Log abnormal event identification method and device of flight operation control system, equipment and medium

Abstract

The invention provides a log abnormal event identification method and device for a flight operation control system, equipment and a medium, and the method comprises the steps: carrying out the preprocessing of a to-be-identified log text, and determining a feature sequence of the to-be-identified log text; inputting the feature sequence into a pre-trained log abnormal event recognition model, processing each word vector in the feature sequence based on a plurality of long and short term memory neural networks in the log abnormal event recognition model, determining a key feature vector of the feature sequence, performing full connection layer classification processing on the key feature vector, and obtaining a log abnormal event recognition result; outputting a log abnormal event occurrence probability vector of the key feature vector; wherein the log abnormal event identification model is obtained by controlling a neural network model to learn a corresponding relation between an abnormal log and a log abnormal event code; and determining a target log abnormal event code of the to-be-identified log text based on the log abnormal event occurrence probability vector, thereby realizing accurate identification of the log abnormal event.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, equipment and medium for identifying abnormal log events in a flight operation control system. Background Art

[0002] With the rapid development of the civil aviation industry, the flight operation control system plays a vital role in operations. This system is not only responsible for the scheduling, management, and security of flights, but also involves flight safety, passenger services, and other aspects. However, with the increase in system complexity, the amount of log data generated during the operation control process is also growing rapidly. These log data contain a lot of valuable information, including the operating status of the system, potential problems, and abnormal events. Traditional abnormal event identification mainly relies on preset rules and conditions, such as detecting abnormal situations in logs through keyword searches or matching of specific patterns. However, this method has obvious limitations when processing massive and diverse log data. On the one hand, the setting of rules needs to be done manually, and it is often difficult to cover all possible abnormal situations; on the other hand, with the update and upgrade of the system, the old rules may become invalid and need to be continuously updated and maintained; and the rule-based identification method is not effective in detecting complex and hidden abnormal events. Therefore, how to improve the accuracy of log abnormal event identification has become a technical issue that cannot be underestimated. Summary of the invention

[0003] In view of this, the purpose of this application is to provide a log abnormal event recognition method, device, equipment and medium for a flight operation control system. The log abnormal event recognition model combines the powerful sequence modeling capability of a bidirectional long short-term memory network and the effective information screening capability of an attention mechanism. It can automatically capture key feature vectors in log description texts, learn the correspondence between abnormal logs and log abnormal event encodings, and thus achieve accurate recognition of log abnormal events.

[0004] The present application provides a method for identifying abnormal log events of a flight operation control system. The method for identifying abnormal log events of a flight operation control system includes: Acquire the log text to be identified of the flight operation control system, pre-process the log text to be identified, and determine the feature sequence of the log text to be identified; The feature sequence is input into a pre-trained log abnormal event recognition model, and each word vector in the feature sequence is processed based on multiple long short-term memory neural networks in the log abnormal event recognition model to determine the key feature vector of the feature sequence, and the key feature vector is subjected to full connection layer classification processing, and the log abnormal event occurrence probability vector of the key feature vector is output; wherein the log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes; The target log abnormal event code of the log text to be identified is determined based on the log abnormal event occurrence probability vector.

[0005] In a possible implementation manner, the step of obtaining a log text to be identified from a flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified includes: Performing word segmentation processing on the Chinese content in the log file to be identified based on a word segmentation tool, and performing word segmentation processing on the English content in the log file to be identified based on a word separator, to determine the log file to be identified after the word segmentation processing; performing stop word removal on the log file to be identified after the word segmentation process, and determining the log file to be identified with the stop word removed; The text of the log file to be identified with the stop words removed is converted into a word vector, and a matrix composed of the word vectors is truncated or padded to determine a feature sequence of the log text to be identified.

[0006] In a possible implementation manner, the multiple long short-term memory neural networks in the log abnormal event recognition model process each word vector in the feature sequence to determine the key feature vector of the feature sequence, including: Input each of the word vectors into each of the long short-term memory neural networks in order from the first word vector to the last word vector; For the forward propagation LSTM neural network, each LSTM neural network processes the forward hidden state output by the previous LSTM neural network and the current word vector to predict the forward hidden state of the word vector; For the back-propagation LSTM neural network, each LSTM neural network processes the backward hidden state output by the next LSTM neural network and the current word vector to predict the backward hidden state of the word vector; The backward hidden state and the forward hidden state of each of the word vectors are processed based on an attention mechanism to determine a key feature vector of the feature sequence.

