Log anomaly detection method and device, equipment, medium and product

Abstract

The invention discloses a log anomaly detection method and device, equipment, a medium and a product, and relates to the field of data analysis, the method comprises the following steps: preprocessing a target log to obtain log semantics and a log sequence of the target log; word segmentation is conducted on the log semantics, the log sequence and input prompts, a log semantic word segmentation result, a log sequence word segmentation result and a first prompt word segmentation result are obtained, the prompts comprise prompt statements, and the prompt statements are statements for prompting the pre-training language model to conduct log anomaly detection; according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result, log feature vectors are obtained, and the log feature vectors comprise a first vector, a second vector and a third vector; the log feature vector is input into a pre-training language model, the pre-training language model predicts and outputs an anomaly detection result of the target log according to the log feature vector, and the cost of a log anomaly detection technology based on deep learning is reduced.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a log anomaly detection method, device, equipment, medium and product. Background Art

[0002] With the development of modern networks, higher requirements are placed on the real-time and accuracy of anomaly detection technology. Log data is closely related to network security and big data. Software systems usually record operation and status information by printing console logs, and a complex software system may generate many logs. When an anomaly occurs in a software system, log data can help operation and maintenance personnel detect system failures in a timely manner. Therefore, log data is widely used in anomaly detection tasks in software systems.

[0003] Traditional log data analysis and anomaly detection are performed manually by operation and maintenance personnel based on their professional knowledge. However, in the face of massive, unstructured system log data, manual log analysis can no longer meet current needs. Therefore, log anomaly detection based on deep learning has become an important research trend. However, the existing deep learning-based log anomaly detection technology requires a large number of training samples to train the deep learning-based log anomaly detection model. Therefore, a large amount of log data needs to be labeled as training samples, which consumes a lot of manpower and resource costs. Summary of the invention

[0004] The purpose of this application is to provide a log anomaly detection method, device, equipment, medium and product to reduce the cost of log anomaly detection technology based on deep learning.

[0005] To achieve the above objectives, this application provides the following solutions: In a first aspect, the present application provides a log anomaly detection method, comprising: Preprocessing the target log to obtain the log semantics and log sequence of the target log; Segmenting the log semantics, the log sequence and the input prompt to obtain a log semantic segmentation result, a log sequence segmentation result and a first prompt segmentation result; wherein the prompt includes a prompt sentence, and the prompt sentence is a sentence that prompts the pre-trained language model to perform log anomaly detection; A log feature vector is obtained according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first vector includes an embedding vector of each log semantic word in the log semantic word segmentation result, the second vector includes an embedding vector of each log sequence word in the log sequence word segmentation result, and the third vector includes an embedding vector of each prompt word in the first prompt word segmentation result; The log feature vector is input into the pre-trained language model, and the pre-trained language model predicts and outputs an anomaly detection result of the target log according to the log feature vector.

[0006] Optionally, the preprocessing of the target log to obtain the log semantics and log sequence of the target log specifically includes: Converting the target log into a structured log; Extracting the semantics of each log in the structured log to obtain the first log semantics; Removing special symbols from each of the first log semantics, and retaining repeated words in each of the first log semantics as a word, to obtain a second log semantics; The same second log semantics is retained as a log event, and all the log events are sorted according to timestamps to form a sequence, so as to obtain a log sequence of the target log.

[0007] Optionally, the prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, and the prompt template includes a prompt sentence and a template mask; wherein the first label phrase corresponds to a category characterizing that the target log is an abnormal log, and the second label phrase corresponds to a category characterizing that the target log is a normal log, and each of the label words of the first label phrase and the second label phrase is located in the vocabulary of the pre-trained language model; The pre-trained language model predicts and outputs an anomaly detection result of the target log according to the log feature vector, specifically including: The pre-trained language model predicts and outputs a first label word probability and a second label word probability according to the log feature vector; wherein the first label word probability is a probability of predicting each label word in the first label word group as the template mask, and the second label word probability is a probability of predicting each label word in the second label word group as the template mask; According to the first label word probability and the second label word probability, the anomaly detection result of the target log is obtained: If the first probability is not less than the second probability, the anomaly detection result of the target log is a category that characterizes the target log as an abnormal log; otherwise, the anomaly detection result of the target log is a category that characterizes the target log as a normal log; wherein the first probability is the average of all the first label word probabilities, and the second probability is the average of all the second label word probabilities.

