Multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm

Abstract

The invention belongs to the technical field of log anomaly detection. The invention provides a multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm. According to the embodiment of the invention, the original log is analyzed through the fixed depth analysis tree Drain method, and the log template is obtained through the clustering operation, so that the log analysis speed is improved, and the more representative structured log template is obtained. By extracting semantic features, template sequence features and statistical counting features of the structured logs, anomaly detection data is more comprehensive. And by inputting multiple features into the anomaly detection model in parallel, the features of the log are fully learned, so that the anomaly detection accuracy and robustness are improved.

Description

Technical Field

[0001] The disclosed embodiments relate to the technical field of log anomaly detection, and in particular to a multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm. Background Art

[0002] With the continuous development of information technology, log data plays an extremely important role in modern systems. Log data can reflect the system's operations, errors, event sequences and other information, helping engineers and developers understand the system's operating status, troubleshoot faults and monitor performance. Therefore, log anomaly detection has become a key link in ensuring system stability and security.

[0003] Log anomaly detection aims to identify abnormal behaviors or events from massive logs. These anomalies may indicate system failures or security risks. Existing log anomaly detection methods can be roughly divided into two categories: Log anomaly detection methods based on machine learning: Machine learning methods, such as support vector machines (SVM), decision trees (DT), random forests (RF), etc., rely on manually extracted features for training and prediction. These methods can automatically learn the patterns in the data to a certain extent, but they usually rely on manually designed features and are not suitable for complex nonlinear relationships.

[0004] Log anomaly detection methods based on deep learning: Log anomaly detection methods based on deep learning have shown stronger capabilities in processing complex log data through automatic feature learning. Deep learning methods can extract multi-level features from raw logs. Commonly used network structures include long short-term memory networks (LSTM), convolutional neural networks (CNN), recurrent neural networks (RNN), etc. These methods can capture complex patterns in log data and usually have high accuracy and strong adaptability.

[0005] Although deep learning methods have shown stronger capabilities in log anomaly detection, existing deep learning-based methods still face some challenges, especially how to reasonably select features and how to efficiently process and fuse multiple features.

[0006] In the current log anomaly detection methods, there are certain problems in the feature selection process. Too many features will cause the model to overfit and fail to generalize effectively to new data, thus affecting the accuracy and robustness of the model. Too few features may cause the model to fail to fully reflect the changes in the system state, affecting the training effect of the model.

[0007] Therefore, it is necessary to improve one or more problems existing in the above-mentioned related technical solutions.

[0008] It should be noted that this section is intended to provide background or context for the technical solutions of the present disclosure stated in the claims. The description herein is not admitted to be prior art by virtue of being included in this section. Summary of the invention

[0009] The purpose of the embodiments of the present disclosure is to provide a multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm, thereby overcoming one or more problems caused by the limitations and defects of related technologies at least to a certain extent.

[0010] According to an embodiment of the present disclosure, a method for detecting anomalies in multi-feature parallel input logs based on an artificial intelligence algorithm is provided, the method comprising: The unstructured log data is parsed using a log parsing method to obtain a structured initial log template; Clustering the log templates using a clustering algorithm to obtain a target log template and log parameter information; wherein the log parameter information at least includes a log block; Dividing the log data according to the log block and the tag information of the log data to obtain a log template sequence, and saving the tag information corresponding to the log template sequence; Acquire semantic features, sequence features and statistical counting features according to the log template, the log parameter information and the log template sequence; Training an anomaly detection model using the semantic features, the sequence features, and the statistical counting features to obtain the trained anomaly detection model; The log data to be detected is input into the trained anomaly detection model to obtain anomaly detection results.

[0011] Furthermore, the step of performing log parsing on unstructured log data using the log parsing method includes: Construct an empty tree to store the parsed target log template; Preprocessing the log data to remove timestamps and IP addresses; Searching the tree for a match with the target log template; If the match is successful, the log template is updated; if the match fails, a new log template is generated and added to the tree; wherein the tree is regularly maintained and optimized.

[0012] Furthermore, the step of clustering the log templates using a clustering algorithm to obtain target log templates and log parameter information includes: Calculating the similarity between the log templates; Based on the similarity, the log templates are clustered in combination with the clustering algorithm.

