risks. Therefore, anomaly detection of log data is crucial to ensure the stable operation of the system and information security.

[0003] However, traditional detection methods rely on the professionalism of the testers and require a lot of experience and trial and error, which leads to problems such as low detection efficiency, easy errors, and low accuracy. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a log anomaly detection method, a graph neural network training method and related equipment to solve the problems of low detection efficiency, easy errors and low accuracy in traditional log detection methods.

[0005] In order to achieve the above objectives, the present application embodiment adopts the following technical solutions: In a first aspect, an embodiment of the present application provides a log anomaly detection method, comprising: Acquire multiple log sequences and a semantic vector of each log sequence, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; Creating a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; Using a graph neural network, based on the relationship graph and the label of the first log sequence, predict the abnormal category of the second log sequence.

[0006] In a second aspect, an embodiment of the present application provides a graph neural network training method, including: Acquire a plurality of first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence includes a plurality of semantically related first sample log data, the semantic vector of each first sample log sequence includes a plurality of sub-vectors, and the plurality of first sample log sequences have labels indicating abnormal categories; Creating a relationship map based on correlation coefficients between subvectors in semantic vectors of different first sample log sequences, where the relationship map is used to describe the semantic relationship between the multiple first sample log sequences; Determine a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predict an abnormal category of the third sample log sequence based on the relationship graph and a label of the second sample log sequence through a graph neural network; Based on the abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted.

[0007] In a third aspect, an embodiment of the present application provides a log anomaly detection device, including: an acquiring unit, configured to acquire a plurality of log sequences and a semantic vector of each log sequence, wherein each log sequence includes a plurality of log data that are semantically related, and the semantic vector of each log sequence includes a plurality of sub-vectors, and the plurality of log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; A creating unit, used to create a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; A prediction unit is used to predict an abnormal category of the second log sequence based on the relationship graph and the label of the first log sequence through a graph neural network.

[0008] In a fourth aspect, an embodiment of the present application provides a graph neural network training device, including: an acquiring unit, configured to acquire a plurality of first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence including a plurality of semantically related first sample log data, the semantic vector of each first sample log sequence including a plurality of sub-vectors, and the plurality of first sample log sequences having labels indicating abnormal categories; A creating unit, configured to create a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different first sample log sequences, wherein the relationship map is used to describe the semantic relationship between the plurality of first sample log sequences; a prediction unit, configured to determine a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predict an abnormal category of the third sample log sequence based on the relationship graph and a label of the second sample log sequence through a graph neural network; The prediction unit is further used to adjust the parameters of the graph neural network based on the abnormal category of the third sample log sequence and the label of the third sample log sequence.

[0009] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method described in the first aspect or the second aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the method described in the first aspect or the second aspect.

[0011] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute part or all of the steps in the method described in the first aspect or the second aspect.

[0012] At least one of the above-mentioned technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: by obtaining multiple log sequences and their semantic vectors, each log sequence includes multiple semantically related log data, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence with a label and a second log sequence without a label, the content of the label indicates the abnormal category to which the first log sequence belongs, based on the correlation coefficient between the sub-vectors in the semantic vectors of different log sequences, a relationship graph is created, and through a graph neural network, based on the relationship graph and the label of the first log sequence, the abnormal category of the second log sequence is predicted, which can improve the degree of automation of anomaly detection, thereby improving the efficiency of log detection, reducing the dependence on the professional experience of detection personnel, reducing human errors, and improving the accuracy of log detection, so as to quickly identify potential system failures and security risks, thereby ensuring the stable operation and security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A flow chart of a log anomaly detection method provided for an embodiment of the present application; Figure 2 A flowchart of a graph neural network training method provided for one embodiment of the present application; Figure 3A A schematic diagram of the structure of correlation coefficients between sub-vectors in semantic vectors of different log sequences provided by an embodiment of the present application; Figure 3BA schematic diagram of a processing flow of a graph neural network provided for one embodiment of the present application; Figure 4 A schematic flow chart of another graph neural network training method provided for one embodiment of the present application; Figure 5 A schematic diagram of the structure of a log anomaly detection device provided for an embodiment of the present application; Figure 6 A schematic diagram of the structure of a graph neural network training device provided for one embodiment of the present application; Figure 7 A schematic diagram of the structure of an electronic device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0014] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0015] The terms "first", "second", etc. in this specification and claims are used to distinguish similar objects, and are not used to describe a particular order or precedence. It should be understood that the terms used in this way can be interchanged where appropriate so that the embodiments of the present application are implemented in a sequence other than those illustrated or described herein. In addition, "and / or" in this specification and claims means at least one of the connected objects, and the character " / " generally means that the objects associated with each other are in an "or" relationship.

[0016] With the rapid development of information technology, various information systems generate a large amount of log data in daily operations. These data not only record the operating status of the system, but also contain rich fault information and potential security risks. Therefore, anomaly detection of log data is crucial to ensure the stable operation of the system and information security.

[0017] However, traditional detection methods rely on the professionalism of the testers and require a lot of experience and trial and error, which leads to problems such as low detection efficiency, easy errors, and low accuracy.

[0018] In view of this, an embodiment of the present application provides a log anomaly detection method, which obtains multiple log sequences and their semantic vectors, each log sequence includes multiple semantically related log data, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence with a label and a second log sequence without a label, the content of the label indicates the anomaly category to which the first log sequence belongs, and creates a relationship graph based on the correlation coefficient between the sub-vectors in the semantic vectors of different log sequences. Through a graph neural network, the anomaly category of the second log sequence is predicted based on the relationship graph and the label of the first log sequence. The degree of automation of anomaly detection can be improved, thereby improving the efficiency of log detection, reducing dependence on the professional experience of detection personnel, reducing human errors, and improving the accuracy of log detection, thereby quickly identifying potential system failures and security risks, thereby ensuring the stable operation and security of the system.

[0019] Based on the same inventive concept, an embodiment of the present application also provides a graph neural network training method, which obtains multiple first sample log sequences and their semantic vectors, each first sample log sequence includes multiple semantically related first sample log data, the semantic vector of each first sample log sequence includes multiple sub-vectors, and the multiple first sample log sequences all carry labels representing abnormal categories. Based on the correlation coefficients between the sub-vectors in the semantic vectors of different first sample log sequences, a relationship graph is created, and the relationship graph is used to describe the semantic relationship between the multiple first sample log sequences. The second sample log sequence and the third sample log sequence are determined from the multiple first sample log sequences, and the abnormal category of the third sample log sequence is predicted based on the relationship graph and the label of the second sample log sequence through the graph neural network. Based on the predicted abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted. By continuously adjusting the parameters, the prediction result of the third sample log sequence is close to the label, so that the graph neural network has the ability to accurately predict the abnormal category of the log data.