[0008] Optionally, the log anomaly detection method further includes: Before segmenting the inputted prompt, selecting the prompt to be inputted from a prompt library; The word segmentation of the input prompt includes: The input prompt template is segmented, and the obtained prompt template including multiple prompt segmented words is the first prompt segmented word result.

[0009] Optionally, the log anomaly detection method further includes: Before inputting the log feature vector into the pre-trained language model, adjusting the pre-trained language model specifically includes: The pre-trained language model is trained using training samples. During the training process, the focus loss function shown in the following formula is used L F As the loss function of the pre-trained language model: ; in, represents the log label of the input training sample, wherein the log label includes abnormal log and normal log, represents the probability that the pre-trained language model predicts that the input training sample is an abnormal log or a normal log, is the weight factor, is a hyperparameter.

[0010] Optionally, the log anomaly detection method further includes: Before obtaining the log feature vector according to the log semantic segmentation result, the log sequence segmentation result and the first prompt segmentation result, the first prompt segmentation result is optimized to obtain a first prompt segmentation result suitable for log anomaly detection.

[0011] In a second aspect, the present application provides a log anomaly detection device, comprising: A preprocessing module, used to preprocess the target log to obtain the log semantics and log sequence of the target log; A word segmentation module is used to segment the log semantics, the log sequence and the input prompt to obtain a log semantic segmentation result, a log sequence segmentation result and a first prompt segmentation result; wherein the prompt includes a prompt sentence, and the prompt sentence is a sentence that prompts the pre-trained language model to perform log anomaly detection; An embedding module, configured to obtain a log feature vector according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first vector includes an embedding vector of each log semantic word in the log semantic word segmentation result, the second vector includes an embedding vector of each log sequence word in the log sequence word segmentation result, and the third vector includes an embedding vector of each prompt word in the first prompt word segmentation result; The detection module is used to input the log feature vector into the pre-trained language model, and the pre-trained language model predicts and outputs the abnormality detection result of the target log according to the log feature vector.

[0012] In a third aspect, the present application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any one of the above-mentioned log anomaly detection methods.

[0013] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the log anomaly detection methods described above.

[0014] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any one of the log anomaly detection methods described above.

[0015] According to the specific embodiments provided in this application, this application discloses the following technical effects: The present application provides a log anomaly detection method, apparatus, device, medium and product. By acquiring log semantics, point anomalies of a target log can be detected, and by acquiring log sequences, context anomalies of a target log can be detected, so that the present application can simultaneously detect point anomalies and context anomalies of a target log, thereby improving the anomaly detection capability of a target log. By segmenting log semantics, log sequences and input prompts, log semantic segmentation results, log sequence segmentation results and first prompt segmentation results are obtained. Based on the log semantic segmentation, log sequence segmentation and first prompt segmentation results, a log feature vector is obtained, and the input prompt, log semantics and log sequence can be converted into a vector form that can be understood by a pre-trained language model. By inputting the log feature vector into a pre-trained language model, the pre-trained language model converts the input prompt, log semantics and log sequence into a vector form that can be understood by a pre-trained language model according to the third word segmentation result in the log feature vector. The invention discloses a method for detecting anomalies of a target log using a pre-trained language model, and based on the first vector and the second vector, performs log anomaly detection on the target log, predicts and outputs the anomaly detection result of the target log, and realizes the direct use of a pre-trained language model for prompt-based log anomaly detection. Compared with the existing log anomaly detection technology based on deep learning, the pre-trained language model provides good parameter initialization, uses a small amount of training samples, and uses the first vector to prompt the pre-trained language model for log anomaly detection, thereby avoiding the step of adjusting the pre-trained language model according to the application scenario of log anomaly detection to make it meet the needs of log anomaly detection, and further reducing the amount of training samples used. Therefore, the present application does not require a large number of training samples for model training, and thus does not need to label a large amount of log data as training samples, effectively reducing the manpower cost and resource cost of log anomaly detection technology based on deep learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flow chart of a log anomaly detection method provided in one embodiment of the present application; Figure 2 A schematic diagram of the functional modules of a log anomaly detection device provided in one embodiment of the present application; Figure 3 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0020] In an exemplary embodiment, Figure 1 As shown, a log anomaly detection method is provided, including the following steps 101 to 105. Among them: Step 101 , preprocessing the target log to obtain the log semantics and log sequence of the target log.

[0021] In the embodiment of the present application, the target log refers to the log entry to be detected for anomalies, which may include multiple log data. Log semantics refers to the constant part in the target log, which is used to understand the meaning or context behind the target log content. A log sequence refers to a series of log events arranged in chronological order, and a log event refers to a record of different activities or state changes that occur during the operation of a system, application, or device.