[0013] Furthermore, the expression for calculating the similarity between the log templates is:

[0014] in, x i and x j represent the first object and the second object respectively, x iu and x ju Respectively x i and x j The component value in the u-th dimension, n represents the dimension of the vector, ||·||2 represents the Euclidean norm, disted( x i , x j )express x i and x j The Euclidean distance between The clustering algorithm clusters the log templates as follows:

[0015] in, C a and C b Represent the first and second classes respectively, C a and C b There are m and n elements respectively, C a and C b The centers of γ a and γ b , the first element X∈ C a , the second element Y∈ C b , Ds( C a , C b ) is the distance between the first element and the second element, is the cluster center point.

[0016] Further, the step of acquiring semantic features, sequence features and statistical counting features according to the log template, the log parameter information and the log template sequence includes: Setting the number of sliding windows, vectorizing the semantic information using a semantic processing method based on the log parameter information and the log template, and extracting semantic features of the target log template; Setting the number of sliding windows, saving the log template sequence in each sliding window, and serializing the log template sequence to obtain the sequence feature; Setting a session window, and obtaining a count of each of the log templates according to the log data to obtain the statistical count feature; The semantic feature, the sequence feature and the statistical count feature are saved under each log block.

[0017] Furthermore, the step of vectorizing the semantic information using the semantic processing method includes: For one of the target log templates, a custom stop word list is loaded, and the concatenated text is preprocessed in sequence; wherein the preprocessing includes word segmentation, screening out words that meet the part of speech, and removing stop words; Traversing all the target log templates, and putting the preprocessed text into a document set; Use the CountVectorizer() function to get the word frequency matrix, where a[j][i] represents the frequency of the jth word in the i-th document; Use the TfidfTransformer() function to calculate the tf-idf weight of each word; Get the keywords in the bag-of-words model and the corresponding tf-idf matrix; Traverse the tf-idf matrix to obtain the weight corresponding to each word of the target log template.

[0018] Furthermore, the step of serializing the log template sequence includes: Each log event is mapped to the corresponding log template sequence; the generated sequence is the template number sequence of the log events arranged in the original template order.

[0019] Furthermore, the step of obtaining the count of each log template includes: The occurrence frequency of each log event type in the specified session window is counted as a count vector and standardized.

[0020] Furthermore, the anomaly detection model includes a multi-feature parallel input model, an LSTM model and a fully connected layer, and the LSTM module includes a forget gate, an input gate and an output gate; wherein the steps of training the anomaly detection model are: The semantic features, the sequence features and the statistical counting features are input into the LSTM model through the parallel multi-feature input model, and the features are concatenated after binary classification output, and finally passed through a layer of the fully connected layer.

[0021] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: In the embodiments of the present disclosure, the multi-feature parallel input log anomaly detection method based on the artificial intelligence algorithm is used to parse the original log through the log parsing method, and the log template is obtained through the clustering operation, thereby improving the speed of log parsing and obtaining a more representative structured log template. By extracting the semantic features, template sequence features, and statistical count features of the structured log, the anomaly detection data is made more comprehensive. By inputting the multi-feature parallel anomaly detection model, the features of the log are fully learned, so that the accuracy and robustness of anomaly detection are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0023] Figure 1 A multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm in an exemplary embodiment of the present disclosure is shown; Figure 2 A specific flow chart showing a multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm in an exemplary embodiment of the present disclosure; Figure 3 A specific flow chart of log parsing in an exemplary embodiment of the present disclosure is shown; Figure 4 A specific flow chart showing anomaly detection performed by an anomaly detection model in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0025] In addition, the accompanying drawings are only schematic illustrations of the embodiments of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0026] This example implementation provides a multi-feature parallel input log anomaly detection method based on an artificial intelligence algorithm. Figure 1 As shown in , the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm may include: step S101 to step S106.

[0027] Step S101: using a log parsing method to perform log parsing on unstructured log data to obtain a structured initial log template; Step S102: clustering the log templates using a clustering algorithm to obtain a target log template and log parameter information; wherein the log parameter information at least includes a log block; Step S103: dividing the log data according to the log block and the tag information of the log data to obtain a log template sequence, and saving the tag information corresponding to the log template sequence; Step S104: acquiring semantic features, sequence features and statistical counting features according to the log template, the log parameter information and the log template sequence; Step S105: training an anomaly detection model using the semantic features, the sequence features and the statistical counting features to obtain the trained anomaly detection model; Step S106: input the log data to be detected into the trained anomaly detection model to obtain anomaly detection results.