[0020] It should be understood that the log anomaly detection method and graph neural network training method provided in the embodiments of the present application can be executed by an electronic device or software installed in an electronic device. The so-called electronic device here may include terminal devices, such as smart phones, tablet computers, laptops, desktop computers, intelligent voice interaction devices, smart home appliances, smart watches, vehicle terminals, aircraft, etc.; or, the electronic device may also include a server, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0021] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0022] See also Figure 1 , is a flow chart of a log anomaly detection method provided by an embodiment of the present application. Figure 1 As shown, an embodiment of the present application provides a log anomaly detection method, which may include the following steps: S102, obtaining multiple log sequences and a semantic vector of each log sequence.

[0023] Each log sequence includes multiple log data that are semantically related. The semantic vector of each log sequence includes multiple sub-vectors. The multiple log sequences include a first log sequence and a second log sequence. The first log sequence has a label representing an abnormal category.

[0024] Log data records detailed information about operations or events in a system, application, or device. Log data usually comes from common systems, applications, or devices such as database servers, Web servers, application servers, and network devices such as routers and switches. As an optional method, multiple log data are obtained from different systems, applications, or devices, grouped according to specific data items such as user ID, transaction ID, etc., and arranged according to their generation time to obtain a main sequence. Without changing the arrangement order, the main sequence is divided into multiple subsequences based on a preset window to obtain multiple log sequences. Each subsequence corresponds to a log sequence, and each log sequence reflects the behavior state of the system, application, or device within a certain period of time. Among them, the size of the preset window determines the number of multiple log data in each log sequence. If the window is too small, it may not capture enough context information; if the window is too large, it may introduce too much noise and irrelevant information. The embodiment of the present application uses a graph neural network to create a relationship map based on multiple sequences obtained, and then predicts the log sequence of unknown abnormal categories, wherein the relationship map is used to describe the semantic relationship between multiple log sequences, and has a global message passing process during prediction, which can capture contextual information across log sequences, so only the impact of noise and irrelevant information needs to be considered. Without introducing too much noise and irrelevant information, the embodiment of the present application usually sets the window size to 2, that is, every two adjacent log data is a log sequence. This ensures that enough contextual information can be captured, and can also avoid introducing too much noise and irrelevant information, thereby improving the accuracy and reliability of the overall prediction.

[0025] Log data includes keywords and log parameters. Keywords are words used to describe the nature or type of log entries, usually in a fixed form. The information in the keyword part can quickly identify the category and important information of the log. Keywords include: timestamp, log level, log type, operation type, source / target, log parameters and other field data. Among them, the timestamp records the time when the log is generated, for example: 2024-07-02 14:35:00; the log level indicates the severity of the log, for example: INFO, DEBUG, WARN, ERROR, FATAL; the log type describes the type or module of the log, for example: Authentication, Transaction, System, Network; the operation type records the operation or event that occurred, for example: Login, FileUpload, DataUpdate, ServiceStart; the source / target indicates the source or target of the log, for example: IP address, user name, server name. Log parameters are dynamic or specific numerical information recorded in log entries to provide context or detailed information. They are usually used in conjunction with keywords to understand the specific details of the event. Log parameters include: user ID / user name, IP address, file name / path, operation result, error code, resource index and other field data. User ID / user name indicates the user involved, for example: user123,admin; IP address is the source or target IP, for example: 192.168.1.1; file name / path indicates the file or path involved, for example: / var / log / syslog, document.txt; operation result describes the result of the operation, for example: Success, Failed, Timeout; error code is a specific error code, for example: 404, 500, ERR1234; resource index refers to indicators such as CPU usage, memory usage, for example: CPU: 75%, Memory: 2GB.

[0026] Semantics is the meaning or connotation of text information. A semantic vector is a numerical vector that can represent the semantics of text information. By performing semantic extraction on text information and converting it into a vector, a semantic vector of the text information is obtained, which can better capture the semantic relationship between texts in the subsequent prediction process. In an embodiment of the present application, the semantic vector of the log data is obtained by converting the text information in the log data into a vector. According to the arrangement order of multiple log data in the log sequence, the semantic vectors of multiple log data in the log sequence are spliced ​​to obtain the semantic vector of the log sequence. For example, the log sequence includes log data A and log data B. The semantic vector of log data A is [203, 1011, 7, 1011, 2, 14,235, 351, 293, 312, 274, 2114, 11419, 3048, 19247, 2020, 2022, 10468, 4469], and the semantic vector of log data B is [2024, 1011, 7, 1011, 2, 14, 235, 351, 293, 312, 274,2114, 11419, 3048, 19247, 2020, 2022, 10468, 4469], and through concatenation, the semantic vector of the log sequence is [203, 1011, 7, 1011, 2, 14, 235, 351, 293, 312, 274, 2114, 11419,3048, 19247, 2020, 2022, 10468, 4469, 2024, 1011, 7, 1011, 2, 14, 235, 351,293, 312, 274, 2114, 11419,3048, 19247, 2020, 2022, 10468, 4469].

[0027] The sub-vector of the semantic vector represents a component of a specific dimension in the semantic vector. By dividing the semantic vector according to specific conditions, each part obtained by the division is a sub-vector. In an embodiment of the present application, the multiple sub-vectors included in the semantic vector of the log sequence can be equally divided based on a preset threshold. For example, assuming that the preset threshold n=4, 4 sub-vectors are obtained by evenly dividing the semantic vector of the log sequence. Each log data can also be used as a division unit, that is, the semantic vector of each log data in the log sequence corresponds to one of the sub-vectors of the log sequence. This division method can better reflect the similarity between different log sequences when calculating the correlation coefficient later, and reflect the similarity of the system's operations or events in two different time periods, thereby better predicting the abnormal category, and is also convenient for calculation and avoids waste of computing resources.

[0028] As an optional method, the text information in the log data can be encoded through a coding model to achieve vector conversion and obtain a corresponding semantic vector. As an example, the coding model can be a Transformer encoder, such as a 12-layer Transformer encoder, or a BERT model or other model training, which is not specifically limited in the embodiments of the present application. In order to fully capture the contextual information of the text information in the log data, accurately extract the semantics of the text information in the log data, and then ensure that the semantic vector obtained by the conversion can fully or fully represent the semantics of the text information in the log data, the embodiments of the present application also provide a training method for the coding model, which will be described in detail in subsequent embodiments, and will not be described here.