[0022] Step 102, segmenting the log semantics, log sequence and input prompt to obtain log semantic segmentation results, log sequence segmentation results and first prompt segmentation results; wherein the prompt includes a prompt sentence, which is a sentence that prompts the pre-trained language model to perform log anomaly detection.

[0023] In the embodiment of the present application, the log semantic segmentation result includes multiple log semantic segmentations, i.e., the log semantic segmentation, the log sequence segmentation result includes multiple log sequence segmentations, i.e., the log semantic segmentation, the first prompt segmentation result includes multiple prompt segmentations, i.e., the prompt segmentation, each segmentation is a word, subword or character. There is no specific limitation on the prompt and the prompt sentence therein, which can be set according to actual needs. For example, set the prompt to " Is the log normal or abnormal? "Among them, Indicates the log semantic segmentation placeholder. Indicates the log sequence word segmentation placeholder, and "Is the log normal or abnormal?" is the prompt statement. For another example, set the prompt to " Is the log abnormal? "Among them, "Is the log abnormal?" is a prompt statement.

[0024] Use a tokenizer that matches the pre-trained language model to tokenize log semantics, log sequence, and input prompts. For example, the pre-trained language model BERT uses the WordPiece tokenizer. Log semantic tokenization, log sequence tokenization, and prompt tokenization may include words, subwords, and / or characters, depending on the model used and its vocabulary. For example, the input prompt is " Is the log normal or abnormal? ", the first prompt word segmentation result after word segmentation is {" ”, “ ”, “log”, “yes”, “normal”, “or”, “abnormal”, “?”}.

[0025] The main purpose of word segmentation for log semantics, log sequences, and input prompts is to convert the input prompts, log semantics, and log sequences into a form that can be understood by the pre-trained language model, that is, a series of tokens (fragments). This improves the pre-trained language model's ability to understand and process input prompts, log semantics, and log sequences, while improving the efficiency and accuracy of the trained language model in detecting log anomalies.

[0026] Step 103, obtaining a log feature vector according to the log semantic segmentation result, the log sequence segmentation result and the first prompt segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first prompt vector includes an embedding vector of each log semantic segmentation in the log semantic segmentation result, the second prompt vector includes an embedding vector of each log sequence segmentation in the log sequence segmentation result, and the third vector includes an embedding vector of each prompt segmentation in the first prompt segmentation result.

[0027] In the embodiment of the present application, the embedding vector is obtained by embedding the log semantic segmentation, log sequence segmentation and prompt segmentation, and the embedding process can be performed on the log semantic segmentation, log sequence segmentation and prompt segmentation respectively using a tagger matching the pre-trained language model. For example, for a pre-trained language model based on BERT, the BERT tagger is used to embed each log semantic segmentation, log sequence segmentation and prompt segmentation respectively.

[0028] Step 104: input the prompt vector into the pre-trained language model, and the pre-trained language model predicts and outputs the anomaly detection result of the target log based on the prompt vector.

[0029] In an embodiment of the present application, the pre-trained language model predicts and outputs the anomaly detection result of the target log based on the prompt vector, which means that the pre-trained language model performs log anomaly detection on the target log according to the prompt of the third vector in the log feature vector, and based on the first vector and the second vector, and predicts and outputs the anomaly detection result of the target log. The prompt of the third vector refers to the prompt of the embedded vector of the prompt sentence in the third vector, that is, the prompt of the prompt sentence. The anomaly detection result includes two categories, namely, the category characterizing the target log as a normal log and the category characterizing the target log as an abnormal log.

[0030] For example, if the prompt statement in the prompt is "Is the log normal or abnormal?", the category characterizing the target log as an abnormal log may be "abnormal log", and the category characterizing the target log as a normal log may be "normal log". If the prompt statement in the prompt is "Is the log an abnormal log?", the category characterizing the target log as an abnormal log may be "yes", and the category characterizing the target log as a normal log may be "no".

