Electric power communication network log abnormal information detection method based on incremental learning

Abstract

The invention discloses a power communication network log abnormal information detection method based on incremental learning. The method comprises the following steps: preprocessing original data; performing feature extraction on the preprocessed data; inputting the extracted feature data into the constructed incremental learning model, and updating the model; and outputting an abnormal information detection result of the electric power communication weblog by using the updated incremental learning model. According to the method, the model can gradually adapt to continuously generated new data through an incremental learning strategy, the performance of a previous task cannot be obviously reduced, the problem of disastrous forgetting in the process of processing the complexity and the real-time performance in an existing method is solved, the accuracy of detecting the abnormal information of the electric power communication weblog is improved, and the method is suitable for popularization and application. Therefore, the stability of the overall performance is kept.

Description

Technical Field

[0001] The present invention belongs to the field of electric power communication, and relates to abnormal information detection in electric power communication network logs, and specifically to an abnormal information detection method in electric power communication network logs based on incremental learning. Background Art

[0002] With the construction of a new type of power system oriented to "source, grid, load and storage", the scale and complexity of the power grid continues to expand. As one of the three pillars of safe and stable operation of the power system, the power communication network also shows an explosive growth trend. In this context, efficient risk analysis methods for power communication networks have become the core issue to ensure the stable operation of the network. The risk analysis of power communication networks is closely related to network operation logs. Log data has the advantages of popularity, accuracy and continuity. It is easy to obtain and continuously generated while accurately describing the information of the power communication network. However, how to accurately extract and analyze abnormal information from massive operation, maintenance, defect and resource logs, and mine potential patterns and information that are not obvious, has become the key to risk analysis.

[0003] Traditional log anomaly detection methods are based on machine learning and deep learning algorithms. Traditional machine learning algorithms are usually performed on explicitly provided features. Liang et al. designed five sets of features to describe the number and distribution of events in a time window, and then used multiple classifiers for anomaly detection. Experimental results show that the customized nearest neighbor classifier (KNN) performs much better than the support vector machine (SVM). Liu et al. proposed LogCluster to cluster log sequences and calculate the cluster centroid as a representative sequence to help developers quickly identify potential problems. Deep learning methods can automatically learn the feature representation of data without manually designing feature engineering. Yang et al. estimated the probability of unlabeled data based on the clustering results, giving full play to the superiority of supervised methods. In order to reduce the long dependency problem that damages the effectiveness of anomaly detection, an attention-based gated recurrent unit (GRU) is used for anomaly detection. OC4Seq proposed by Wang et al. is a multi-scale single-class recurrent neural network for detecting anomalies in discrete event sequences. A multi-scale RNN framework is designed to capture sequence anomalies at different levels.

[0004] However, the core challenge faced by these methods is the catastrophic forgetting problem when dealing with the huge amount of log data in the power communication network, which is diverse in type and dynamically evolving over time. Specifically, it is difficult for traditional models to effectively adapt to the highly dynamic and real-time characteristics of log data. As new data is continuously generated, the performance of the model for previously learned tasks will drop sharply as it gradually learns new tasks, resulting in a significant decrease in the overall performance of the model. In addition, due to the limited running memory and the possible complex interweaving and overlap between task categories, how to efficiently utilize and deeply analyze the log data of the power communication network poses another major challenge. Summary of the invention

[0005] Purpose of the invention: In order to overcome the deficiencies in the prior art, a method for detecting abnormal information in power communication network logs based on incremental learning is provided. By continuously learning new data to optimize the model, the utilization rate of log data in the power communication network and the real-time performance of abnormality detection are improved.

[0006] Technical solution: To achieve the above purpose, the present invention provides a method for detecting abnormal information in a power communication network log based on incremental learning, comprising the following steps:

[0007] S1: Preprocess the raw data;

[0008] S2: extract features from the preprocessed data;

[0009] S3: Input the extracted feature data into the constructed incremental learning model to update the model;

[0010] S4: Use the updated incremental learning model to output the abnormal information detection results of the power communication network log.

[0011] Furthermore, the pre-processing method in step S1 includes:

[0012] Power grid log data often contains noise, duplicate or missing values, and because developers can write free-text log messages in source code, raw log messages are usually unstructured. Subsequent deep learning models require structured data input (such as event lists or matrices) for feature extraction. Therefore, the first step in log analysis is log parsing, which converts unstructured log messages into structured events. An unstructured log message usually contains various forms of system runtime information: timestamp (recording the time when the event occurred), detail level (indicating the severity level of the event, such as INFO), and original message content (free text description of service operations).