[0029] As a specific implementation method, when performing vector conversion on log data, it includes: performing word segmentation processing on the text information in the log data through a word segmenter to obtain independent words, and marking the beginning and end of each log data with special tags, such as [CLS] and [SEP], and then inputting the log data with special tags into the word embedding model for vector conversion. Among them, the [CLS] tag is a symbol used for text classification tasks, and the [SEP] tag is an end delimiter used to separate different log sentences. By using word segmentation and special tags, the processing of text information is optimized and the performance of subsequent models is improved. Word segmentation can improve the parsability and semantic representation ability of text, thereby improving the accuracy of anomaly detection and classification, and can better cope with diversified and complex log data.

[0030] As an example, the word segmenter may use, for example, including but not limited to Byte Pair Encoding, WordPiece, SentencePiece, etc., which is not specifically limited in the embodiments of the present application.

[0031] As an optional method, before the word segmentation is performed on the text information in the log data by the word segmenter, the method also includes: preprocessing and parsing the log data, filtering out the text information such as keywords and log parameters in the log data, and then performing word segmentation on the filtered text information such as keywords and log parameters by the word segmenter. Only the text information that can provide context or detailed information is converted into a vector, which improves the conversion efficiency and accuracy.

[0032] Here, an example is used to illustrate the process of obtaining the semantic vector of a log sequence, which should not be understood as a limitation on the method of the embodiment of the present application. Example: The log sequence includes two log data. After preprocessing and parsing, the content is 2024-07-02 14:35:00 INFO Authentication Login user123 from IP 192.168.1.10 Success; 2024-07-02 14:36:00 INFO Authentication Login user125 from IP 192.168.1.11 Success; then, the result of segmentation and tagging using the word segmenter based on the bert-base-uncased model is ['[CLS]', '2024', '-', '07', '-', '02', '14', ':', '35', ':', '00', 'info', 'authentication', 'login', 'user123', 'from', 'ip', '192.168.1.10', 'success','[SEP]', '2024', '-', '07', '-', '02', '14', ':', '36', ':', '00', 'info', 'authentication', 'login', 'user125', 'from', 'ip', '192.168.1.11', 'success','[SEP]'], then, through the encoding model for vector transformation and concatenation, the semantic vector of the log sequence is [101,2024, 1011, 7, 1011, 2, 14, 235, 351, 293, 312, 274, 2114, 11419, 3048,19247, 2020, 2022, 10468, 4469, 102, 2024, 1011, 7, 1011, 2, 14, 235, 351,293, 312, 274, 2114, 11419, 3048, 19247, 2020, 2022, 10468, 4469, 102].

[0033] The exception category refers to the exception type of the events and operations recorded in the log data, for example, including but not limited to network exceptions, database exceptions, hardware exceptions, I / O exceptions, operating system exceptions and other types. Labels are identification information used to classify different exception types. Labels are also used to distinguish whether there are exceptions, that is, the label of the first log sequence includes a label indicating a specific exception category, or a label indicating no exception. In an embodiment of the present application, based on the identification information of each first log sequence, it is possible to determine whether the first log sequence has an exception, and what kind of exception exists.

[0034] S104, creating a relationship graph based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences.

[0035] The relationship map is used to describe the semantic relationship between multiple log sequences. The similarity or correlation between different log sequences is measured by the correlation coefficient between the sub-vectors in the semantic vectors of different log sequences, and then a relationship map is created based on the correlation between different log sequences. The correlation coefficient refers to the relationship or interdependence between different data items. As an optional method, the correlation coefficient can be calculated by the Pearson coefficient, and also includes calculation by the Spearman correlation coefficient, the Kendall correlation coefficient, etc., which is not specifically limited in the embodiments of the present application.

[0036] As an optional implementation, the above S106 may include the following steps: creating multiple nodes, where the multiple nodes correspond to the multiple log sequences one by one; Determine the correlation coefficients between different log sequences based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences; Based on the correlation coefficients between different log sequences, connection edges are created between nodes corresponding to different log sequences; Based on the created nodes and connecting edges, a relationship graph is obtained.

[0037] A node is an element in a relational graph that represents a single log sequence. Each node corresponds to a log sequence. As an example, a node can store a semantic vector corresponding to the log sequence, as well as attribute information of the edges connecting the node to other nodes. In graphical representations, nodes are usually represented by circles or other shapes.

[0038] A connection edge is a line segment connecting two nodes in a relationship graph, which is used to represent the similarity or correlation between different nodes or different log sequences. As an optional method, a threshold can be set. When the correlation coefficient between two log sequences meets the preset threshold, a connection edge is created between the nodes corresponding to the two log sequences. As another optional method, the correlation coefficient between the two log sequences can also be used as the attribute information of the connection edge between the corresponding nodes, and this attribute information is saved in the two nodes. Based on the created connection edges, nodes, and the semantic vectors and attribute information of the connection edges saved in the nodes, a relationship graph for predicting abnormal categories is obtained.

[0039] The embodiment of the present application determines and creates connection edges between nodes corresponding to different log sequences based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences, and obtains a relationship map based on the created nodes and connection edges. The relationship map obtained in this way not only considers the overall semantics of the log sequence, but also incorporates the local feature relationship of the log sequence. Through the relationship map, the relationship between different log sequences is intuitively presented in a graphical manner, thereby providing a clearer semantic structure for subsequent anomaly detection. By analyzing the correlation coefficients between sub-vectors in the semantic vector, the similarity between log sequences can be determined more accurately, thereby reducing the subjective judgment in the traditional detection method, reducing the false positive rate and the missed judgment rate, and helping to more efficiently capture potential faults and safety risks, realize real-time monitoring and rapid response of information systems, and greatly improve the stability and security of the system.

[0040] As an optional implementation, when multiple sub-vectors correspond one-to-one to multiple log data, and the sub-vectors in the semantic vector of the same log sequence are sorted according to the generation time of the corresponding log data, the above-mentioned determination of the correlation coefficients between different log sequences based on the correlation coefficients between the sub-vectors in the semantic vectors of different log sequences may include the following steps: determining the correlation coefficient between the k-th sub-vector in the semantic vector of the third log sequence and the k-th sub-vector in the semantic vector of the fourth log sequence, to obtain the k-th correlation coefficient between the third log sequence and the fourth log sequence, where k is an integer greater than or equal to 1 and less than or equal to K, K is the number of the multiple sub-vectors, and the third log sequence and the fourth log sequence are any two log sequences among the multiple log sequences; Based on the sum of K correlation coefficients between the third log sequence and the fourth log sequence, a correlation coefficient between the third log sequence and the fourth log sequence is determined.

