A time sequence and convolution combined computing power network log anomaly detection method and system

Abstract

The present application relates to a kind of time sequence and convolution combined computing power network log anomaly detection method and system.The present application utilizes hash optimization based on analytic tree log template analysis algorithm to accelerate the template classification of mass computing network log.Meanwhile, based on the space coordinate mapping of hash makes log variable can effectively construct spatial features.In addition, the method of combining time sequence network and convolution network considers both the log sequence features based on semantic information and the original sequence features of log, and also fully considers the variable space features in time sequence, so that the neural network model in the present application has higher detection accuracy and robustness.

Description

Technical Field

[0001] The present invention relates to the technical field of log anomaly detection in computing power networks, and in particular to a log anomaly detection method and system based on a time series deep learning neural network and a hash mapping-based convolutional neural network. Background Art

[0002] To support business needs and meet computing power demands, supercomputing centers, intelligent computing centers, and clusters are growing in size. These centers are characterized by large scale and numerous components, dramatically increasing the probability of system anomalies and failures. Furthermore, as computing systems grow in size, log volumes increase, and the search space for anomaly detection expands. Log processing faces challenges such as large data volumes, multiple anomaly patterns, rapid log growth, and low log processing efficiency. In computing networks in particular, system logs are even larger and more complex. Furthermore, intensive computing scheduling and data distribution generate a greater number of related logs, making effective analysis and detection difficult. This results in low anomaly detection efficiency and accuracy.

[0003] Log anomalies typically refer to phenomena where the system's operation, as reflected in the logs, deviates from normal behavior patterns. This can include instances where a specific metric exceeds its normal range, an unexpected interruption occurs during system operation, or a program timeout occurs. Alternatively, a single log entry may appear normal, but a sequence of log entries may exhibit anomalies, such as a process repeatedly attempting to call a resource. Repeated unsuccessful attempts by a process to call a resource may indicate a system deadlock or a suspended or blocked service. In recent years, several methods for detecting anomalies in system logs have been proposed for data centers, supercomputing centers, and distributed clusters. These studies typically divide the log anomaly detection process into four stages: log collection and cleaning, log template parsing, feature extraction, and log anomaly detection.

[0004] In the log collection and cleaning phase, the logs collected are based on the output of pre-written scripts or logging frameworks. This phase is used to obtain logs from the computing network, which usually include the printing time, log level, specific content, etc.

[0005] During the log template parsing phase, various template parsing algorithms are available, including those based on code analysis, machine learning, and classical algorithms. These template parsing algorithms are both online and offline. Code analysis-based algorithms suffer from drawbacks such as difficulty obtaining source code and complex operations. Deep learning algorithms, on the other hand, require training phases, requiring model retraining as the number of code templates increases. Without retraining, generalization performance is poor. This can significantly reduce accuracy for later log migration scenarios. Therefore, the current mainstream parsing algorithms are based on classical algorithms, including the longest common subsequence (LCS) and parse tree algorithms. However, with increasing business demands for faster log parsing, these classical algorithms also have limitations. For example, the parse tree algorithm involves processes such as node classification and log similarity calculation. The LCS algorithm also involves calculating the length of the longest common subsequence between logs, which involves a significant amount of repeated computation and consumes a significant amount of time. Therefore, insufficient parsing speed has become a major constraint.

[0006] When detecting anomalies in logs, there are traditional machine learning algorithms, such as clustering and principal component analysis (PCA), as well as neural network-based deep learning algorithms, such as recurrent neural network-based long short-term memory artificial neural networks (LSTMs), graph neural networks (GNNs), generative adversarial neural networks (GANs), and convolutional neural networks (CNNs). Traditional machine learning solutions, such as clustering and principal component analysis, have difficulty handling noise and outliers, and clustering algorithms are sensitive to both. Principal component analysis assumes a linearly separable data structure and a direct proportional relationship between variables in the logs. However, in actual computing network logs, the relationships between logs are more complex, making PCA unable to capture these complex anomalies. Consequently, traditional machine learning algorithms suffer from low prediction and classification accuracy and coarse granularity. When it comes to using neural networks for anomaly detection, they can fully learn the relationships between features. However, this also depends on feature selection, and different network models have different strengths and characteristics. For example, the Recurrent Neural Network (RNN) focuses on understanding temporal features; CNNs and GNNs focus more on learning features in the spatial dimension; and GANs emphasize the model's generalization and robustness. Most existing research uses only one of these network models, failing to fully exploit the feature information in logs. This results in low detection accuracy and instability. Therefore, improving the robustness and accuracy of detection models is a key challenge in computing network log anomaly detection.