[0028] Through the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm, the original log is parsed through the fixed depth parsing tree Drain method, and the log template is obtained through clustering operation, which improves the speed of log parsing and obtains more representative structured log templates. By extracting the semantic features, template sequence features, and statistical counting features of structured logs, the anomaly detection data is made more comprehensive. By inputting the multi-feature parallel anomaly detection model, the features of the log are fully learned, so that the accuracy and robustness of anomaly detection are improved.

[0029] Next, we will refer to Figures 1 to 4 The various steps of the above-mentioned multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm in this example implementation are described in more detail.

[0030] In step S101, a log parsing method is used to parse unstructured log data to obtain a structured initial log template.

[0031] For example, Figure 2 As shown in the figure, the fixed-depth parse tree Drain method is used to parse the unstructured log data into structured log templates, calculate the similarity between the log templates, and use the clustering algorithm to cluster the log templates to extract the representative log template (i.e., the target log template) and log parameter information log block ID, etc.

[0032] like Figure 3 As shown in the figure, it is a specific flow chart of log parsing. The specific parsing steps are as follows: Tree initialization: Create an empty tree structure to store the parsed log template.

[0033] Log preprocessing: Perform simple preprocessing on the logs to remove irrelevant information such as timestamps and IP addresses.

[0034] Tree search and matching: Search the tree for the node that is most similar to the log and match the existing log template.

[0035] New template generation: If the match succeeds, the template is updated. If the match fails, a new log template is generated and added to the tree.

[0036] Template maintenance: Regularly maintain and optimize the template tree, such as merging similar templates, deleting redundant templates, etc.

[0037] In step S102, clustering algorithm is used to cluster the log templates to obtain target log templates and log parameter information; wherein the log parameter information at least includes log blocks.

[0038] For example, the similarity is calculated as follows:

[0039] in, x i and x j Represents two n-dimensional vectors, which are the objects whose distance needs to be calculated. x iu and x ju Respectively x i and x jThe component value in the uth dimension. n represents the dimension of the vector, that is, the dimension of the space where the data point is located. Σ represents the summation symbol, which means summing the square of the difference of each component in the n-th dimension. ||·||2 represents the L2 norm, that is, the Euclidean norm, which is used to measure the distance between two vectors. disted( x i , x j )express x i and x j The Euclidean distance between .

[0040] The similarity calculation method of inter-class distance is as follows: There are two classes C a and C b , with m and n elements respectively, and their centers are γ a and γ b . Let element x∈ C a , y∈ C b , the distance between these two elements is usually characterized by the inter-class distance, denoted as Ds( C a , C b ).

[0041]

[0042] In step S103, the log data is divided according to the log blocks and the tag information of the log data to obtain a log template sequence, and the tag information corresponding to the log template sequence is saved.

[0043] For example, the structured log data is further processed. According to the log block information and tag information, all logs are divided into log blocks. Each log block is followed by a log template sequence, and each log block saves its tag.

[0044] The final form of the processed data is as follows: preprocess_data : { session_id : { log_template_ sequence: template1,template2,template2……, anomaly : 0 or 1, }} In step S104, semantic features, sequence features and statistical counting features are acquired according to the log template, the log parameter information and the log template sequence; For example, the specific operations of feature extraction are as follows: Semantic feature selection, setting the number of sliding windows, using semantic processing methods to vectorize semantic information, and extracting semantic features of log templates; Sequence feature extraction: also set the number of sliding windows, save the log template sequence in each sliding window, and number the log template sequence; Statistical feature extraction, setting the session window, and obtaining the count of each template; Semantic features, sequence features, and statistical features are saved in each log block to build a multi-feature parallel input model.

[0045] The steps of log semantic vectorization TF-IDF are as follows: ① Load a custom stop word list and perform data preprocessing on the concatenated text, including word segmentation, filtering out words that match the part of speech, and removing stop words; ② Traverse all log templates and put the preprocessed text into the document set; ③ Use the CountVectorizer() function to get the word frequency matrix, where a[j][i] represents the word frequency of the jth word in the i-th document; ④ Use the TfidfTransformer() function to calculate the tf-idf weight of each word; ⑤ Get the keywords in the bag-of-words model and the corresponding tf-idf matrix; Traverse the tf-idf matrix to obtain the weight corresponding to each log template word; Log event mapping: Map each log event to its corresponding template number. The generated sequence is the template number sequence of the log events arranged in the order of the original template.