[0041] As an example, you can use To represent the created relationship graph, where V is a node set consisting of different first log sequences, including the node feature matrix X, each node There is a set of node features, namely, The semantic vector of ,in addition, ,in, Represents the kth subvector in the semantic vector corresponding to the i-th node. is the adjacency matrix, which represents the connection relationship between different nodes. The connection relationship between any two nodes is ,in, , represents the element in the i-th row and j-th column of the adjacency matrix A, for and The correlation coefficient between them, where S represents the number of nodes in the graph. Figure 3A Schematic diagram of the structure of the correlation between sub-vectors in the semantic vectors of different log sequences.

[0042] Here, a specific example is used to illustrate the above process of calculating the correlation coefficient between the sub-vectors of the semantic vectors of different log sequences, which should not be understood as a limitation on the method of the embodiment of the present application. For example: Assume that there are two log sequences, the sub-vectors in the semantic vector of log sequence L1 include v(1,1), v(1,2), and v(1,3); the sub-vectors in the semantic vector of log sequence L2 include v(2,1), v(2,2), and v(2,3). V(1,k) represents the kth sub-vector in the semantic vector of log sequence L1, and v(2,k) represents the kth sub-vector in the semantic vector of log sequence L2. The sub-vectors (v1,k) and (v2,k) correspond one-to-one to the log data in the log sequence, that is, log sequence L1 includes 3 log data, and their generation order is the same as the arrangement order of the sub-vectors. The k correlation coefficients between the log sequence L1 and the log sequence L2 include r(1,1,2,1)=corr[v(1,1),v(2,1)], r(1,2,2,2)=corr[v(1,2),v(2,2)], and r(1,3,2,3)=corr[v(1,3),v(2,3)]. Calculating the sum of the k correlation coefficients, we get the correlation coefficient R(1,2)=r(1,1,2,1)+r(1,2,2,2)+r(1,3,2,3) between the log sequence L1 and the log sequence L2.

[0043] As an optional method, according to actual conditions, the correlation coefficient between the third log sequence and the fourth log sequence can be further normalized to obtain the comprehensive correlation coefficient between the third log sequence and the fourth log sequence. This can enhance the accuracy and stability of log data analysis, provide strong data support for subsequent anomaly detection and decision support, and improve the accuracy of prediction by improving the comparability and consistency of data.

[0044] The embodiment of the present application can better capture the changing trend of log data in the time dimension and its potential relationship by sorting the sub-vectors in the same log sequence by time and calculating the correlation coefficients between the corresponding sub-vectors one by one, so that the system can automatically identify and analyze abnormal patterns in log data, which helps to discover potential faults or security risks early, thereby improving the stability and security of the information system.

[0045] S106, predicting the abnormal category of the second log sequence based on the relationship graph and the label of the first log sequence through a graph neural network.

[0046] A graph neural network is a deep learning model based on graph structure data. It classifies unlabeled nodes by learning the node features of nodes and the relationship between the edges between nodes, and then predicts the abnormal category to which the log sequence belongs, and discovers abnormal or dangerous events that exist in the system within a certain period of time. In order to improve the accuracy of the prediction, the embodiment of the present application also provides a graph neural network training method, which will be described in detail in the subsequent embodiments and will not be described here.

[0047] The embodiment of the present application obtains multiple log sequences and their semantic vectors, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence with a label and a second log sequence without a label, the content of the label indicates the abnormal category to which the first log sequence belongs, and creates a relationship graph based on the correlation coefficient between the sub-vectors in the semantic vectors of different log sequences. Through a graph neural network, the abnormal category of the second log sequence is predicted based on the relationship graph and the label of the first log sequence, which can improve the degree of automation of anomaly detection, thereby improving the efficiency of log detection, reducing dependence on the professional experience of detection personnel, reducing human errors, and improving the accuracy of log detection, thereby quickly identifying potential system failures and security risks, thereby ensuring the stable operation and security of the system.

[0048] The embodiment of the present application also provides a graph neural network training method, which is used to train the graph neural network in the above embodiment method to further improve the accuracy and reliability of log anomaly detection.

[0049] Specifically, see Figure 2 , which is a flowchart of a graph neural network training method provided by an embodiment of the present application, may include the following steps: S202: Obtain multiple first sample log sequences and a semantic vector of each first sample log sequence.

[0050] Each first sample log sequence includes a plurality of semantically related first sample log data, a semantic vector of each first sample log sequence includes a plurality of sub-vectors, and the plurality of first sample log sequences have labels indicating abnormal categories.

[0051] The first sample log data is used to train the graph neural network. After obtaining multiple first sample log data from different systems, applications or devices, the multiple first sample log data are arranged and grouped to obtain a first sample log sequence, and then the multiple first sample log data in each first sample log sequence are preprocessed, parsed, segmented, labeled, vectorized, and spliced ​​to obtain a semantic vector of each first sample log sequence, and the semantic vector of each first sample log sequence is divided to obtain multiple sub-vectors in the semantic vector of the first sample log sequence. The processing method is the same as the processing method in the log anomaly detection method proposed above, and will not be repeated here.

[0052] The label of the first sample log sequence is determined and labeled through manual analysis based on multiple first sample log data in the first sample log sequence. Some labels of the first sample log sequence indicate that there is no anomaly in the first sample log sequence, and some labels of the first sample log sequence indicate that there is an anomaly in the first sample log sequence and what kind of anomaly it is.

[0053] The embodiment of the present application also provides a coding model training method for training a coding model to obtain semantic vectors of the above-mentioned log sequence and the first sample log sequence, so as to further improve the accuracy and reliability of log anomaly detection.

[0054] Specifically, as an optional implementation manner, the semantic vector of each first sample log sequence is obtained by encoding each first sample log sequence through a coding model; The encoding model is trained in the following way: Acquire a fourth sample log sequence, where the fourth sample log sequence includes a plurality of fourth sample log data; For each fourth sample log data, randomly mask the words in the fourth sample log data to obtain a fine-tuning training set; The fine-tuning training set is input into the encoding model for fine-tuning processing, and the fine-tuning processing includes: obtaining context information before and after the masked words through the encoding model, predicting the masked words based on the context information, and adjusting the parameters of the encoding model based on the predicted probability of the masked words.

[0055] The encoding model is a deep learning model used to convert input text information into the form of a numerical vector. It learns the structure and semantics of the input text information and encodes it into a numerical vector suitable for machine learning tasks.