[0007] In summary, the current technical bottlenecks for anomaly detection in computing network logs are mainly concentrated in the log template parsing stage and the anomaly detection stage. The main bottlenecks in the template parsing stage are insufficient parsing speed and low parsing accuracy. This is because most parsing algorithms involve log preprocessing and similarity calculation, which are often accompanied by a large number of repeated comparisons and calculations. The main bottlenecks in the anomaly detection stage are the one-sidedness of learned features and the difficulty in using variables in the logs for effective predictions. This is usually caused by the difficulty in constructing effective feature inputs and the inability to coordinate multiple models. Summary of the Invention

[0008] The objective of the present invention is to realize a system log anomaly detection method and system under a computing power network that combines a temporal neural network and a convolutional neural network. The innovative part includes forming a dual-path model with a temporal neural network and a convolutional neural network, which includes a temporal branch and a spatial convolution branch to fully extract feature information; hash optimization of the fixed-layer template parsing tree to accelerate the template classification process of the structured log; using hash coordinate mapping, the structured placeholders of the structured log within a time window are converted into a two-dimensional matrix, and the spatial features under the temporal sequence are constructed to achieve convolution, so that the neural network part can fully learn the temporal information and spatial information of the log, improve the stability and accuracy of anomaly detection, and solve the shortcomings of slow log template parsing speed and low anomaly detection accuracy.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is:

[0010] In a first aspect, the present invention provides a method for detecting anomalies in computing network logs by combining time series and convolution. The method comprises the following steps:

[0011] Step 1: Use regular expressions to separate variables and structured information in the computing power network system logs, replace the variable positions in the computing power network system logs with structured placeholders to obtain structured logs, and determine the time window and stride to obtain a log sequence;

[0012] Step 2: The structured logs are quickly classified into log templates using a hash-optimized fixed-layer parse tree. All structured logs are mapped to corresponding log templates, and the log templates are labeled with corresponding serial numbers to form log template numbers. Sequence features are generated using the log template numbers. Semantic features are generated from the structured logs using the AL-Bert model.

[0013] Step 3: Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization, and a two-dimensional variable matrix on the time series is constructed to obtain spatial features;

[0014] Step 4: Using the sequence features, semantic features, and spatial features as input, a two-way model is used for prediction. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network. The two branches are parallel structures. The output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0015] In a second aspect, the present invention provides a computing power network log anomaly detection system that combines time series and convolution, including:

[0016] The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log using regular expressions, replace the variable positions in the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain the log sequence;

[0017] The template parsing module is used to quickly classify the structured logs into log templates using a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features based on the log template numbers; and generate semantic features from the structured logs using the AL-Bert model;

[0018] The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and construct a two-dimensional variable matrix on the time series to obtain spatial features;

[0019] The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as input and perform prediction using a two-way model. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long-short-term memory models; the spatial convolution branch includes a convolutional neural network. The two branches are parallel structures. The output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0020] The beneficial effects of the present invention are:

[0021] 1. Speed ​​up log template parsing through hash optimization:

[0022] Currently, there's a pain point with slow log template parsing. The computing power network system logs that need to be inspected can reach millions or even tens of millions, but there are only a few hundred types of log templates. This means that most logs are ultimately classified into existing templates after layers of classification, wasting a significant amount of time on layer-by-layer selection and traversal. Therefore, a hash map (cache) is used to first query whether the log template to which the computing power network system (original) log to be classified belongs already exists. If so, the log template of the structured log is directly recorded as the corresponding log template number in H. If not, the structured log enters a fixed-number parsing tree and continues to build until the corresponding log template number is generated. This significantly speeds up log template classification.