[0007] In a possible implementation manner, the backward hidden state and the forward hidden state of each word vector are processed based on the attention mechanism to determine the key feature vector of the feature sequence, including: For each of the word vectors, feature concatenation is performed on the backward hidden state and the forward hidden state of the word vector to determine a target hidden state of the word vector; The target hidden state of each word vector is weighted and processed based on the attention mechanism to determine the key feature vector.

[0008] In a possible implementation manner, the log abnormal event occurrence probability vector is determined by the following formula: ; in, is the log abnormal event occurrence probability vector, wherein the log abnormal event occurrence probability vector includes the probability of occurrence of each log abnormal event code in the log text to be identified, is the weight matrix of the fully connected layer, b is the bias vector, and c is the key eigenvector.

[0009] In a possible implementation manner, the log abnormal event recognition model is determined by the following steps: Obtaining log abnormality event codes from a plurality of historical abnormality logs, performing deduplication processing on the plurality of log abnormality event codes, and performing encoding processing on the plurality of log abnormality event codes after deduplication processing, so that the log abnormality event recognition model can recognize the log abnormality event codes; A sample log text is obtained from a plurality of the historical abnormal logs, a sample feature sequence of the sample log text is input into a neural network model, the sample feature sequence is processed, and a predicted log abnormal event occurrence probability vector of the log abnormal event code occurring in the sample log text is output; wherein the dimension of the predicted log abnormal event occurrence probability vector is consistent with the number of the log abnormal event codes; Determining the loss value of the neural network model based on the real log abnormal event occurrence probability vector of the sample log text and the predicted log abnormal event occurrence probability vector; If the loss value is less than or equal to the preset loss value, the training of the neural network model is stopped and the neural network model is used as the log abnormal event recognition model. If the loss value is greater than the preset loss value, the network parameters of the neural network model are changed and the iterative training of the neural network model continues.

[0010] In a possible implementation manner, determining the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector includes: The abnormal event code corresponding to the maximum log abnormal event occurrence probability in the log abnormal event occurrence probability vector is used as the target log abnormal event code.

[0011] The embodiment of the present application also provides a log abnormal event identification device for a flight operation control system, and the log abnormal event identification device for the flight operation control system includes: A preprocessing module, used for acquiring the log text to be identified of the flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified; A probability vector determination module is used to input the feature sequence into a pre-trained log abnormal event recognition model, process each word vector in the feature sequence based on multiple long short-term memory neural networks in the log abnormal event recognition model, determine the key feature vector of the feature sequence, perform full-connection layer classification processing on the key feature vector, and output the log abnormal event occurrence probability vector of the key feature vector; wherein the log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes; The determination module is used to determine the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector.

[0012] An embodiment of the present application also provides an electronic device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the log abnormal event identification method of the flight operation control system as described above are performed.

[0013] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for identifying abnormal log events in a flight operation control system as described above are executed.

[0014] The embodiments of the present application provide a method, device, equipment and medium for identifying abnormal log events of a flight operation control system. The method for identifying abnormal log events of a flight operation control system includes: obtaining a log text to be identified of a flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified; inputting the feature sequence into a pre-trained abnormal log event identification model, processing each word vector in the feature sequence based on multiple long short-term memory neural networks in the abnormal log event identification model, determining a key feature vector of the feature sequence, performing full-connection layer classification processing on the key feature vector, and outputting a log abnormal event occurrence probability vector of the key feature vector; wherein the abnormal log event identification model is obtained by controlling a neural network model to learn the correspondence between abnormal logs and abnormal log event codes; and determining a target abnormal log event code of the log text to be identified based on the abnormal log event occurrence probability vector. The beneficial effects of this solution are as follows: the log abnormal event recognition model combines the powerful sequence modeling capability of the bidirectional long short-term memory network and the effective information screening capability of the attention mechanism. It can automatically capture the key feature vectors in the log description text, learn the correspondence between abnormal logs and log abnormal event encodings, and thus realize accurate recognition of log abnormal events.

[0015] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flow chart of a method for identifying abnormal log events in a flight operation control system provided in an embodiment of the present application; Figure 2 A schematic diagram of the long short-term memory neural network processing process provided by an embodiment of the present application; Figure 3 One of the structural schematic diagrams of a log abnormal event identification device for a flight operation control system provided in an embodiment of the present application; Figure 4 A second structural diagram of a log abnormal event identification device for a flight operation control system provided in an embodiment of the present application; Figure 5A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0019] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of data processing technology.