[0056] Context information refers to the semantics and position of a specific word in text information. Because different words have different meanings in different contexts, the encoding model is required to capture context information and perform vector conversion based on context information. Traditional unidirectional models, such as GPT, RNN language models, etc., can only generate text step by step from left to right or from right to left, which limits the model's use of bidirectional context information. For example, when only the previous text is used to predict the current word, the model may not be able to fully utilize the information after the current word. The embodiment of the present application predicts the masked words based on the context information before and after the masked words through the encoding model, so that the trained model can not only capture the content before the masked words, but also capture the content after the masked words, thereby better capturing the semantics and syntactic relationship of the masked words in the sentence. This can improve the quality of the semantic vector representation of the log sequence, thereby improving the effect of anomaly detection.

[0057] Random masking is to randomly select words in the fourth sample log data for masking. For example: given a sentence "2024-07-02 14:35:00 INFO Authentication Login user123 from IP192.168.1.10 Success", after masking, the sentence becomes "2024-07-02 14:35:00 INFOAuthentication [MASK] user123 from IP 192.168.1.10 Success.", where [MASK] is the masking token and the word "Login" is the masked word.

[0058] In order to prevent the model from over-relying on the [MASK] tag and improve the generalization ability of the model, the selected word is not always replaced with [MASK], but may be replaced with other words. Specifically, it will vary according to the masking strategy. For example: In 80% of cases, the selected word will be replaced with [MASK], that is, "Login" in the above example is replaced with "[MASK]", so that the model can explicitly learn how to predict the masked word; in 10% of cases, the selected word will be replaced with a random word, that is, "Login" may be replaced with "banana", to avoid the model from relying entirely on the [MASK] tag; in 10% of cases, the selected word remains unchanged, that is, "Login" remains unchanged, allowing the model to retain the original information and learn to make predictions in the non-masked case.

[0059] In order to make the model predict accurately, for each masked word, the model will output a probability distribution table. The probability in the table represents the probability that each word in the vocabulary may be a masked word, which represents the probability that the model believes each word is a masked word. The difference between the distribution predicted by the model and the actual masked word is calculated through the loss function, and the parameters of the model are optimized and updated through back propagation based on this difference, so that the model gradually learns how to predict the masked words more accurately. The parameters of the encoding model are adjustable values ​​learned during the model training process, such as the learning rate. These parameters usually include weights and biases, which can affect how the input data is processed by the model, thereby affecting the final output results. As an example, optimizers such as Adam and AdamW can be used to optimize the parameters of the model.

[0060] As another optional method, before fine-tuning the encoding model based on the fourth sample log sequence, the above method also includes obtaining a large amount of natural language text data, such as a Wikipedia data set, as a training set, and pre-training the encoding model through mask prediction. The model is able to learn the semantic information and contextual relationships of the text, so that it can generate a more accurate vector representation. By using mask prediction in both the pre-training and fine-tuning stages, and training the encoding model through the same prediction task, the consistency of model training can be maintained, ensuring that the model can further optimize its understanding of the semantics and contextual relationships of the log data. Mask prediction is a self-supervised learning method that can achieve unsupervised training of the model, and thus does not require manual labeling of sample log data, saving manpower and time costs, and can use large quantities of sample log data to train the model.

[0061] In the embodiment of the present application, the fourth sample log data used for fine-tuning is the full amount of data, and there is no need to perform data screening on the fourth sample log data. When this part of the data is obtained, it is parsed and segmented, and then input into the encoding model for training. It can improve the performance and generalization ability of the model, ensure the integrity and richness of information, simplify the data processing process, and enhance the adaptability of the model in various application scenarios, which has a positive impact on the intelligence and automation level of the system and improves the effect of log analysis and anomaly detection.

[0062] The embodiment of the present application uses mask prediction so that the model needs to rely on the context information before and after the masked words for prediction. By continuously predicting different masked words, the model can better learn and understand the semantics of words in different contexts, so that the model can more accurately understand the meaning of text information when facing complex sentences, and then achieve accurate encoding to obtain the semantic vector of the log sequence. Through the training method of random masking and context prediction, the model is not only more robust when processing logs, but also can effectively adapt to variable input data, reduce classification errors caused by insufficient context information, and provide the system with stronger adaptive capabilities.

[0063] S204: Create a relationship graph based on correlation coefficients between sub-vectors in the semantic vectors of different first sample log sequences.

[0064] The relationship graph is used to describe the semantic relationship between multiple first sample log sequences.

[0065] The method for creating a relationship graph based on the correlation coefficients between sub-vectors in the semantic vectors of different first sample log sequences is the same as the processing method in the above-mentioned log anomaly detection method, and will not be repeated here.

[0066] S206, determining a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predicting an abnormal category of the third sample log sequence based on the relationship graph and the label of the second sample log sequence through a graph neural network.

[0067] It should be understood that the graph neural network in the embodiment of the present application is the original graph neural network, and the graph neural network in the above-mentioned log anomaly detection method is a graph neural network obtained after training with the training method provided in the embodiment of the present application.

[0068] The second sample log sequence is used to train the graph neural network. The third sample log sequence is used to test the trained graph neural network. According to the test results, the parameters of the graph neural network model are continuously adjusted to obtain the graph neural network in the log anomaly detection method proposed above. As an optional method, multiple first sample log sequences can be grouped in a random manner according to a certain ratio to obtain two sequence sets. The first sample log sequences in these two sequence sets are the second sample log sequence and the third sample log sequence, respectively.

[0069] As an optional implementation, determining the second sample log sequence and the third sample log sequence from the plurality of first sample log sequences in S206 may include the following steps: based on the label of each first sample log sequence, counting the number of first sample log sequences included in each abnormal category; For each abnormal category, if the number of first sample log sequences is less than or equal to a preset number threshold, the first sample log sequence included in the abnormal category is determined as the first sample log sequence of the pending abnormality; The first sample log sequence without pending exception is divided into a second sample log sequence and a third sample log sequence.

[0070] The preset number threshold is a specific value that is set in advance, usually based on historical experience, and is used to determine whether a certain anomaly category has enough sample log sequences to support its classification and training. When the number of the first sample log sequence of a certain anomaly category is less than or equal to this threshold, it means that the sample data of the anomaly category is insufficient for effective model training, so it will be regarded as a pending anomaly. When the number of the first sample log sequence of a certain anomaly category is greater than this threshold, it is a non-pending anomaly.

[0071] The first sample log sequence marked with a pending anomaly mark will no longer participate in the subsequent training process. This category of anomalies will be manually detected later. When the log data of this anomaly category accumulates to a certain amount, it will be added to the model for training to complete the update of the log detection system.