[0023] 2. The hash-based log-structured placeholder coordinate mapping method can effectively utilize the variables of the log (original):

[0024] Usually, the variables in the original log have rich feature information, but previous technologies have not been able to make good use of this part of the variable information. The present invention constructs a spatial feature matrix M on the time series scale based on the time window. Its implementation principle is to map the structured placeholders in space, so that the structured placeholders can be better mapped to the corresponding positions in the matrix. The advantage of this is that adjacent structured placeholders can be avoided from being overlapped when mapped into M.

[0025] 3. The dual-path neural network model integrating time series and convolution can better capture the temporal and spatial information of logs:

[0026] Previous technologies often focused only on local feature information, such as time series, statistical features, and semantic information. This invention fully considers semantic and time series information through time series branches, resulting in a tensor output after time series branch predictions. Simultaneously, the powerful feature extraction capabilities of convolutional neural networks fully extract the feature information contained in structured placeholders in structured logs. The entire model fully mines logs from three dimensions: semantic, time series, and spatial features. This addresses the problem of a single feature failing to accurately detect anomalies, making the model's anomaly detection more accurate and stable. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is the overall architecture diagram of the system log anomaly detection system under the computing power network of an embodiment of the present application.

[0028] Figure 2 This is a flow chart of the log template parsing method based on hash-optimized parse tree.

[0029] Figure 3 This is a schematic diagram of the hash-based log variable coordinate mapping method. DETAILED DESCRIPTION

[0030] The present invention will be further described below with reference to the accompanying drawings. The following examples are only used to more clearly illustrate the technical solution of the present invention and are not intended to limit the scope of protection of the present invention.

[0031] like Figure 1 As shown, the embodiment of the present application provides a computing power network log anomaly detection method combining time series and convolution, including the following steps:

[0032] S1. Computing network log preprocessing stage: Use regular expressions to separate variables and structured information in the computing network system log. Replace the variable positions in the computing network system log with structured placeholders to obtain structured logs. Then determine the time window and stride to obtain a log sequence.

[0033] In one example of this application, the computing network log preprocessing stage includes:

[0034] S11. Usually, the logs of the computing network will involve time, message level, and strings describing the system operation status. They will also involve variables such as numbers, IP addresses, port numbers, and task time intervals.

[0035] First, the collected computing network logs are regularized. The variable parts are hashed using a hash function, assigning the same regular expression number (starting at 1 and increasing in number). The structured parts of the original logs are also separated and replaced with regular expression numbers, marking them as structured placeholders. For example, the regular expression number of a number is mapped to 1, the regular expression number of an IP address is mapped to 2, and so on.

[0036] S12. Set a time window of length W and a moving step of S. All structured logs within a time window are called a log sequence L. seq , the length of the log sequence is W.

[0037] S2, Template parsing stage: Structured logs are quickly classified into log templates through a hash-optimized fixed-layer parsing tree. All structured logs are mapped to corresponding log templates, and the log templates are labeled with corresponding serial numbers to form log template numbers. Sequence features are generated through the log template numbers; semantic features are generated from structured logs through the AL-Bert model.

[0038] In one example of this application, the template parsing phase includes:

[0039] S21. First, a hash table H is preset that can dynamically parse and record whether the log template has been parsed, where H is presented in the form of key-value pairs. Before the structured log enters the fixed-level parsing tree construction, a query is first performed on the hash table H: H is asked whether the structured log has been mapped. If it has been mapped, the log template of the structured log is directly recorded as the corresponding log template number in H; the log template corresponding to the structured log is the key in H, marked as L, and the value is the log template number, marked as L num The initial value of the value is null. If it has not been mapped, the structured log of the computing network log preprocessing stage is taken and entered into the fixed-layer parsing tree optimized by hashing. Figure 2 .

[0040] Furthermore, the number of layers of the parse tree is preset to D layers, and the first layer is used to initially classify the length of the structured log, and classify structured logs of different lengths into different branches. In the second layer to the D-1 layer, the structured logs are classified into different branches based on the complete match of the string (separated by spaces). For example, if the length of the structured log "Received blockreplica with id 1from unexpected source:2" is 10, it is divided into a branch of length 10 in the first layer, into the "Received" branch in the second layer, and into the "block" branch in the third layer, and so on. Until the leaf node corresponding to the last layer of the log parse tree is matched.