[0020] According to research, with the rapid development of the civil aviation industry, the flight operation control system plays a vital role in operations. This system is not only responsible for the scheduling, management, and guarantee of flights, but also involves flight safety, passenger services, and other aspects. However, with the increase in system complexity, the amount of log data generated during the operation control process is also growing rapidly. These log data contain a lot of valuable information, including the operating status of the system, potential problems, and abnormal events. Traditional abnormal event identification mainly relies on preset rules and conditions, such as detecting abnormal situations in logs through keyword searches or matching of specific patterns. However, this method has obvious limitations when processing massive and diverse log data. On the one hand, the setting of rules needs to be done manually, and it is often difficult to cover all possible abnormal situations; on the other hand, with the update and upgrade of the system, the old rules may become invalid and need to be continuously updated and maintained; and the rule-based identification method is not effective in detecting complex and hidden abnormal events. Therefore, how to improve the accuracy of log abnormal event identification has become a technical issue that cannot be underestimated.

[0021] Based on this, an embodiment of the present application provides a log abnormal event identification method for a flight operation control system. The log abnormal event identification model combines the powerful sequence modeling capability of the bidirectional long short-term memory network and the effective information screening capability of the attention mechanism. It can automatically capture the key feature vectors in the log description text, learn the correspondence between abnormal logs and log abnormal event encodings, and thus realize accurate identification of log abnormal events.

[0022] See also Figure 1 , Figure 1This is a flow chart of a method for identifying abnormal events in a log of a flight operation control system provided by an embodiment of the present application. Figure 1 As shown in , the method for identifying abnormal log events of a flight operation control system provided by an embodiment of the present application includes: S101: Obtaining a log text to be identified from a flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified.

[0023] In this step, the log text to be identified is obtained from the flight operation control system, the log text to be identified is preprocessed, and the feature sequence of the log text to be identified is determined.

[0024] In a possible implementation manner, the step of obtaining a log text to be identified from a flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified includes: A: Perform word segmentation processing on the Chinese content in the log file to be identified based on a word segmentation tool, and perform word segmentation processing on the English content in the log file to be identified based on word separators, to determine the log file to be identified after word segmentation processing.

[0025] Here, the Chinese content in the log file to be identified is segmented according to the word segmentation tool, and the English content in the log file to be identified is segmented according to the word separator, so as to determine the log file to be identified after the word segmentation.

[0026] In the text segmentation stage, since the log may contain both Chinese and English content, they need to be processed separately. The Chinese part is segmented using a segmentation tool. At the same time, the English part can be segmented directly using spaces and special symbols as natural word separators.

[0027] B: performing stop words removal on the log file to be identified after the word segmentation process, and determining the log file to be identified with the stop words removed.

[0028] Here, the stop words are removed from the log file to be recognized after the word segmentation process, and the log file to be recognized with the stop words removed is determined.

[0029] Among them, special symbols can also be removed from the log files to be identified. This step is the same for Chinese and English. Regular expressions are used to systematically identify and remove special characters such as punctuation marks and brackets to reduce the noise information in the log text. In order to further improve the data quality, stop words need to be further removed. Use open source Chinese and English stop word lists to remove high-frequency but less informative words in Chinese and English.

[0030] C: Convert the text of the log file to be identified after removing stop words into word vectors, and perform truncation or padding on the matrix composed of each of the word vectors to determine the feature sequence of the log text to be identified.

[0031] Here, the text of the log file to be recognized with stop words removed is converted into word vectors, and the matrix composed of each word vector is truncated or padded to determine the feature sequence of the log text to be recognized.

[0032] Among them, the text is converted into word vectors and represented by vectors using Word2Vec. After the preprocessed log text, each word in it will be converted into a high-dimensional word vector representation. By combining the words in the text, the matrix representation of the log text is obtained. Since the model can only accept fixed-length input, it is necessary to truncate and pad the matrix composed of each word vector of the log text. In order to preserve the integrity of the semantic information of the log text as much as possible, and at the same time, the retained length should not be too long to bring additional overhead to the model processing, it is necessary to perform statistical analysis on the length of all preprocessed logs to determine a relatively appropriate fixed length value for the log text. S102: Input the feature sequence into a pre-trained log abnormal event recognition model, process each word vector in the feature sequence based on multiple long short-term memory neural networks in the log abnormal event recognition model, determine the key feature vector of the feature sequence, perform full-connected layer classification processing on the key feature vector, and output the log abnormal event occurrence probability vector of the key feature vector.