[0072] Here is an example to illustrate the determination process of the second sample log sequence and the third sample log sequence in the embodiment of the present application. For example: count the labels of multiple first sample log sequences, and record the number of first sample log sequences contained in each exception category. Assuming the preset threshold is 10, and the number of only network exceptions is 8, the first sample log sequence of this type of exception is automatically marked as a pending exception, and the number of database exceptions is 15, then the first sample log sequence of this type of exception is a non-pending exception. Then, for the first sample log sequence that is not marked as a pending exception, a random sampling method is used to select the first 70% of the non-pending exception logs as the second sample log sequence for model training, and the last 30% as the third sample log sequence for model testing.

[0073] It should be understood that in the embodiment of the present application, the second sample log sequence mentioned in the graph neural network training method and the first log sequence mentioned in the log anomaly detection method are the same log sequence.

[0074] The embodiment of the present application counts the number of first sample logs of various anomaly categories, excludes samples with a small number and difficult to classify, ensures the adequacy of sample data in model training, effectively improves the accuracy and reliability of anomaly detection, and can effectively avoid misjudgments due to insufficient samples, making anomaly detection more intelligent, which helps to improve the security and stability of the system, making the model more adaptable when processing complex log data and able to cope with the ever-changing network environment and potential security threats.

[0075] S208: Adjust the parameters of the graph neural network based on the abnormal category of the third sample log sequence and the label of the third sample log sequence.

[0076] After the model is trained for the first time based on the second sample log sequence, the trained model is used to predict the third sample log sequence. The model prediction results are compared with the original labels of the third sample log sequence, and the various indicators of the model, such as accuracy, are analyzed. If the indicators do not meet the standards, the parameters of the model are adjusted, and the model is trained again based on the second sample log sequence. Then, the third sample log sequence is predicted until all indicators meet the standards for the model to be put into practical use, thereby obtaining the graph neural network in the log anomaly detection method proposed above.

[0077] In the implementation of the present application, the graph neural network includes multiple convolutional layers and linear layers. The created relationship graph is processed by each convolutional layer and linear layer to obtain a prediction result, including the label of each third sample log sequence obtained by prediction. The abnormal category to which the corresponding second log sequence belongs is determined according to the predicted label, and compared with the manually marked label. Based on the comparison result, various indicators of the model, such as accuracy, are calculated. Figure 3B The processing process is shown.

[0078] As an optional method, during the training of the graph neural network, the prediction results obtained also include the predicted probability of each third sample log sequence corresponding to each abnormal category, that is, the confidence. The confidence is used to reflect the degree of possibility of which category the sample belongs to. Generally, the abnormal category corresponding to the maximum predicted probability is used as the final classification result of the sample. When calculating various indicators, the embodiment of the present application also compares the maximum predicted probability of each third sample log sequence with the preset probability threshold. If it is less than the preset probability threshold, the third sample log sequence is determined as a pending abnormality; if it is greater than or equal to, it is determined as a non-pending abnormality. Based on the predicted category results of the third sample log sequence of the non-pending abnormality, various indicators are calculated to further optimize the model parameters and improve the sensitivity and generalization ability of the model.

[0079] The embodiment of the present application obtains multiple first sample log sequences and their semantic vectors, each first sample log sequence includes multiple semantically related first sample log data, the semantic vector of each first sample log sequence includes multiple sub-vectors, and the multiple first sample log sequences all have labels representing abnormal categories. Based on the correlation coefficients between the sub-vectors in the semantic vectors of different first sample log sequences, a relationship graph is created, and the relationship graph is used to describe the semantic relationship between the multiple first sample log sequences. The second sample log sequence and the third sample log sequence are determined from the multiple first sample log sequences, and the abnormal category of the third sample log sequence is predicted based on the relationship graph and the label of the second sample log sequence through a graph neural network. Based on the predicted abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted. By continuously adjusting the parameters, the prediction result of the third sample log sequence is made close to the label, so that the graph neural network has the ability to accurately predict the abnormal category of log data.

[0080] The following is a complete example to illustrate the log anomaly detection method and graph neural network training method provided in the embodiment of the present application, which should not be understood as limiting the method of the embodiment of the present application. Graph neural network training training stage: please refer to Figure 4 , is a flow chart of another graph neural network training method provided by an embodiment of the present application. Figure 4 As shown, sample log data from different systems, application services or devices are collected, and a part of the sample log data is screened out by random sampling, for example, no less than 5000 sample log data, denoted as A, for training the graph neural network, and the remaining sample log data, that is, the fine-tuning set, denoted as B, is used for training the encoding model.

[0081] First, the training of the encoding model includes: pre-training the encoding model through mask prediction based on natural language text data, and then fine-tuning the encoding model through mask prediction based on the full amount of sample log data B to obtain a trained encoding model.

[0082] Then, the training of the graph neural network includes: grouping the sample log data A to obtain multiple first sample log sequences, labeling the multiple first sample log sequences to obtain labels representing the abnormal categories of the first sample log sequences, counting the number of first sample log sequences of each abnormal category, determining the first sample log sequences whose number does not meet the preset threshold as pending abnormalities, and determining the second sample log sequence, i.e., the training set, and the third sample log sequence, i.e., the test set, from the first sample log sequences that are not pending abnormalities according to a certain ratio, such as 9:1. Then, the sample log data in the first sample log sequence is vectorized by the trained encoding model to obtain the semantic vector of the first sample log sequence. Then, a relationship map is created based on the correlation coefficient between the sub-vectors in the semantic vectors of different first sample log sequences. Then, the third sample log sequence is predicted by the neural network model based on the relationship map and the label of the second sample log sequence, and the parameters of the graph neural network are adjusted based on the prediction result of the third sample log sequence and the label of the third sample log sequence until the various indicators of the graph neural network meet the requirements to obtain a trained graph neural network.

[0083] Log anomaly detection stage: perform anomaly detection on the logs to be detected through the trained encoding model and graph neural network. The log data to be detected is grouped to obtain a second log sequence, and the second sample log sequence in the above training stage is used as the first log sequence. The first log sequence and the second log sequence together constitute multiple log sequences in the log anomaly detection method embodiment. The log data in the trained encoding model log sequence is vectorized to obtain a semantic vector of the log sequence. Then, based on the correlation coefficients between the sub-vectors in the semantic vectors of different log sequences, a relationship graph is created. Then, through the trained graph neural network, based on the relationship graph and the label of the first log sequence, the anomaly category of the second log sequence is predicted, and then the anomaly of the log data to be detected is identified.