[0041] Match the structured log with each log template in the log template set of the leaf node through the log similarity function T, and take the log template with the highest similarity from the set U of all log templates whose similarity exceeds the preset threshold Z as Template max , and the structured log L num Mark as Template max The corresponding log template number. If The structured log itself is recorded as a new log template in the leaf node, its log template number is recorded, and H is updated.

[0042] In the above process, when the hash table H is directly hit, the time complexity is the complexity of querying H O(1); if there is no hit, the execution process is to first access H, and then access the parse tree being built. It is necessary to traverse the leaf nodes of the parse tree and calculate the similarity, that is, first traverse from the first layer to the leaf node, the traversal path length is D, and then assume that each leaf node has an average of k log templates, the average length of each log template is p, and the length of the structured log used for template parsing is q, so the average time complexity is O(D+k*max(len(p),len(q))), where the formula for calculating the similarity function is:

[0043]

[0044] Where T represents the similarity between the structured log that needs template parsing and the log template, T∈[0,1], Sim is a similarity function, which is specifically described as 1 if the values ​​at corresponding positions are equal, otherwise it is 0, and len is a function that calculates the number of structured log strings.

[0045] In practice, the number of original logs is far greater than the number of templates. This indicates that in actual computing network logs, the regularized structured logs belong to the same template. For these structured logs, the time complexity of finding log templates based on the hash optimization strategy is reduced from O(D+k*max(len(p),len(q))) to O(1). This shows that this method can significantly improve the time efficiency of log template classification.

[0046] S22, L seq As input, we first use the language model AL-Bert to embed each string in the structured log. Then, we add up all the embedded strings of the same log and divide it by the number of strings in the structured log to obtain a fixed-length one-dimensional tensor D1, where D1 = {v0, v1, ..., v n-2 ,v n-1}, n is the length of the tensor; then according to the continuous W value set in the first stage, take an L seq After the above operations, the W structured logs in the matrix form a two-dimensional tensor matrix, which is represented by V Sem , V Sem ={D 1(0) ,D 1(1) ,…,D 1(W-2) ,D 1(W-1)} represents the semantic features of a certain time window.

[0047] At the same time, the log template sequence number in the same time window is taken to construct the sequence feature V Seq , specifically, L seqEach structured log is replaced by the corresponding log template number L num , where V Seq ={d0,d1,…,d W-2 ,d W-1}, W is the length of the sliding window, d is the log template number, that is, the log template number L to which each structured log belongs num The above operation is repeated for each time window. So far, all semantic features and sequence features have been obtained.

[0048] S3, Log two-dimensional variable matrix construction phase: Based on the hash function, the structured placeholder part of the variables of the computing power network (original) log after regularization is mapped to coordinates, and a two-dimensional variable matrix on the time series is constructed to obtain spatial features, see Figure 3 .

[0049] In one example of the present application, the log two-dimensional variable matrix construction phase includes:

[0050] S31. Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization processing, and a two-dimensional variable matrix M on the time series is constructed.

[0051] When processing the k-th time window: first, obtain all the structured placeholder information of the structured log corresponding to the k-th time window in the preprocessing stage, and then obtain the position of each structured placeholder x. For a structured placeholder x, its position information is recorded as a two-tuple E = [i, J(j)], where i represents the i-th log in the window, and its row in M ​​is consistent with the position of the structured log in W; j represents the j-th structured placeholder in the sentence, and J(j) indicates the column of the two-dimensional variable matrix to which the structured placeholder belongs.

[0052] The value range of J(j) is set to an upper limit C to prevent individual structured logs from being too long and causing a lot of space waste. The expression of J is:

[0053]

[0054] j is the jth structured placeholder in the original log. Mapping it to the column position of the two-dimensional variable matrix M is to first round j down. If there is a remainder after taking the value modulo 2, move it back one column. This approach has the advantage of preventing overlapping structured placeholders when adjacent structured placeholders are mapped into M.