[0046] The statistical feature extraction method is as follows: Count the occurrence frequency of each log event type in the specified session window as a count vector; perform normalization.

[0047] In step S105, the anomaly detection model is trained using the semantic features, the sequence features and the statistical counting features to obtain the trained anomaly detection model; For example, Figure 4The figure shows a flow chart of checking the anomaly detection model. The anomaly detection model includes a multi-feature parallel input model, an LSTM model and a fully connected layer, and the LSTM module includes a forget gate, an input gate and an output gate. The steps of training the anomaly detection model are as follows: The semantic features, the sequence features and the statistical counting features are input into the LSTM model through the parallel multi-feature input model, and the features are concatenated after binary classification output, and finally passed through a layer of the fully connected layer.

[0048] Forget Gate: ; Input Gate: , ; Output Gate: , .

[0049] f t : The output of the forget gate (value range 0 to 1), indicating the part of the current unit state that needs to be forgotten.

[0050] σ: Sigmoid activation function, compresses the value to the range [0,1].

[0051] W f Weight matrix of the forget gate.

[0052] b f Bias term for the forget gate.

[0053] h t−1 : The hidden state at the previous time step.

[0054] x t : Input for the current time step.

[0055] i t : The output of the input gate determines the impact of the current input on the unit state (value range is 0 to 1).

[0056] C t : Candidate memory state (range [-1,1]), indicating the new information that needs to be added at the current time step.

[0057] W i , W c : Weight matrix for input gates and candidate memory states.

[0058] b i 、b c : Bias term between input gate and candidate memory state.

[0059] o t: The output of the output gate determines the information contained in the hidden state of the current time step (value range 0 to 1).

[0060] h t : The hidden state of the current time step (output result).

[0061] tanh: Hyperbolic tangent activation function, which compresses the unit state value to the range of [-1,1].

[0062] W o : Weight matrix of the output gate.

[0063] b o : Bias term for the output gate.

[0064] In step S106, the log data to be detected is input into the trained anomaly detection model to obtain an anomaly detection result.

[0065] For example, Figure 2 As shown, the trained anomaly detection model will be experimentally verified using experimental data.

[0066] Experimental proof: (1) Improved accuracy: Through multi-feature parallel input and combined with the LSTM model, the present invention can fully learn various features in log data and improve detection accuracy.

[0067] (2) Efficient processing: The fixed-depth parsing tree (Drain) method is used to parse logs and extract features, which improves the efficiency of log parsing and feature extraction.

[0068] (3) Reduce computational complexity: Through streamlined feature extraction methods and optimized deep learning models, the computational complexity and training time of the model are reduced, making it better applicable to real-time detection.

[0069] In a specific embodiment, the pseudo code of the parse function of the Drain key step to parse the input log file is as follows:

[0070] In a specific embodiment, the process of data processing is as follows: ① Load structured HDFS log data and tag data; ② Identify block IDs and event templates in logs; ③Save the log template and tag information of the log sequence in each session; ④ Split each session (represented by a chunk ID) into a training set and a test set based on the label, optionally performing a random split on the session; ⑤Save the session data of the training set and test set as pickle files.

[0071] The code parameter settings in the data processing experiment are as follows:

[0072] In a specific embodiment, the pseudo code of semantic feature extraction in feature extraction is as follows:

[0073] The pseudo code for sequence feature extraction is as follows:

[0074] The pseudo code for statistical counting feature extraction is as follows:

[0075] The parameter settings during feature selection are as follows:

[0076] Through the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm, the original log is parsed through the fixed depth parsing tree Drain method, and the log template is obtained through clustering operation, which improves the speed of log parsing and obtains more representative structured log templates. By extracting the semantic features, template sequence features, and statistical counting features of structured logs, the anomaly detection data is made more comprehensive. By inputting the multi-feature parallel anomaly detection model, the features of the log are fully learned, so that the accuracy and robustness of anomaly detection are improved.

[0077] It should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", etc. in the above description indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present disclosure and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the embodiments of the present disclosure.

[0078] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0079] In the embodiments of the present disclosure, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present disclosure can be understood according to specific circumstances.