[0084] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] With the above Figure 1 Corresponding to the log anomaly detection method shown, the present application embodiment also proposes a log anomaly detection device. Figure 5, is a structural diagram of a log anomaly detection device provided by an embodiment of the present application, the device 500 includes: an acquisition unit 510, a creation unit 520, and a prediction unit 530.

[0086] The acquisition unit 510 is used to acquire multiple log sequences and a semantic vector of each log sequence, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category.

[0087] The creating unit 520 is used to create a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, where the relationship map is used to describe the semantic relationship between the multiple log sequences.

[0088] The prediction unit 530 is used to predict the abnormal category of the second log sequence based on the relationship graph and the label of the first log sequence through a graph neural network.

[0089] Optionally, when creating a relationship graph based on correlation coefficients between sub-vectors in the semantic vectors based on different log sequences, the creating unit 520 may perform the following steps: creating a plurality of nodes, wherein the plurality of nodes correspond one-to-one to the plurality of log sequences; Determine the correlation coefficients between different log sequences based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences; Based on the correlation coefficients between the different log sequences, creating connection edges between the nodes corresponding to the different log sequences; Based on the created nodes and connecting edges, the relationship graph is obtained.

[0090] Optionally, in the case where the multiple sub-vectors correspond one-to-one to the multiple log data, and the sub-vectors in the semantic vector of the same log sequence are sorted according to the generation time of the corresponding log data, the creation unit 520 may perform the following steps when determining the correlation coefficients between different log sequences based on the correlation coefficients between the sub-vectors in the semantic vectors of different log sequences: determine the correlation coefficient between the k-th sub-vector in the semantic vector of the third log sequence and the k-th sub-vector in the semantic vector of the fourth log sequence, and obtain the k-th correlation coefficient between the third log sequence and the fourth log sequence, where k is an integer greater than or equal to 1 and less than or equal to K, and K is the number of the multiple sub-vectors, and the third log sequence and the fourth log sequence are any two log sequences among the multiple log sequences; Based on the sum of K correlation coefficients between the third log sequence and the fourth log sequence, a correlation coefficient between the third log sequence and the fourth log sequence is determined.

[0091] Obviously, the log anomaly detection device provided in the embodiment of the present application can be used as Figure 1 The execution body of the log anomaly detection method shown is, for example Figure 1 In the log anomaly detection method shown in FIG. 1 , step S102 may be performed by Figure 5 The acquisition unit 510 in the log anomaly detection device shown in FIG. 1 is executed, and step S104 can be performed by Figure 5 The creation unit 520 in the log anomaly detection device shown in FIG. 1 is executed, and step S106 can be performed by Figure 5 The prediction unit 530 in the log anomaly detection device shown is executed.

[0092] With the above Figure 2 Corresponding to the graph neural network training method shown, the present application embodiment also proposes a graph neural network training device. Figure 6 , is a structural diagram of a graph neural network training device provided in one embodiment of the present application, the device 600 includes: an acquisition unit 610, a creation unit 620, and a prediction unit 630.

[0093] The acquisition unit 610 is used to acquire multiple first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence includes multiple semantically related first sample log data, the semantic vector of each first sample log sequence includes multiple sub-vectors, and the multiple first sample log sequences have labels representing abnormal categories.

[0094] The creation unit 620 is used to create a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different first sample log sequences, where the relationship map is used to describe the semantic relationship between the multiple first sample log sequences.

[0095] The prediction unit 630 is used to determine the second sample log sequence and the third sample log sequence from the multiple first sample log sequences, and predict the abnormal category of the third sample log sequence based on the relationship graph and the label of the second sample log sequence through a graph neural network.

[0096] The prediction unit 630 is further used to adjust the parameters of the graph neural network based on the abnormal category of the third sample log sequence and the label of the third sample log sequence.

[0097] Optionally, when determining the second sample log sequence and the third sample log sequence from the plurality of first sample log sequences, the prediction unit 630 may perform the following steps: based on the label of each first sample log sequence, counting the number of first sample log sequences included in each abnormal category; For each abnormal category, if the number of the first sample log sequences is less than or equal to a preset number threshold, the first sample log sequences included in the abnormal category are determined as the first sample log sequences of the pending abnormality; The first sample log sequence without pending exception is divided into a second sample log sequence and a third sample log sequence.

[0098] Optionally, the device 600 further includes: an encoding unit; The encoding unit is used to encode each first sample log sequence through the encoding model to obtain a semantic vector of each first sample log sequence; The encoding model is trained in the following way: Acquire a fourth sample log sequence, where the fourth sample log sequence includes a plurality of fourth sample log data; For each fourth sample log data, randomly mask the words in the fourth sample log data to obtain a fine-tuning training set; The fine-tuning training set is input into the encoding model for fine-tuning processing, and the fine-tuning processing includes: obtaining context information before and after the masked words through the encoding model, predicting the masked words based on the context information, and adjusting the parameters of the encoding model based on the predicted probability of the masked words.

[0099] Obviously, the graph neural network training device provided in the embodiment of the present application can be used as Figure 2 The execution body of the graph neural network training method shown, for example Figure 2 In the graph neural network training method shown in FIG, step S202 can be performed by Figure 6 The acquisition unit 610 in the graph neural network training device shown in FIG. 1 is executed, and step S204 can be performed by Figure 6 The creation unit 620 in the graph neural network training device shown in FIG. 1 is executed, and step S206 and step S208 can be performed by Figure 6 The prediction unit 630 in the graph neural network training device is shown.

[0100] According to another embodiment of the present application, Figure 5 or Figure 6The various units in the device shown can be combined into one or more other units separately or in whole, or one (or more) of the units can be further divided into multiple functionally smaller units, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above units are divided based on logical functions. In practical applications, the functions of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit. In other embodiments of the present application, Figure 5 or Figure 6 The device shown may also include other units. In practical applications, these functions may also be implemented with the assistance of other units, and may be implemented by collaboration of multiple units.

[0101] According to another embodiment of the present application, the program can be executed on a general computing device such as a computer including a central processing unit (CPU), a random access memory (RAM), a read-only memory (ROM), and other processing elements and storage elements. Figure 1 or Figure 2 A computer program (including program code) for each step involved in the corresponding method shown in FIG. Figure 5 or Figure 6 The device shown in the embodiment of the present application is implemented Figure 1 or Figure 2 The computer program can be recorded on a computer-readable storage medium, for example, and transferred to an electronic device through the computer-readable storage medium and run therein.

[0102] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 7 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0103] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0104] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0105] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a data processing device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: Acquire multiple log sequences and a semantic vector of each log sequence, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; Creating a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; Through a graph neural network, based on the relationship graph and the label of the first log sequence, predict the abnormal category of the second log sequence.