[0055] S32. Get the value of the structured placeholder (regular number 1), specifically expressed as:

[0056] Hash(x)=l

[0057] Where Hash(x) = l represents the hash function used to generate the regular number (completed in S11). The mapped number is l. That is, the value l is the value of the structured placeholder and needs to be mapped to the corresponding position in the two-dimensional variable matrix in the subsequent steps. x represents the variable in the original log. So far, a single structured placeholder is represented as a tuple G kq =[E,l], where E=[i,J(j)], indicating that the qth structured placeholder value of the kth window is l, and is located in the i-th row and the J(j)-th column of the k-th two-dimensional variable matrix.

[0058] At the same time, a structured log is represented as a one-dimensional tensor D2 = {g0, g1, ..., g C-2 ,g C-1}, C is the maximum length of the set two-dimensional variable matrix column, that is, no matter whether the J of the structured placeholder in the structured log is less than or equal to C or greater than C, its length is C. If the mapped column subscript J is less than or equal to C, it is directly mapped; otherwise, it is directly discarded.

[0059] For each g i If the corresponding subscript is mapped by a structured placeholder in the mapping phase, then the g i The value of is the value of the structured placeholder l, otherwise it is 0. Take W consecutive structured logs, then all the structured placeholder information of a time window is abstracted into a two-dimensional variable matrix, which is represented as V Space (M matrix), V Space ={D 2(0) ,D 2(1) ,…,D 2(W-2) ,D 2(W-1) Perform the above operations (S31, S32) on all time windows to obtain all two-dimensional variable matrices.

[0060] S4. Log anomaly detection stage: Using sequence features, semantic features, and spatial features as input, the dual-path model designed by this method is used for prediction. The dual-path model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch contains two bidirectional long-short-term memory models; the spatial convolution branch contains a convolutional neural network. The two branches are parallel structures. The output tensor is judged to be abnormal through steps such as splicing, attention mechanism, changing tensor dimension, and regression prediction.

[0061] This application extracts three features in S2 and S3: time series feature V Seq , semantic feature V Sem And the spatial feature V in time series Space Next, we enter the log anomaly detection stage based on machine learning and deep learning.

[0062] In one example of this application, the log anomaly detection stage includes:

[0063] S41, take a single time window W as an input, and take the semantic features V of the template parsing stage Sem and the timing characteristics V Seq , are respectively used as inputs for training and prediction through a bidirectional long short-term artificial memory model (Bi-LSTM) model. Although the semantic feature V Sem It also contains certain temporal features, but due to the semantic processing of AL-Bert, the feature dimension increases, which may cause the original temporal features to be interfered with. Therefore, for a single temporal feature V Seq The output tensors F1 and F2 of the two networks are horizontally spliced ​​to obtain the tensor V a .

[0064] S42. Take the spatial characteristics V of the variables in the time series during the two-dimensional variable matrix construction phase. Space (i.e., a two-dimensional variable matrix M), convolution is performed through an n*n* convolution kernel to extract the spatial information in the matrix. To further reduce the sparsity of the matrix, the maximum value of each pooling window is retained through the maximum pooling layer to retain useful feature information. Since there may be values ​​less than 0 in the matrix, in order to prevent the problem of neuron death, the output tensor V is obtained after changing its shape through the fully connected layer and then through the Leaky_Relu activation function. b .

[0065] S43, tensor V a and V b Horizontal splicing to obtain the result tensor V ab , the tensor contains the abstract features of semantic information, temporal information and variable space information, and then passes through the attention layer Att to increase the weight of the more valuable part and reduce the weight of the irrelevant part. The output is recorded as V att ; Finally, a fully connected layer is used to change the shape of the tensor and reduce the feature dimension to obtain the output tensor V res The output tensor is then fed into the random forest regression test to determine whether the log sequence is abnormal by voting with the decision tree. The classification output of each decision tree is either 1 or 0, where 0 is a vote for normality and 1 is a vote for abnormality. This application sets the number of decision trees in the random forest to T. N , after all decision trees vote, the number of decision trees that cast abnormal votes is TA, when TA / T N When ≥0.5, the log sequence is considered abnormal, otherwise it is normal.

[0066]

[0067]

[0068] In the above formula, TA is the number of abnormal voting results of all decision trees, and function f t Voting result for the t-th decision tree.

[0069] After all the original computing power network logs are processed through steps S1, S2, and S3, the above S4 operation is performed to obtain the final anomaly detection results, and an alarm is issued for the logs with detected anomalies.