[0031] By implementing the above steps 101 to 104, the point anomaly of the target log can be detected through the acquired log semantics, and the context anomaly of the target log can be detected through the acquired log sequence, so that the present application can simultaneously detect the point anomaly and context anomaly of the target log, thereby improving the anomaly detection capability of the target log; by segmenting the log semantics, the log sequence and the input prompt, the log semantic segmentation result, the log sequence segmentation result and the first prompt segmentation result are obtained, and the log feature vector is obtained according to the log semantic segmentation, the log sequence segmentation and the first prompt segmentation results, so that the input prompt, log semantics and log sequence can be converted into a vector form that can be understood by the pre-trained language model; by inputting the log feature vector into the pre-trained language model, the pre-trained language model converts the prompt of the third vector in the log feature vector into the pre-trained language model. Based on the first vector and the second vector, log anomaly detection is performed on the target log, and the anomaly detection result of the target log is predicted and output, thereby realizing the direct use of the pre-trained language model for prompt-based log anomaly detection. Compared with the existing log anomaly detection technology based on deep learning, the pre-trained language model provides good parameter initialization, and the amount of training samples used is very small. In addition, the first vector is used to prompt the pre-trained language model for log anomaly detection, which avoids the step of adjusting the pre-trained language model according to the log anomaly detection application scenario to make it meet the log anomaly detection requirements, and further reduces the amount of training samples used. Therefore, the present application does not require a large number of training samples for model training, and thus does not need to label a large amount of log data as training samples, effectively reducing the manpower cost and resource cost of the log anomaly detection technology based on deep learning.

[0032] Optionally, in other embodiments of the present application, the above step 101 includes the following steps 201 to 204. Among them: Step 201: convert the target log into a structured log.

[0033] In the embodiment of the present application, the target log includes log content, which is composed of a constant part and a variable part. In the log content printed by the same log statement, the constant part is the same; the variable part is also called a parameter, which reflects the variable information when the system is running. In different states and activities, the variable part may be different. Replace the variable part in the target log, that is, convert the target log into a structured log.

[0034] Step 202: extract the semantics of each log in the structured log to obtain the first log semantics.

[0035] In the embodiment of the present application, the constant part of each log in the structured log is the log semantics of each log.

[0036] Step 203 , remove special symbols in each first log semantics, and retain the words that appear repeatedly in each first log semantics as one word, to obtain the second log semantics.

[0037] In the embodiment of the present application, special symbols refer to characters other than letters and numbers, which have specific functions or meanings in the log text. These symbols may include punctuation marks (such as periods and commas), mathematical operators (such as plus signs and equal signs), currency symbols (such as dollar signs), brackets, quotation marks, and various other symbols (such as @, #, %). The second log semantics does not need to consider variables and special symbols, so they are removed.

[0038] Step 204: retain the same second log semantics as a log event, and sort all log events according to timestamps to form a sequence, so as to obtain a log sequence of the target log.

[0039] Optionally, in other embodiments of the present application, the above step 103 includes: Step 301 , embedding processing is performed on each of the log semantic segmentation results, each log sequence segmentation result, and each prompt segmentation result to obtain a first vector, a second vector, and a third vector.

[0040] In the embodiment of the present application, the obtained first vector, second vector and third vector are log feature vectors.

[0041] Optionally, in other embodiments of the present application, the above step 103 further includes: Step 302: concatenate the first vector, the second vector and the third vector to obtain a log feature vector.

[0042] Optionally, in other embodiments of the present application, the prompt includes a log semantic word segmentation placeholder and / or a log sequence word segmentation placeholder, and the prompt word segmentation of the first prompt word segmentation result includes a log semantic word segmentation placeholder and / or a log sequence word segmentation placeholder, as well as multiple non-placeholder word segmentations, where the non-placeholder word segmentation is a prompt word segmentation that is not a log semantic word segmentation placeholder and a log sequence word segmentation placeholder.

[0043] The above step 103 includes the following steps 401 to 403. Among them: Step 401: Use all log semantic segmentations in the log semantic segmentation result to replace the log semantic segmentation placeholder in the first prompt segmentation result, and / or use all log sequence segmentations in the log sequence segmentation result to replace the log sequence segmentation placeholder in the first prompt segmentation result to obtain a second prompt segmentation result.

[0044] In the embodiment of the present application, the second prompt word segmentation result includes the first alternative word segmentation or the second alternative word segmentation, and multiple non-placeholder word segmentations. The first alternative word segmentation is a prompt word segmentation obtained by replacing the log sequence word segmentation placeholder in the first prompt word segmentation result with all log semantic word segmentations in the log semantic word segmentation result. The second alternative word segmentation is a prompt word segmentation obtained by replacing the log sequence word segmentation placeholder in the first prompt word segmentation result with all log sequence word segmentations in the log sequence word segmentation result.