[0033] In this step, the feature sequence is input into the pre-trained log abnormal event recognition model, and each word vector in the feature sequence is processed according to multiple long short-term memory neural networks in the log abnormal event recognition model to determine the key feature vector of the feature sequence. The key feature vector is classified by the fully connected layer and the log abnormal event occurrence probability vector of the key feature vector is output.

[0034] The log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes.

[0035] Here, the log abnormal event occurrence probability vector includes the occurrence probability of each log abnormal event code corresponding to the log text to be identified. For example, the model gives a log abnormal event occurrence probability vector of [0.1, 0.3, 0.2, 0.25, 0.15], which respectively represent the probability that the log text to be identified belongs to E1 to E5.

[0036] Among them, the feature sequence ,in Indicates the first word vectors.

[0037] In a possible implementation manner, the multiple long short-term memory neural networks in the log abnormal event recognition model process each word vector in the feature sequence to determine the key feature vector of the feature sequence, including: a: Input each of the word vectors into each of the long short-term memory neural networks in order from the first word vector to the last word vector.

[0038] Here, each word vector is input into each long short-term memory neural network in order from the first word vector to the last word vector.

[0039] Here, the number of LSTM neural networks matches the number of word embeddings.

[0040] b: For the forward propagation LSTM neural network, each LSTM neural network processes the forward hidden state output by the previous LSTM neural network and the current word vector to predict the forward hidden state of the word vector.

[0041] Here, for the forward propagation LSTM neural network, each LSTM neural network processes the forward hidden state output by the previous LSTM neural network and the current word vector to predict the forward hidden state of the word vector.

[0042] Among them, the forward LSTM is arrive Process the input sequence sequentially. For each word vector , the forward LSTM will be based on the current input and the previous forward hidden state To calculate the current forward hidden state (As shown in the following formula). In this way, It encodes all the information from the beginning of the sequence to the current word vector.

[0043]

[0044] c: For the back-propagation LSTM neural network, each LSTM neural network processes the backward hidden state output by the next LSTM neural network and the current word vector to predict the backward hidden state of the word vector.

[0045] Here, for the back-propagation LSTM neural network, each LSTM neural network processes the backward hidden state output by the next LSTM neural network and the current word vector to predict the backward hidden state of the word vector.

[0046] Here, the backward LSTM is arrive Process the input sequence in reverse order. At each time point , the backward LSTM will be based on the current input and the next backward hidden state To calculate the current backward hidden state (As shown in the following formula). In this way, All the information from the end of the sequence to the current word vector is encoded.

[0047]

[0048] For further information, see Figure 2 , Figure 2 This is a schematic diagram of the long short-term memory neural network processing process provided by the embodiment of the present application. Figure 2 As shown, the characteristic sequence ,in Indicates the first word vectors, Indicates the number of word vectors in the text. In the Bi-LSTM model, this sequence It will be fed into the forward LSTM and backward LSTM at the same time. The LSTM network processes the input sequence independently, but in opposite directions. For the forward LSTM neural network, each LSTM neural network processes the forward hidden state output by the previous LSTM neural network and the current word vector, and predicts the forward hidden state of the word vector; for the backward LSTM neural network, each LSTM neural network processes the backward hidden state output by the next LSTM neural network and the current word vector, and predicts the backward hidden state of the word vector.

[0049] d: Processing the backward hidden state and the forward hidden state of each word vector based on the attention mechanism to determine the key feature vector of the feature sequence.

[0050] Here, the backward hidden state and forward hidden state of each word vector are processed according to the attention mechanism to determine the key feature vector of the feature sequence.

[0051] In a possible implementation manner, the backward hidden state and the forward hidden state of each word vector are processed based on the attention mechanism to determine the key feature vector of the feature sequence, including: For each of the word vectors, the backward hidden state and the forward hidden state of the word vector are feature concatenated to determine the target hidden state of the word vector; based on the attention mechanism, the target hidden state of each of the word vectors is weighted and processed to determine the key feature vector.

[0052] Here, for each word vector, the backward hidden state and the forward hidden state of the word vector are feature concatenated to determine the target hidden state of the word vector; the target hidden state of each word vector is weighted and processed according to the attention mechanism to determine the key feature vector.