[0070] The present application also provides a computing power network log anomaly detection system that combines time series and convolution, including:

[0071] The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log using regular expressions, replace the variable positions in the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain the log sequence;

[0072] The template parsing module is used to quickly classify the structured logs into log templates using a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features based on the log template numbers; and generate semantic features from the structured logs using the AL-Bert model;

[0073] The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and construct a two-dimensional variable matrix on the time series to obtain spatial features;

[0074] The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as input and perform prediction using a two-way model. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long-short-term memory models; the spatial convolution branch includes a convolutional neural network. The two branches are parallel structures. The output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction.

[0075] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A computing network log anomaly detection method combining time series and convolution, characterized by The method comprises the following steps: Step 1: Use regular expressions to separate variables and structured information in the computing power network system logs, replace the variable positions in the computing power network system logs with structured placeholders to obtain structured logs, and determine the time window and stride to obtain a log sequence; Step 2: The structured logs are quickly classified into log templates using a hash-optimized fixed-layer parse tree. All structured logs are mapped to corresponding log templates, and the log templates are labeled with corresponding serial numbers to form log template numbers. Sequence features are generated using the log template numbers. Semantic features are generated from the structured logs using the AL-Bert model. Step 3: Based on the hash function, coordinate mapping is performed on the structured placeholder part of the structured log variables after regularization, and a two-dimensional variable matrix on the time series is constructed to obtain spatial features; Step 4: Using the sequence features, semantic features, and spatial features as input, a two-way model is used for prediction. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long short-term memory models; the spatial convolution branch includes a convolutional neural network. The two branches are parallel structures. The output vector is judged to be abnormal through splicing, attention mechanism, changing vector dimension, and regression prediction. Among them, step 3 is specifically: Take the structured placeholder mapped by the hash function in step 1, and determine the position mapped to the two-dimensional variable matrix based on the position of the structured log where the structured placeholder is located within a time window and the position of the structured log where the structured placeholder is located; The rows of the structured placeholders in the two-dimensional variable matrix are consistent with the positions of the structured logs in the time window, and the columns in the two-dimensional variable matrix are mapped to the corresponding positions of the two-dimensional variable matrix as , the mapping rules are: Represents the first A structured placeholder; Among them, step 4 is specifically: The semantic features and sequence features obtained in step 3 are respectively passed through the bidirectional long short-term memory model 、 Make predictions and get the output tensor and , and the output tensor and Horizontally splice in sequence to generate the output vector ; The spatial features obtained in step 3 are input into the convolutional neural network, and convolution calculation is performed to extract spatial information. The maximum value of each pooling window is retained through the preset pooling layer to reduce the dimension of the feature map and reduce the sparsity of the two-dimensional variable matrix. The output shape is then changed through the fully connected layer to become a one-dimensional vector, and then delinearized through the activation function to improve the expression ability of the neural network to the model. The output vector is recorded as ; The output vector and The vector is obtained by horizontal splicing , the vector The attention layer enables the two-way model to focus on the key parts of the input data, and the output tensor is recorded as ; Change the shape of the tensor through the fully connected layer to reduce the feature dimension to obtain the output vector Finally, the output vector Input into the random forest regression model to determine whether the log series is abnormal.

2. The method for detecting anomalies in computing network logs by combining time series and convolution according to claim 1 is characterized by: In step 1, use a hash function to assign the same regular expression number to the variables separated by the same regular expression, and replace the variable position in the computing power network system log with the corresponding regular expression number. The replaced value is recorded as a structured placeholder, and the log after this operation is recorded as a structured log.

3. The method for detecting anomalies in computing network logs by combining time series and convolution according to claim 1 is characterized by: Step 2 specifically is: Set a hash table for dynamically recording whether a log template has been parsed. The hash table is presented in the form of key-value pairs, where the key is the log template and the value is the log template number; Before a structured log enters the fixed-level parse tree, the hash table is queried to determine whether the log template corresponding to the structured log has been mapped. If it has been mapped, the log template of the structured log is directly recorded as the corresponding log template number in the hash table. If no mapping has been done, the structured log from the computing network log preprocessing phase is taken and entered into a fixed-layer parse tree optimized by hashing until a leaf node corresponding to the last layer of the log parse tree is matched; Each structured log in the log sequence is replaced with the corresponding log template number, and the replaced vector forms the sequence feature.