[0106] Alternatively, the processor executes the program stored in the memory and is specifically configured to perform the following operations: Acquire a plurality of first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence includes a plurality of semantically related first sample log data, the semantic vector of each first sample log sequence includes a plurality of sub-vectors, and the plurality of first sample log sequences have labels indicating abnormal categories; Creating a relationship map based on correlation coefficients between subvectors in semantic vectors of different first sample log sequences, where the relationship map is used to describe the semantic relationship between the multiple first sample log sequences; Determine a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predict an abnormal category of the third sample log sequence based on the relationship graph and a label of the second sample log sequence through a graph neural network; Based on the abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted.

[0107] The above application Figure 5 or Figure 6 The method performed by the device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0108] The electronic device may also perform Figure 1 or Figure 2 The method shown and implemented Figure 5 or Figure 6 The functions of the device embodiment shown will not be described in detail in the embodiments of the present application.

[0109] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0110] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including a plurality of application programs, enable the portable electronic device to execute Figure 1 The method of the embodiment shown is specifically used to perform the following operations: Acquire multiple log sequences and a semantic vector of each log sequence, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; Creating a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; Through a graph neural network, based on the relationship graph and the label of the first log sequence, predict the abnormal category of the second log sequence.

[0111] Alternatively, the portable electronic device can be caused to execute Figure 2 The method of the embodiment shown is specifically used to perform the following operations: Acquire a plurality of first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence includes a plurality of semantically related first sample log data, the semantic vector of each first sample log sequence includes a plurality of sub-vectors, and the plurality of first sample log sequences have labels indicating abnormal categories; Creating a relationship map based on correlation coefficients between subvectors in semantic vectors of different first sample log sequences, where the relationship map is used to describe the semantic relationship between the multiple first sample log sequences; Determine a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predict an abnormal category of the third sample log sequence based on the relationship graph and a label of the second sample log sequence through a graph neural network; Based on the abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted.

[0112] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0113] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0114] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0115] The present application also provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute the following Figure 1 or Figure 2 Some or all of the steps in the described method.

[0116] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0117] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A log anomaly detection method, characterized in that: include: Acquire multiple log sequences and a semantic vector of each log sequence, each log sequence includes multiple log data that are semantically related, the semantic vector of each log sequence includes multiple sub-vectors, the multiple log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; Creating a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; Through a graph neural network, based on the relationship graph and the label of the first log sequence, predict the abnormal category of the second log sequence.

2. The method according to claim 1, characterized in that The step of creating a relationship graph based on correlation coefficients between sub-vectors in semantic vectors of different log sequences includes: Creating a plurality of nodes, wherein the plurality of nodes correspond one-to-one to the plurality of log sequences; Determine the correlation coefficients between different log sequences based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences; Based on the correlation coefficients between the different log sequences, creating connection edges between the nodes corresponding to the different log sequences; Based on the created nodes and connecting edges, the relationship graph is obtained.

3. The method according to claim 2, characterized in that The multiple sub-vectors correspond to the multiple log data one by one, and the sub-vectors in the semantic vector of the same log sequence are sorted according to the generation time of the corresponding log data; The step of determining the correlation coefficients between different log sequences based on the correlation coefficients between sub-vectors in the semantic vectors of different log sequences includes: Determine a correlation coefficient between a k-th subvector in the semantic vector of the third log sequence and a k-th subvector in the semantic vector of the fourth log sequence, to obtain a k-th correlation coefficient between the third log sequence and the fourth log sequence, where k is an integer greater than or equal to 1 and less than or equal to K, K is the number of the multiple subvectors, and the third log sequence and the fourth log sequence are any two log sequences from the multiple log sequences; Based on the sum of K correlation coefficients between the third log sequence and the fourth log sequence, a correlation coefficient between the third log sequence and the fourth log sequence is determined.

4. A graph neural network training method, characterized in that: include: Acquire a plurality of first sample log sequences and a semantic vector of each first sample log sequence, each first sample log sequence includes a plurality of semantically related first sample log data, the semantic vector of each first sample log sequence includes a plurality of sub-vectors, and the plurality of first sample log sequences have labels indicating abnormal categories; Creating a relationship map based on correlation coefficients between subvectors in semantic vectors of different first sample log sequences, where the relationship map is used to describe the semantic relationship between the multiple first sample log sequences; Determine a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences, and predict an abnormal category of the third sample log sequence based on the relationship graph and a label of the second sample log sequence through a graph neural network; Based on the abnormal category of the third sample log sequence and the label of the third sample log sequence, the parameters of the graph neural network are adjusted.

5. The method according to claim 4, characterized in that The determining a second sample log sequence and a third sample log sequence from the plurality of first sample log sequences comprises: Based on the label of each first sample log sequence, count the number of first sample log sequences included in each abnormal category; For each abnormal category, if the number of the first sample log sequences is less than or equal to a preset number threshold, the first sample log sequences included in the abnormal category are determined as the first sample log sequences of the pending abnormality; The first sample log sequence without pending exception is divided into a second sample log sequence and a third sample log sequence.

6. The method according to claim 4, characterized in that The semantic vector of each first sample log sequence is obtained by encoding each first sample log sequence through a coding model; The encoding model is trained in the following way: Acquire a fourth sample log sequence, where the fourth sample log sequence includes a plurality of fourth sample log data; For each fourth sample log data, randomly mask the words in the fourth sample log data to obtain a fine-tuning training set; The fine-tuning training set is input into the encoding model for fine-tuning processing, and the fine-tuning processing includes: obtaining context information before and after the masked words through the encoding model, predicting the masked words based on the context information, and adjusting the parameters of the encoding model based on the predicted probability of the masked words.

7. A log anomaly detection device, characterized in that: include: an acquiring unit, configured to acquire a plurality of log sequences and a semantic vector of each log sequence, wherein each log sequence includes a plurality of log data that are semantically related, and the semantic vector of each log sequence includes a plurality of sub-vectors, and the plurality of log sequences include a first log sequence and a second log sequence, and the first log sequence has a label indicating an abnormal category; A creating unit, used to create a relationship map based on correlation coefficients between sub-vectors in semantic vectors of different log sequences, wherein the relationship map is used to describe the semantic relationship between the multiple log sequences; A prediction unit is used to predict an abnormal category of the second log sequence based on the relationship graph and the label of the first log sequence through a graph neural network.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement part or all of the steps in the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute part or all of the steps in the method as claimed in any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps in the method according to any one of claims 1 to 6.

Images