[0053] Among them, in order to obtain the word vector A more comprehensive semantic representation. The corresponding forward hidden state and the backward hidden state Concatenate on the feature dimension to form a new target hidden state , the calculation process is as follows:

[0054] Considering that some words in the log text play a more important guiding role in the identification of abnormal event coding, we further introduce it to give higher weights to important words. Based on the attention mechanism, we can get a key feature vector that captures the key information in the entire sequence. , which is the weighted sum of all hidden states, is calculated as follows:

[0055] in, is the attention weight, indicating the The attention of a hidden state.

[0056] In a possible implementation manner, the log abnormal event occurrence probability vector is determined by the following formula: ; in, is the log abnormal event occurrence probability vector, wherein the log abnormal event occurrence probability vector includes the probability of occurrence of each log abnormal event code in the log text to be identified, is the weight matrix of the fully connected layer, b is the bias vector, and c is the key eigenvector.

[0057] In a possible implementation manner, the log abnormal event recognition model is determined by the following steps: (1): Obtain log abnormality event codes from multiple historical abnormality logs, perform deduplication processing on the multiple log abnormality event codes, and perform encoding processing on the multiple log abnormality event codes after deduplication processing, so that the log abnormality event recognition model can recognize the log abnormality event code.

[0058] Here, log abnormality event codes are obtained from multiple historical abnormality logs, multiple log abnormality event codes are deduplicated, and multiple log abnormality event codes after deduplication are encoded so that the log abnormality event recognition model can recognize the log abnormality event codes.

[0059] (2): Obtain sample log text from multiple historical exception logs, input the sample feature sequence of the sample log text into the neural network model, process the sample feature sequence, and output a predicted log abnormal event occurrence probability vector of the log abnormal event code occurring in the sample log text; wherein the dimension of the predicted log abnormal event occurrence probability vector is consistent with the number of the log abnormal event codes.

[0060] Here, sample log texts are obtained from multiple historical abnormal logs, and the sample feature sequences of the sample log texts are input into the neural network model, the sample feature sequences are processed, and the predicted log abnormal event occurrence probability vector encoding the log abnormal event occurring in the sample log text is output.

[0061] The processing process of the sample feature sequence is consistent with the processing process of the above feature sequence, and will not be described in detail in this section.

[0062] Here, the process of determining the probability vector of the predicted log abnormal event is equivalent to encoding each log abnormal event as a label, scoring each label, and then obtaining the probability vector.

[0063] (3): Based on the real log abnormal event occurrence probability vector of the sample log text and the predicted log abnormal event occurrence probability vector, determine the loss value of the neural network model.

[0064] Here, the loss value of the neural network model is determined based on the probability vector of the actual log abnormal event occurrence of the sample log text and the probability vector of the predicted log abnormal event occurrence.

[0065] Log abnormal event recognition can be essentially regarded as a text multi-label classification task, where each label can be regarded as an independent binary classification problem. In this type of task, the most commonly used loss function is binary cross entropy, and the loss value is determined by the following formula:

[0066] in, is the probability vector of the occurrence of real log abnormal events, is the probability vector of predicted log abnormal events, and L is the loss value.

[0067] (4): If the loss value is less than or equal to the preset loss value, the training of the neural network model is stopped and the neural network model is used as the log abnormal event recognition model. If the loss value is greater than the preset loss value, the network parameters of the neural network model are changed and the iterative training of the neural network model is continued.

[0068] Here, if the loss value is less than or equal to the preset loss value, the training of the neural network model is stopped and the neural network model is used as a log abnormal event recognition model. If the loss value is greater than the preset loss value, the network parameters of the neural network model are changed and the neural network model continues to be iteratively trained.

[0069] In order to evaluate the accuracy of the model, we selected recall, precision, and F1-Score as evaluation indicators to evaluate the performance of the model in identifying abnormal log events.

[0070] Assume that TP is a positive sample judged as positive, TN is a negative sample judged as negative, FP is a negative sample judged as positive, and FN is a positive sample judged as negative.

[0071] Recall It is used to measure the model's ability to find true positive examples. The calculation process is as follows:

[0072] Precision measures the proportion of true positives predicted by the model and is calculated as follows:

[0073] The F1 score can be understood as the recall rate And precision The harmonic mean of is used to evaluate the comprehensive performance of the model. The calculation process is as follows:

[0074] S103: Determine a target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector.

[0075] In this step, the target log abnormal event code of the log text to be identified is determined according to the log abnormal event occurrence probability vector.

[0076] In a possible implementation manner, determining the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector includes: The abnormal event code corresponding to the maximum log abnormal event occurrence probability in the log abnormal event occurrence probability vector is used as the target log abnormal event code.