[0013] Therefore, the present invention adopts an online log parsing method Drain based on a fixed-depth tree to implement log parsing. When a new original log message arrives, Drain will pre-process it through a simple regular expression based on domain knowledge, and then search for log groups, i.e., leaf nodes of the tree, according to the encoding, in specific rules in the internal nodes of the tree. If a suitable log group is found, the log message will be matched with the log events stored in the log group. Otherwise, a new log group will be created based on the log message.

[0014] Furthermore, the feature extraction method in step S2 is:

[0015] In order to meet the structured input of the model and improve the efficiency and accuracy of the model, it is necessary to extract key features. The features in the power grid log may include timestamp, device type, operation type, device status code, etc.

[0016] The present invention uses a pre-trained language model Bert to learn the initial log sequence semantic vector. The Bert model has multiple transformer encoders, each of which has a multi-head attention layer and a feedforward network layer (FFN) that applies a self-attention mechanism, and adopts a residual network and normalization operation. Finally, by calculating the IDF weight, the occurrence frequency of each log sequence is integrated with its initial log sequence semantic vector to form the final log sequence semantic expression.

[0017] Furthermore, the method for constructing the incremental learning model in step S3 is:

[0018] Dark experience replay DER is used to participate in the construction of the incremental learning model. DER uses cross entropy loss for supervised training of new task samples and distillation loss for example samples. Due to the advantages of DER such as simplicity and efficiency, no need for task boundaries and no reliance on data task identification, it can adapt to many strict incremental learning settings, such as task incremental learning, class incremental learning, domain incremental learning, online incremental learning, etc.

[0019] Furthermore, the incremental update task of dark experience playback in step S3 is regarded as T ordered classification tasks, and the input sample x and its true label y are obtained from the distribution D in each task t∈{1,…,T} t The classifier f is updated on each task in chronological order with θ as parameter; the goal is to correctly classify the task t in a given task. c When t∈{1,…,t c}Sequence sample data:

[0020]

[0021] h θ(x) represents the original score of the category output by the model, Represents the probability distribution of the category; since this task is challenging in terms of time and space complexity, the data of the previous task is assumed to be unavailable; therefore, it is necessary to find parameters suitable for the current task, while the parameters trained in the old task must also be effectively retained, so the network needs to imitate its original response to past samples; in order to retain knowledge about previous tasks, the following objectives are sought to be minimized:

[0022]

[0023] Among them, α is a hyperparameter that balances the losses. is the optimal parameter set at the end of task t; by using the Kmeans clustering method to extract samples as experience, it can provide support for the learning of subsequent tasks; in the training set of example samples In the example, the original scores of the categories corresponding to the samples are retained. These scores provide informative descriptions about the data points;

[0024]

[0025] Under mild assumptions, the optimization of KL divergence in equation (3) is equivalent to minimizing the Euclidean distance between the corresponding type raw score and the predicted category score; the optimization objective during model update is finally transformed into:

[0026]

[0027] Furthermore, it should be noted in step S3 that sudden distribution changes may occur in the input stream, which may cause the example samples to be affected by samples that are highly biased in the previous task when they are replayed. DER++ better copes with distribution changes by adding an additional term to the objective function to improve the conditional likelihood of buffer data points relative to their true labels;

[0028]

[0029] DER++ introduces an additional coefficient β to balance the last term in the objective function; DER++ optimizes the objective function to promote the model to reach a flatter minimum. This flat minimum helps the model explore neighboring areas in the parameter space, improves the model's tolerance to local perturbations, and reduces the forgetting of knowledge.