[0045] Step 402, embedding processing is performed on each prompt word in the second prompt word segmentation result to obtain a log feature vector; or, embedding processing is performed on each prompt word in the second prompt word segmentation result and each log semantic word in the log semantic word segmentation result or each log sequence word in the log sequence word segmentation result to obtain a fourth vector and the first vector or the second vector, wherein the fourth vector includes the embedding vector of each prompt word in the second prompt word segmentation result, and the fourth vector and the first vector or the second vector are concatenated to obtain a log feature vector.

[0046] In an embodiment of the present application, if step 401 uses all log sequence segmentations in the log sequence segmentation result to replace the log sequence segmentation placeholder in the first prompt segmentation result, and uses all log sequence segmentations in the log sequence segmentation result to replace the log sequence segmentation placeholder in the first prompt segmentation result, then step 402 embeds each prompt segmentation in the second prompt segmentation result to obtain a log feature vector.

[0047] If step 401 only uses all log semantic segmentations in the log semantic segmentation result to replace the log semantic segmentation placeholder in the first prompt segmentation result, then step 402 embeds each prompt segmentation in the second prompt segmentation result and each log sequence segmentation in the log sequence segmentation result to obtain a fourth vector and the second vector, wherein the fourth vector includes the first vector and the third vector.

[0048] If step 401 only uses all log sequence segmentations in the log sequence segmentation result to replace the log sequence segmentation placeholder in the first prompt segmentation result, then step 402 embeds each prompt segmentation in the second prompt segmentation result and each log semantic segmentation in the log semantic segmentation result to obtain a fourth vector and the first vector, wherein the fourth vector includes the second vector and the third vector.

[0049] Optionally, in other embodiments of the present application, the prompt includes a log semantic word segmentation placeholder and a log sequence word segmentation placeholder, and the prompt word segmentation of the first prompt word segmentation result includes a log semantic word segmentation placeholder, a log sequence word segmentation placeholder and multiple non-placeholder word segmentations.

[0050] The above step 103 includes the following steps 501 to 502. Among them: Step 501, embedding processing is performed on each log semantic segmentation in the log semantic segmentation result, each log sequence segmentation in the log sequence segmentation result, and each prompt segmentation in the first prompt segmentation result, to obtain a first vector, a second vector, and a fifth vector; wherein the fifth vector includes the third vector, the embedding vector of the log semantic segmentation placeholder, and the embedding vector of the log sequence segmentation placeholder.

[0051] Step 502: Use the log semantic vector to replace the embedding vector of the log semantic word placeholder in the fifth vector, and use the log sequence vector to replace the embedding vector of the log sequence word placeholder in the fifth vector to obtain a log feature vector.

[0052] Optionally, in other embodiments of the present application, the prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, the prompt template includes a prompt statement and a template mask, wherein the first label phrase corresponds to a category characterizing the target log as an abnormal log, the second label phrase corresponds to a category characterizing the target log as a normal log, and each label word of the first label phrase and the second label phrase is located in the vocabulary of the pre-trained language model, which can reduce the computational complexity. For example, a group of label words corresponding to a normal log include test, run, etc., and a group of label words corresponding to an abnormal log include error, failure, alarm, etc.

[0053] For example, the prompt is " Is the log normal or abnormal? MSK ]",but"[ MSK ]” is the template mask.

[0054] Accordingly, the above-mentioned pre-trained language model predicts and outputs the anomaly detection result of the target log according to the log feature vector, including the following steps 601 to 602. Among them: Step 601: The pre-trained language model predicts and outputs the first label word probability and the second label word probability based on the log feature vector; wherein the first label word probability is the probability of predicting each label word in the first label word group as a template mask, and the second label word probability is the probability of predicting each label word in the second label word group as a template mask.

[0055] Step 602: Obtain anomaly detection results of the target log according to the first label word probability and the second label word probability: If the first probability is not less than the second probability, the anomaly detection result of the target log is a category that characterizes the target log as an abnormal log; otherwise, the anomaly detection result of the target log is a category that characterizes the target log as a normal log; wherein the first probability is the average of all first label word probabilities, and the second probability is the average of all second label word probabilities.

[0056] For example, suppose the first label phrase corresponding to the category characterizing the target log as an abnormal log is {v1, v2, …, v n}, the first label word probabilities are {p v1 ,p v2 ,…,p vn}, where v n is the nth label word in the first label word group, p vn To predict v n As the probability of the template mask, calculate p1,p2,…,p n The first probability is obtained by averaging the values ​​of . Assume that the second label phrase corresponding to the category characterizing the target log as a normal log is {u1,u2,…,u m}, the probabilities of the second label words are {p u1 ,p u2 ,…,p um}, where u m is the mth tag word in the second tag word group, p um To predict u m As the probability of the template mask, calculate p u1 ,p u2 ,…,p umThe second probability is obtained by taking the average value of . If the first probability is not less than the second probability, the abnormality detection result of the target log is a category that indicates that the target log is an abnormal log, that is, the target log is judged to be an abnormal log; otherwise, the abnormality detection result of the target log is a category that indicates that the target log is a normal log, that is, the target log is judged to be a normal log.