[0080] In the embodiments of the present disclosure, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include the first and second features being in direct contact, or may include the first and second features not being in direct contact but being in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes the first feature being directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes the first feature being directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0081] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0082] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm, characterized in that: The method includes: The unstructured log data is parsed using a log parsing method to obtain a structured initial log template; Clustering the log templates using a clustering algorithm to obtain a target log template and log parameter information; wherein the log parameter information at least includes a log block; Dividing the log data according to the log block and the tag information of the log data to obtain a log template sequence, and saving the tag information corresponding to the log template sequence; Acquire semantic features, sequence features and statistical counting features according to the log template, the log parameter information and the log template sequence; Training an anomaly detection model using the semantic features, the sequence features, and the statistical counting features to obtain the trained anomaly detection model; The log data to be detected is input into the trained anomaly detection model to obtain anomaly detection results.

2. According to the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm in claim 1, it is characterized in that: The steps of performing log parsing on unstructured log data using the log parsing method include: Construct an empty tree to store the parsed target log template; Preprocessing the log data to remove timestamps and IP addresses; Searching the tree for a match with the target log template; If the match is successful, the log template is updated; if the match fails, a new log template is generated and added to the tree; wherein the tree is regularly maintained and optimized.

3. According to the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm in claim 1, it is characterized in that: The step of clustering the log templates using a clustering algorithm to obtain target log templates and log parameter information includes: Calculating the similarity between the log templates; Based on the similarity, the log templates are clustered in combination with the clustering algorithm.

4. According to claim 3, the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm is characterized in that: The expression for calculating the similarity between the log templates is: in, x i and x j represent the first object and the second object respectively, x iu and x ju Respectively x i and x j The component value in the u-th dimension, n represents the dimension of the vector, ||·||2 represents the Euclidean norm, disted( x i , x j )express x i and x j The Euclidean distance between The clustering algorithm clusters the log templates as follows: in, C a and C b Represent the first and second classes respectively, C a and C b There are m and n elements respectively, C a and C b The centers of γ a and γ b , the first element X∈ C a , the second element Y∈ C b , Ds( C a , C b ) is the distance between the first element and the second element, is the cluster center point.

5. According to claim 1, the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm is characterized in that: The step of acquiring semantic features, sequence features and statistical counting features according to the log template, the log parameter information and the log template sequence includes: The number of sliding windows is set, and based on the log parameter information and the log template, the semantic information is vectorized by using a semantic processing method to extract the semantic features of the target log template; Setting the number of sliding windows, saving the log template sequence in each sliding window, and serializing the log template sequence to obtain the sequence feature; Setting a session window, and obtaining a count of each of the log templates according to the log data to obtain the statistical count feature; The semantic feature, the sequence feature and the statistical count feature are saved under each log block.

6. According to claim 5, the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm is characterized in that: The steps of vectorizing semantic information using a semantic processing method include: For one of the target log templates, a custom stop word list is loaded, and the concatenated text is preprocessed in sequence; wherein the preprocessing includes word segmentation, screening out words that meet the part of speech, and removing stop words; Traversing all the target log templates, and putting the preprocessed text into a document set; Use the CountVectorizer() function to get the word frequency matrix, where a[j][i] represents the frequency of the jth word in the i-th document; Use the TfidfTransformer() function to calculate the tf-idf weight of each word; Get the keywords in the bag-of-words model and the corresponding tf-idf matrix; Traverse the tf-idf matrix to obtain the weight corresponding to each word of the target log template.

7. According to claim 5, the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm is characterized in that: The step of serializing the log template sequence includes: Each log event is mapped to the corresponding log template sequence; the generated sequence is the template number sequence of the log events arranged in the original template order.

8. According to claim 5, the multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm is characterized in that: The step of obtaining the count of each log template includes: The occurrence frequency of each log event type in the specified session window is counted as a count vector and standardized.

9. The multi-feature parallel input log anomaly detection method based on artificial intelligence algorithm according to claim 6 is characterized in that: The anomaly detection model includes a multi-feature parallel input model, an LSTM model and a fully connected layer, and the LSTM module includes a forget gate, an input gate and an output gate; wherein the steps of training the anomaly detection model are: The semantic features, the sequence features and the statistical counting features are input into the LSTM model through the parallel multi-feature input model, and the features are concatenated after binary classification output, and finally passed through a layer of the fully connected layer.

Images