[0030] Furthermore, the model updating method in step S3 is:

[0031] The model is updated in small batches when new data is received; based on the data mobility and burstiness of the power grid log, the update is set to be performed at fixed intervals;

[0032] Apply small batch updates to aggregate data within a certain period of time into a small batch for update, avoiding the computational overhead caused by frequent updates:

[0033]

[0034] Furthermore, in step S3, a knowledge retention and forgetting mechanism is introduced in the model update, specifically:

[0035] The sliding window mechanism sets a fixed-size time window, and the model is updated only on the data within the window; data outside the window is gradually forgotten:

[0036]

[0037] Another importance weighting mechanism assigns different weights to the data based on its importance or confidence. Newer data can be given higher weights while still retaining some of the influence of older data:

[0038]

[0039] Weight α i Defined as:

[0040] α i =exp(-λ(ti)) (9)

[0041] Furthermore, in the incremental learning model of step S4, the log sequence is modeled by the Mogrifier LSTM-based model, and then input into the CNN-based feature fusion layer, and finally the softmax function is used to output the predicted label; the incremental model is a classifier, and it can judge whether the log is abnormal according to the classification result output by the model. Since the focus of the work is on the log sequence anomaly, not a single anomaly.

[0042] In the anomaly detection task of power grid logs, a loss function based on cross entropy is designed; assuming that the goal is to predict the category yt of the log xt, the probability of the model output is y^t; the cross entropy loss function is:

[0043]

[0044] Furthermore, a feedback mechanism is introduced into the incremental learning model of step S4, and the detected abnormal events are sent to manual review by designing an automatic feedback loop, and the model is adjusted according to the review results. After the system detects the abnormal log, it submits it to the manual review team. If it is confirmed to be an abnormal log, the system uses the feedback result as new training data for model optimization; the model dynamically adjusts its parameters according to the accuracy of the feedback to improve the sensitivity to specific types of abnormalities.

[0045] Beneficial effects: Compared with the prior art, the present invention uses an incremental learning strategy to enable the model to gradually adapt to the continuously generated new data without causing a significant decline in the performance of previous tasks. This solves the catastrophic forgetting problem faced by existing methods when dealing with such complexity and real-time performance, and improves the accuracy of detecting abnormal information in the power communication network log, thereby maintaining the stability of the overall performance. In addition, the present invention designs a memory optimization strategy so that the model can effectively manage the complex interweaving and overlapping relationships between task categories under limited memory resources. This solution not only enhances the model's ability to deeply analyze the log data of the power communication network, but also significantly improves the detection efficiency and realizes real-time response to changes in network status. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a log parsing diagram;

[0047] Figure 2 This is the structure diagram of Drain log analysis;

[0048] Figure 3 This is the schematic diagram of the dark experience replay model;

[0049] Figure 4 To incrementally update the evaluation index change graph;

[0050] Figure 5 This is a comparison chart of the accuracy of incremental update and full update;

[0051] Figure 6 This is a comparison chart of the recall rates of incremental updates and full updates;

[0052] Figure 7 This is a comparison chart of the F1 scores of incremental updates and full updates. DETAILED DESCRIPTION

[0053] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent forms of modifications to the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0054] The present invention provides a method for detecting abnormal information in a power communication network log based on incremental learning, comprising the following steps:

[0055] S1: Preprocess the raw data;

[0056] Power grid log data often contains noise, duplicate or missing values, and because developers can write free text log messages in the source code, the original log messages are usually unstructured. Subsequent deep learning models require structured data input (such as event lists or matrices) for feature extraction. Therefore, the first step in log analysis is log parsing, which converts unstructured log messages into structured events. Figure 1 An unstructured log message typically contains various forms of system runtime information: a timestamp (recording the time when the event occurred), a detail level (indicating the severity level of the event, such as INFO), and raw message content (a free text description of the service operation).

[0057] Therefore, the present invention adopts an online log parsing method Drain based on a fixed-depth tree to implement log parsing. When a new original log message arrives, Drain pre-processes it through a simple regular expression based on domain knowledge, and then searches for log groups, i.e., leaf nodes of the tree, according to the encoding, in specific rules in the internal nodes of the tree. If a suitable log group is found, the log message is matched with the log events stored in the log group. Otherwise, a new log group is created based on the log message, as shown in the following example. Figure 2 shown.

[0058] S2: extract features from the preprocessed data;

[0059] In order to meet the structured input of the model and improve the efficiency and accuracy of the model, it is necessary to extract key features. The features in the power grid log may include timestamp, device type, operation type, device status code, etc.

[0060] The present invention uses a pre-trained language model Bert to learn the initial log sequence semantic vector. The Bert model has multiple transformer encoders, each of which has a multi-head attention layer and a feedforward network layer (FFN) that applies a self-attention mechanism, and adopts a residual network and normalization operation. Finally, by calculating the IDF weight, the occurrence frequency of each log sequence is integrated with its initial log sequence semantic vector to form the final log sequence semantic expression.