4. The method for detecting anomalies in computing network logs by combining time series and convolution according to claim 3 is characterized by: The parse tree has a total of D layers; among them: The first layer is used to initially classify the length of structured logs and classify structured logs of different lengths into different branches. The second to the In the layer, structured logs are classified into different branches based on the exact match of the string.

5. The method for detecting anomalies in computing network logs by combining time series and convolution according to claim 4 is characterized by: Match the structured log and each log template in the log template set of the leaf node through the log similarity function, and take the log template with the highest similarity from all the log template sets whose similarities exceed the preset threshold as , and mark the log template number of the structured log as The corresponding log template number; if the set is an empty set, the structured log itself is recorded as a new log template in the leaf node, its log template number is recorded, and the hash table is updated.

6. The method for detecting anomalies in computing network logs by combining time series and convolution according to claim 1 is characterized by: The semantic feature generation described in step 2 is specifically as follows: Take the log sequence as input and embed each string in the structured log using the language representation model AL-Bert based on the encoder structure; Add up the strings after embedding all words in the same log and divide by the number of strings in the structured log to obtain a vector of fixed length; The tensor obtained after the above operation on several consecutive structured logs is taken as the semantic feature.

7. A computing network log anomaly detection system combining time series and convolution, characterized by: include: The computing power network log preprocessing module is used to separate the variables and structured information in the computing power network system log using regular expressions, replace the variable positions in the computing power network system log with structured placeholders to obtain structured logs, and determine the time window and stride to obtain the log sequence; The template parsing module is used to quickly classify the structured logs into log templates through a hash-optimized fixed-layer parsing tree, map all structured logs into corresponding log templates, and label the log templates with corresponding serial numbers to form log template numbers, and generate sequence features based on the log template numbers; Generate semantic features from structured logs through the AL-Bert model; The log two-dimensional variable matrix construction module is used to perform coordinate mapping on the structured placeholder part of the structured log variables after regularization based on the hash function, and construct a two-dimensional variable matrix on the time series to obtain spatial features; The log anomaly detection module is used to use the sequence features, semantic features, and spatial features as inputs and perform predictions using a two-way model. The two-way model specifically includes two branches: a time series branch and a spatial convolution branch. The time series branch includes two bidirectional long-short-term memory models; the spatial convolution branch includes a convolutional neural network. The two branches are parallel structures. The output vector is concatenated, an attention mechanism is used, the vector dimension is changed, and regression prediction is performed to determine whether it is abnormal. The log two-dimensional variable matrix construction module specifically performs: Take the structured placeholder mapped by the hash function, and determine the position mapped to the two-dimensional variable matrix according to the position of the structured log where the structured placeholder is located in a time window and the position of the structured log where the structured placeholder is located; The rows of the structured placeholders in the two-dimensional variable matrix are consistent with the positions of the structured logs in the time window, and the columns in the two-dimensional variable matrix are mapped to the corresponding positions of the two-dimensional variable matrix as , the mapping rules are: Represents the first A structured placeholder; The log anomaly detection module specifically performs: The semantic features and sequence features obtained by the log two-dimensional variable matrix building module are respectively passed through the bidirectional long short-term memory model 、 Make predictions and get the output tensor and , and the output tensor and Horizontally splice in sequence to generate the output vector ; The spatial features obtained by the log two-dimensional variable matrix construction module are input into the convolutional neural network, and the convolution calculation is performed to extract the spatial information. The maximum value of each pooling window is retained through the preset pooling layer to reduce the dimension of the feature map and reduce the sparsity of the two-dimensional variable matrix. The output shape is then changed through the fully connected layer to make it a one-dimensional vector. Then, the activation function is used to delinearize it to improve the expression ability of the neural network to the model. The output vector is recorded as ; The output vector and The vector is obtained by horizontal splicing , the vector The attention layer enables the two-way model to focus on the key parts of the input data, and the output tensor is recorded as ; Change the shape of the tensor through the fully connected layer to reduce the feature dimension to obtain the output vector Finally, the output vector Input into the random forest regression model to determine whether the log series is abnormal.

Images