[0077] Here, the abnormal event code corresponding to the maximum log abnormal event occurrence probability in the log abnormal event occurrence probability vector is used as the target log abnormal event code.

[0078] Here, in addition to using the abnormal event code corresponding to the largest log abnormal event occurrence probability as the target log abnormal event code, the abnormal event codes corresponding to the first few log abnormal event occurrence probabilities may also be used as the target log abnormal event code.

[0079] This solution attempts to use the idea of ​​multi-label classification tasks to solve the problem of abnormal event recognition in airport operation control system logs, so as to alleviate the cumbersomeness, limitations and poor adaptability of traditional rule matching methods, and improve recognition accuracy and efficiency. This method combines the sequence learning ability of the Bi-LSTM network with the information focusing ability of the attention mechanism, aiming to accurately capture the deep semantics of abnormal log text, learn the relationship between logs and abnormal event encoding, and thus ensure the accuracy of abnormal event coding classification.

[0080] The embodiment of the present application provides a method for identifying abnormal log events of a flight operation control system, and the method for identifying abnormal log events of the flight operation control system includes: obtaining the log text to be identified of the flight operation control system, preprocessing the log text to be identified, and determining the feature sequence of the log text to be identified; inputting the feature sequence into a pre-trained abnormal log event recognition model, processing each word vector in the feature sequence based on multiple long short-term memory neural networks in the abnormal log event recognition model, determining the key feature vector of the feature sequence, performing full connection layer classification processing on the key feature vector, and outputting the abnormal log event occurrence probability vector of the key feature vector; wherein the abnormal log event recognition model is obtained by controlling the neural network model to learn the correspondence between abnormal logs and abnormal log event codes; and determining the target abnormal log event code of the log text to be identified based on the abnormal log event occurrence probability vector. The abnormal log event recognition model combines the powerful sequence modeling capability of the bidirectional long short-term memory network and the effective information screening capability of the attention mechanism, and can automatically capture the key feature vectors in the log description text, learn the correspondence between abnormal logs and abnormal log event codes, and thus realize accurate recognition of abnormal log events.

[0081] See also Figure 3 , Figure 4 , Figure 3 One of the structural schematic diagrams of a log abnormal event identification device for a flight operation control system provided in an embodiment of the present application; Figure 4 This is a second structural diagram of a log abnormal event identification device for a flight operation control system provided in an embodiment of the present application. Figure 3 As shown in , the log abnormal event identification device 300 of the flight operation control system includes: The preprocessing module 310 is used to obtain the log text to be identified of the flight operation control system, preprocess the log text to be identified, and determine the feature sequence of the log text to be identified; The probability vector determination module 320 is used to input the feature sequence into a pre-trained log abnormal event recognition model, process each word vector in the feature sequence based on multiple long short-term memory neural networks in the log abnormal event recognition model, determine the key feature vector of the feature sequence, perform full connection layer classification processing on the key feature vector, and output the log abnormal event occurrence probability vector of the key feature vector; wherein the log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes; The determination module 330 is used to determine the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector.

[0082] Furthermore, when the preprocessing module 310 is used to obtain the log text to be identified of the flight operation control system, preprocess the log text to be identified, and determine the feature sequence of the log text to be identified, the preprocessing module 310 is specifically used to: Performing word segmentation processing on the Chinese content in the log file to be identified based on a word segmentation tool, and performing word segmentation processing on the English content in the log file to be identified based on a word separator, to determine the log file to be identified after the word segmentation processing; performing stop word removal on the log file to be identified after the word segmentation process, and determining the log file to be identified with the stop word removed; The text of the log file to be identified with the stop words removed is converted into a word vector, and a matrix composed of the word vectors is truncated or padded to determine a feature sequence of the log text to be identified.

[0083] Further, when the probability vector determination module 320 is used to process the backward hidden state and the forward hidden state of each word vector based on the attention mechanism to determine the key feature vector of the feature sequence, the probability vector determination module 320 is specifically used to: For each of the word vectors, feature concatenation is performed on the backward hidden state and the forward hidden state of the word vector to determine a target hidden state of the word vector; The target hidden state of each word vector is weighted and processed based on the attention mechanism to determine the key feature vector.

[0084] Furthermore, the probability vector determination module 320 determines the probability vector of the log abnormal event by the following formula: ; in, is the log abnormal event occurrence probability vector, wherein the log abnormal event occurrence probability vector includes the probability of occurrence of each log abnormal event code in the log text to be identified, is the weight matrix of the fully connected layer, b is the bias vector, and c is the key eigenvector.