[0061] S3: Input the extracted feature data into the constructed incremental learning model to update the model;

[0062] Using dark experience replay DER to participate in the construction of incremental learning models, such as Figure 3As shown in Figure 1, DER uses cross entropy loss for supervised training of new task samples and distillation loss for replay of example samples. Due to its advantages such as simplicity and efficiency, no need for task boundaries, and no reliance on data task identification, DER can adapt to many strict incremental learning settings, such as task incremental learning, class incremental learning, domain incremental learning, and online incremental learning.

[0063] The incremental update task of dark experience replay is viewed as T ordered classification tasks, where the input sample x and its true label y are drawn from the distribution D in each task t∈{1,…,T} t The classifier f is updated on each task in chronological order with θ as parameter; the goal is to correctly classify the task t in a given task. c When t∈{1,…,t c}Sequence sample data:

[0064]

[0065] h θ (x) represents the original score of the category output by the model, Represents the probability distribution of the category; since this task is challenging in terms of time and space complexity, the data of the previous task is assumed to be unavailable; therefore, it is necessary to find parameters suitable for the current task, while the parameters trained in the old task must also be effectively retained, so the network needs to imitate its original response to past samples; in order to retain knowledge about previous tasks, the following objectives are sought to be minimized:

[0066]

[0067] Among them, α is a hyperparameter that balances the losses. is the optimal parameter set at the end of task t; by using the Kmeans clustering method to extract samples as experience, it can provide support for the learning of subsequent tasks; in the training set of example samples In the example, the original scores of the categories corresponding to the samples are retained. These scores provide informative descriptions about the data points;

[0068]

[0069] Under mild assumptions, the optimization of KL divergence in equation (3) is equivalent to minimizing the Euclidean distance between the corresponding type raw score and the predicted category score; the optimization objective during model update is finally transformed into:

[0070]

[0071] It is important to note that sudden distribution changes may occur in the input stream, which can cause the replay of the exemplar sample to be affected by samples that were highly biased in the previous task. DER++ better copes with distribution changes by adding an extra term to the objective function to improve the conditional likelihood of the buffer data points relative to their true labels;

[0072]

[0073] DER++ introduces an additional coefficient β to balance the last term in the objective function; DER++ optimizes the objective function to promote the model to reach a flatter minimum. This flat minimum helps the model explore neighboring areas in the parameter space, improves the model's tolerance to local perturbations, and reduces the forgetting of knowledge.

[0074] The model is updated as follows:

[0075] The model is updated in small batches when new data is received; based on the data mobility and burstiness of the power grid log, the update is set to be performed at fixed intervals;

[0076] Apply small batch updates to aggregate data within a certain period of time into a small batch for update, avoiding the computational overhead caused by frequent updates:

[0077]

[0078] Introduce knowledge retention and forgetting mechanisms in model updating, specifically:

[0079] The sliding window mechanism sets a fixed-size time window, and the model is updated only on the data within the window; data outside the window is gradually forgotten:

[0080]

[0081] Another importance weighting mechanism assigns different weights based on the importance or confidence of the data. Newer data can be given higher weights while still retaining some of the influence of older data:

[0082]

[0083] Weight α i Defined as:

[0084] α i =exp(-λ(ti)) (9)

[0085] S4: Use the updated incremental learning model to output the abnormal information detection results of the power communication network log.

[0086] In the incremental learning model, the log sequence is modeled by the Mogrifier LSTM model, then input into the CNN-based feature fusion layer, and finally the softmax function is used to output the predicted label; the incremental model is a classifier, which can determine whether the log is abnormal based on the classification result output by the model. Since the focus of the work is on log sequence anomalies, rather than single anomalies.

[0087] In the anomaly detection task of power grid logs, a loss function based on cross entropy is designed; assuming that the goal is to predict the category yt of the log xt, the probability of the model output is y^t; the cross entropy loss function is:

[0088]

[0089] A feedback mechanism is introduced into the incremental learning model. By designing an automatic feedback loop, the detected abnormal events are sent to manual review, and the model is adjusted according to the review results. After the system detects an abnormal log, it submits it to the manual review team. If it is confirmed to be an abnormal log, the system uses the feedback results as new training data for model optimization; the model dynamically adjusts its parameters according to the accuracy of the feedback to improve its sensitivity to specific types of abnormalities.