[0085] Further, such as Figure 4 As shown, the log abnormal event identification device 300 of the flight operation control system further includes a model training module 340, and the model training module 340 is used to determine the log abnormal event identification model through the following steps: Obtaining log abnormality event codes from a plurality of historical abnormality logs, performing deduplication processing on the plurality of log abnormality event codes, and performing encoding processing on the plurality of log abnormality event codes after deduplication processing, so that the log abnormality event recognition model can recognize the log abnormality event codes; A sample log text is obtained from a plurality of the historical abnormal logs, a sample feature sequence of the sample log text is input into a neural network model, the sample feature sequence is processed, and a predicted log abnormal event occurrence probability vector of the log abnormal event code occurring in the sample log text is output; wherein the dimension of the predicted log abnormal event occurrence probability vector is consistent with the number of the log abnormal event codes; Determining the loss value of the neural network model based on the real log abnormal event occurrence probability vector of the sample log text and the predicted log abnormal event occurrence probability vector; If the loss value is less than or equal to the preset loss value, the training of the neural network model is stopped and the neural network model is used as the log abnormal event recognition model. If the loss value is greater than the preset loss value, the network parameters of the neural network model are changed and the iterative training of the neural network model continues.

[0086] Further, when the determination module 330 is used to determine the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector, the determination module 330 is specifically used to: The abnormal event code corresponding to the maximum log abnormal event occurrence probability in the log abnormal event occurrence probability vector is used as the target log abnormal event code.

[0087] An embodiment of the present application provides a log abnormal event recognition device for a flight operation control system, and the log abnormal event recognition device for the flight operation control system includes: a preprocessing module, which is used to obtain a log text to be recognized of the flight operation control system, preprocess the log text to be recognized, and determine a feature sequence of the log text to be recognized; a probability vector determination module, which is used to input the feature sequence into a pre-trained log abnormal event recognition model, process each word vector in the feature sequence based on multiple long short-term memory neural networks in the log abnormal event recognition model, determine a key feature vector of the feature sequence, perform full-connection layer classification processing on the key feature vector, and output a log abnormal event occurrence probability vector of the key feature vector; wherein the log abnormal event recognition model is obtained by controlling a neural network model to learn the correspondence between abnormal logs and log abnormal event codes; a determination module, which is used to determine a target log abnormal event code of the log text to be recognized based on the log abnormal event occurrence probability vector. The log abnormal event recognition model combines the powerful sequence modeling capability of the bidirectional long short-term memory network and the effective information screening capability of the attention mechanism. It can automatically capture the key feature vectors in the log description text, learn the correspondence between abnormal logs and log abnormal event encodings, and thus achieve accurate recognition of log abnormal events.

[0088] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown in , the electronic device 500 includes a processor 510 , a memory 520 and a bus 530 .

[0089] The memory 520 stores machine-readable instructions executable by the processor 510. When the electronic device 500 is running, the processor 510 communicates with the memory 520 via the bus 530. When the machine-readable instructions are executed by the processor 510, the above-mentioned Figure 1 as well as Figure 2 The steps of the method for identifying abnormal events in the log of the flight operation control system in the method embodiment shown in the embodiment, and the specific implementation method can be referred to the method embodiment, which will not be repeated here.

[0090] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 as well as Figure 2 The steps of the method for identifying abnormal events in the log of the flight operation control system in the method embodiment shown in the embodiment, and the specific implementation method can be referred to the method embodiment, which will not be repeated here.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0093] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0094] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0095] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0096] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for identifying abnormal events in logs of a flight operation control system, characterized in that: The method for identifying abnormal log events of the flight operation control system includes: Acquire the log text to be identified of the flight operation control system, pre-process the log text to be identified, and determine the feature sequence of the log text to be identified; The feature sequence is input into a pre-trained log abnormal event recognition model, and each word vector in the feature sequence is processed based on multiple long short-term memory neural networks in the log abnormal event recognition model to determine the key feature vector of the feature sequence, and the key feature vector is subjected to full connection layer classification processing, and the log abnormal event occurrence probability vector of the key feature vector is output; wherein the log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes; The target log abnormal event code of the log text to be identified is determined based on the log abnormal event occurrence probability vector.