[0090] In this embodiment, the effectiveness and efficiency of the method of the present invention are verified by experiments, as follows:

[0091] Experimental setup:

[0092] In this embodiment, real power communication network log data is used for experiment. The experimental environment is Windows 11 operating system, the processor is Intel core i7, the main frequency is 3.20 GHz, the memory size is 32 GB, the hard disk capacity is 500 GB, and the hard disk rotation speed is 7200 rpm.

[0093] The experimental data is the log data of the power communication network. The log data consists of 12 types of anomalies, and the maximum number of anomalies is 12,157 valid sequences. Based on this type of data, an incremental learning-based power network log anomaly information detection model is constructed, and the data size is 2.56MB.

[0094] Experimental results and analysis:

[0095] This embodiment conducts performance experiments and algorithm efficiency experiments on the method of the present invention.

[0096] For the electric power communication network log dataset, experiments were designed from the perspectives of detection performance and time efficiency to verify the effectiveness of the incremental learning method, and the method of the present invention was compared with other advanced detection methods. The experiment first demonstrated the changes in the detection performance of the basic method MLog during the incremental update process. Specifically, 60% of the electric power communication network log dataset was extracted as a training set, 20% as a validation set, and 20% as a test set. The training and validation datasets were divided according to the update rounds, and all round data were evenly distributed according to the total data volume. The experimental results are shown in the figure. Figure 4 As shown in Figure 2, it shows how the incremental update method changes in detection indicators as the number of update rounds increases.

[0097] from Figure 4 In Figure 1, we can observe the changes in the detection performance indicators of the incremental update method under different update rounds. The overall accuracy shows a gradual upward trend and eventually approaches 1. As the number of update rounds increases, the accuracy of the model continues to improve, and incremental learning helps the model better adapt to new data. The recall rate fluctuates greatly in the initial stage, and then stabilizes, but there is no significant improvement overall. Compared with the accuracy rate, the fluctuation of the recall rate may reflect the poor adaptability of the model when processing unseen data or the proportion of abnormal samples in the data. The F1 score is low in the initial stage, and as the update rounds increase, the overall trend increases, indicating that the overall performance of the model has improved, but the improvement is not as large as the accuracy rate.

[0098] Obtained through experiments Figure 5 to Figure 7 The comparative data shows the changes in the evaluation indicators of the incremental update method and the full update method. Compared with the full update method, the incremental update method of the present invention uses only a small amount of data to learn new sample information while retaining existing knowledge, thereby achieving an effect close to that of the full update. In general, because the full update can ensure the integrity of the data, the detection performance of the incremental update method is slightly lower than that of the full update method.

[0099] Next, we compare the time efficiency of incremental update and full update. As shown in Table 1, the training time of the two update strategies increases with the expansion of data scale, but the time efficiency of incremental update is about 120% to 130% of that of full update, which is significantly improved.

[0100] Table 1 Comparison of time efficiency between incremental update and full update

[0101] 1 2 3 4 5 6 7 Full update time / s 755 834 896 965 1035 1103 1211 Incremental update time / s 255 263 249 296 277 358 324

[0102] Finally, through the experimental structure and analysis, it can be seen that the method of the present invention optimizes the model by continuously learning new data, thereby improving the log data utilization rate of the power communication network and the real-time performance of anomaly detection. The model is constructed through the preprocessing, feature extraction, model training and updating, anomaly detection and feedback process of log data. The experimental verification on the power communication network log data set proves the effectiveness and superiority of the method of the present invention. The present invention not only provides a new idea and method for anomaly detection of power communication network logs, but also explores new directions for the application of incremental learning technology in power systems.

Claims

1. A method for detecting abnormal information in power communication network logs based on incremental learning, characterized in that: The steps include: S1: Preprocess the raw data; S2: extract features from the preprocessed data; S3: Input the extracted feature data into the constructed incremental learning model to update the model; S4: Use the updated incremental learning model to output the abnormal information detection results of the power communication network log.

2. According to claim 1, a method for detecting abnormal information in a power communication network log based on incremental learning is characterized in that: The pre-processing method in step S1 includes: An online log parsing method called Drain based on a fixed-depth tree is used to implement log parsing. When a new raw log message arrives, Drain preprocesses it through a simple regular expression based on domain knowledge, and then searches for log groups, i.e., leaf nodes of the tree, according to the encoding and specific rules in the internal nodes of the tree. If a suitable log group is found, the log message is matched with the log events stored in the log group. Otherwise, a new log group is created based on the log message.