2. The method for identifying abnormal log events in a flight operation control system according to claim 1, characterized in that: The step of obtaining the log text to be identified of the flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified includes: Performing word segmentation processing on the Chinese content in the log file to be identified based on a word segmentation tool, and performing word segmentation processing on the English content in the log file to be identified based on a word separator, to determine the log file to be identified after the word segmentation processing; performing stop word removal on the log file to be identified after the word segmentation process, and determining the log file to be identified with the stop word removed; The text of the log file to be identified with the stop words removed is converted into a word vector, and a matrix composed of the word vectors is truncated or padded to determine a feature sequence of the log text to be identified.

3. The method for identifying abnormal log events of a flight operation control system according to claim 1, characterized in that: The multiple long short-term memory neural networks in the log abnormal event recognition model are used to process each word vector in the feature sequence to determine the key feature vector of the feature sequence, including: Input each of the word vectors into each of the long short-term memory neural networks in order from the first word vector to the last word vector; For the forward propagation LSTM neural network, each LSTM neural network processes the forward hidden state output by the previous LSTM neural network and the current word vector to predict the forward hidden state of the word vector; For the back-propagation LSTM neural network, each LSTM neural network processes the backward hidden state output by the next LSTM neural network and the current word vector to predict the backward hidden state of the word vector; The backward hidden state and the forward hidden state of each of the word vectors are processed based on an attention mechanism to determine a key feature vector of the feature sequence.

4. The method for identifying abnormal log events in a flight operation control system according to claim 3, characterized in that: The backward hidden state and the forward hidden state of each word vector are processed based on the attention mechanism to determine the key feature vector of the feature sequence, including: For each of the word vectors, feature concatenation is performed on the backward hidden state and the forward hidden state of the word vector to determine a target hidden state of the word vector; The target hidden state of each word vector is weighted and processed based on the attention mechanism to determine the key feature vector.

5. The method for identifying abnormal log events in a flight operation control system according to claim 1, characterized in that: The probability vector of the log abnormal event occurrence is determined by the following formula: ； in, is the log abnormal event occurrence probability vector, wherein the log abnormal event occurrence probability vector includes the probability of occurrence of each log abnormal event code in the log text to be identified, is the weight matrix of the fully connected layer, b is the bias vector, and c is the key eigenvector.

6. The method for identifying abnormal log events of a flight operation control system according to claim 1, characterized in that: The log abnormal event recognition model is determined by the following steps: Obtaining log abnormality event codes from a plurality of historical abnormality logs, performing deduplication processing on the plurality of log abnormality event codes, and performing encoding processing on the plurality of log abnormality event codes after deduplication processing, so that the log abnormality event recognition model can recognize the log abnormality event codes; A sample log text is obtained from a plurality of the historical abnormal logs, a sample feature sequence of the sample log text is input into a neural network model, the sample feature sequence is processed, and a predicted log abnormal event occurrence probability vector of the log abnormal event code occurring in the sample log text is output; wherein the dimension of the predicted log abnormal event occurrence probability vector is consistent with the number of the log abnormal event codes; Determining the loss value of the neural network model based on the real log abnormal event occurrence probability vector of the sample log text and the predicted log abnormal event occurrence probability vector; If the loss value is less than or equal to the preset loss value, the training of the neural network model is stopped and the neural network model is used as the log abnormal event recognition model. If the loss value is greater than the preset loss value, the network parameters of the neural network model are changed and the iterative training of the neural network model continues.

7. The method for identifying abnormal log events in a flight operation control system according to claim 1, characterized in that: The step of determining the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector includes: The abnormal event code corresponding to the maximum log abnormal event occurrence probability in the log abnormal event occurrence probability vector is used as the target log abnormal event code.

8. A log abnormal event identification device for a flight operation control system, characterized in that: The log abnormal event identification device of the flight operation control system includes: A preprocessing module, used for acquiring the log text to be identified of the flight operation control system, preprocessing the log text to be identified, and determining a feature sequence of the log text to be identified; A probability vector determination module is used to input the feature sequence into a pre-trained log abnormal event recognition model, process each word vector in the feature sequence based on multiple long short-term memory neural networks in the log abnormal event recognition model, determine the key feature vector of the feature sequence, perform full-connection layer classification processing on the key feature vector, and output the log abnormal event occurrence probability vector of the key feature vector; wherein the log abnormal event recognition model is obtained by controlling the neural network model to learn the corresponding relationship between abnormal logs and log abnormal event codes; The determination module is used to determine the target log abnormal event code of the log text to be identified based on the log abnormal event occurrence probability vector.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the log abnormal event identification method for a flight operation control system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the log abnormal event identification method for a flight operation control system according to any one of claims 1 to 7 are executed.

Images