3. According to claim 1, a method for detecting abnormal information in a power communication network log based on incremental learning is characterized in that: The feature extraction method in step S2 is: The pre-trained language model Bert is used to learn the initial log sequence semantic vector. The Bert model has multiple transformer encoders, each of which has a multi-head attention layer and a feedforward network layer that applies the self-attention mechanism, and uses a residual network and normalization operation. Finally, by calculating the IDF weight, the occurrence frequency of each log sequence is integrated with its initial log sequence semantic vector to form the final log sequence semantic expression.

4. The method for detecting abnormal information in a power communication network log based on incremental learning according to claim 1 is characterized in that: The method for constructing the incremental learning model in step S3 is: Dark experience replay (DER) is used to build the incremental learning model. DER uses cross entropy loss for supervised training of new task samples and distillation loss for example samples.

5. The method for detecting abnormal information in power communication network log based on incremental learning according to claim 4 is characterized in that: The incremental update task of dark experience replay in step S3 is regarded as T ordered classification tasks, and the input sample x and its true label y are from the distribution D in each task t∈{1,…,T} t The classifier f is updated on each task in chronological order with θ as parameter; the goal is to correctly classify the task t in a given task. c When t∈{1,…,t c }Sequence sample data: h θ (x) represents the original score of the category output by the model, Represents the probability distribution of the category; since this task is challenging in terms of time and space complexity, the data of the previous task is assumed to be unavailable; therefore, it is necessary to find parameters suitable for the current task, while the parameters trained in the old task must also be effectively retained, so the network needs to imitate its original response to past samples; in order to retain knowledge about previous tasks, the following objectives are sought to be minimized: Among them, α is a hyperparameter that balances the losses. is the optimal parameter set at the end of task t; by using the Kmeans clustering method to extract samples as experience, it can provide support for the learning of subsequent tasks; in the training set of example samples In the example, the original scores of the categories corresponding to the samples are retained. These scores provide informative descriptions about the data points; Under mild assumptions, the optimization of KL divergence in equation (3) is equivalent to minimizing the Euclidean distance between the corresponding type raw score and the predicted category score; the optimization objective during model update is finally transformed into:

6. The method for detecting abnormal information in a power communication network log based on incremental learning according to claim 5 is characterized in that: In step S3, DER++ improves the conditional likelihood of buffer data points relative to their true labels by adding an extra term in the objective function, thereby better coping with distribution changes; DER++ introduces an additional coefficient β to balance the last term in the objective function.

7. The method for detecting abnormal information in a power communication network log based on incremental learning according to claim 5 is characterized in that: The method of updating the model in step S3 is: The model is updated in small batches when new data is received; based on the data mobility and burstiness of the power grid log, the update is set to be performed at fixed intervals; Apply small batch updates to aggregate data within a certain period of time into a small batch for update, avoiding the computational overhead caused by frequent updates:

8. The method for detecting abnormal information in a power communication network log based on incremental learning according to claim 7 is characterized in that: In step S3, a knowledge retention and forgetting mechanism is introduced in the model update, specifically: The sliding window mechanism sets a fixed-size time window, and the model is updated only on the data within the window; data outside the window is gradually forgotten: Another importance weighting mechanism assigns different weights based on the importance or confidence of the data. Newer data can be given higher weights while still retaining some of the influence of older data: Weight α i Defined as: α i =exp(-λ(t-i)) (9)。 9. The method for detecting abnormal information in a power communication network log based on incremental learning according to claim 1, characterized in that: In the incremental learning model of step S4, the log sequence is modeled by a Mogrifier LSTM-based model, and then input into a CNN-based feature fusion layer, and finally a softmax function is used to output a predicted label; In the anomaly detection task of power grid logs, a loss function based on cross entropy is designed; assuming that the goal is to predict the category yt of the log xt, the probability of the model output is y^t; the cross entropy loss function is:

10. The method for detecting abnormal information in power communication network log based on incremental learning according to claim 1, characterized in that: A feedback mechanism is introduced into the incremental learning model of step S4, and an automatic feedback loop is designed to send detected abnormal events to manual review, and the model is adjusted according to the review results.

Images