[0057] Optionally, in other embodiments of the present application, the template mask is included in the prompt statement.

[0058] For example, if the prompt is " This is[ MSK ]", then "This is [ MSK ]" is a prompt statement, "[ MSK ]” is the template mask.

[0059] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection method further includes: Before segmenting the input prompt, the prompt to be input is selected from the prompt library; wherein the prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, and the prompt template includes a prompt sentence.

[0060] Accordingly, the word segmentation of the input prompt includes: The input prompt template is segmented, and the obtained prompt template including multiple prompt segmented words (words) is the first prompt segmentation result.

[0061] In the embodiment of the present application, the prompt library stores a plurality of prompt templates, a first label phrase and a second label word of each prompt template, and a corresponding relationship (mapping relationship) between the first label phrase and the second label word of each prompt template and the category representing the target log as an abnormal log and the category representing the target log as a normal log. The prompt to be input is selected from the prompt library, that is, the prompt template to be input, the first label phrase and the second label word of the selected prompt template, and the corresponding relationship between the first label phrase and the second label word of the selected prompt template and the category representing the target log as an abnormal log and the category representing the target log as a normal log are manually selected from the prompt library.

[0062] First, the constructed prompt templates are stored in the prompt library. When a prompt needs to be input, a prompt template is directly selected from the prompt library, and the first label phrase and the second label word of the selected prompt template, as well as the correspondence between the first label phrase and the second label word of the selected prompt template and the category representing the target log as an abnormal log and the category representing the target log as a normal log are input, thereby improving the convenience and speed of inputting prompts, thereby shortening the time for log anomaly detection.

[0063] The input prompt template is segmented, that is, the text in the prompt template is segmented to obtain a prompt template including multiple segmented words. For example, a prompt template including multiple segmented words can be expressed as: ; in, Represents a prompt template that includes multiple prompt participles. Indicates Tip participle, Indicates the log semantic segmentation placeholder. Represents the log sequence word placeholder, Represents the stencil mask.

[0064] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection method further includes: Before inputting the log feature vector into the pre-trained language model, the pre-trained language model is adjusted, including: The pre-trained language model is trained using training samples. During the training process, the focal loss function shown in the following formula is used L F As the loss function of the pre-trained language model: ; in, Represents the log label of the input training sample, which includes abnormal logs and normal logs. It indicates the probability that the pre-trained language model predicts that the input training sample is an abnormal log or a normal log. is the weight factor, is a hyperparameter.

[0065] In the embodiment of the present application, the weight factor , modulation factor and modulation factor It is used to adjust the imbalance between normal logs and abnormal logs in training samples. At the same time, the modulation factor is used and , and also alleviates the imbalance problem between easy-to-classify samples and difficult-to-classify samples, and improves the recall rate and F1 score of anomaly detection.

[0066] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection method further includes: Before step 103, a prompt template including a plurality of prompt segmentation words, that is, a first prompt segmentation result, is optimized to obtain a first prompt segmentation result suitable for log anomaly detection.

[0067] In the embodiment of the present application, the first prompt word segmentation result suitable for log anomaly detection is a prompt template that makes the abnormal log detection accuracy of the pre-trained language model higher than the unoptimized first prompt word segmentation result. Optimizing the prompt template in the prompt library to obtain a prompt template suitable for log anomaly detection can improve the accuracy of anomaly detection.

[0068] Optionally, in other embodiments of the present application, manually constructing a prompt template is often suboptimal because there is no prior knowledge of constructing a high-quality prompt template. Therefore, the above optimization includes prompt templates of multiple prompt word segments, i.e., first prompt word segmentation results, to obtain the first prompt word segmentation result suitable for log anomaly detection, specifically including the following steps 1 to 4. Among them: Step 1: Select the prompt segmentation or all segmentations to be optimized in the first prompt segmentation result.

[0069] In the embodiment of the present application, some of the prompt participles in the prompt template including multiple prompt participles can be optimized, or all of the prompt participles therein can be optimized. There is no specific limitation here and it can be set according to actual needs.

[0070] Step 2: Convert each prompt word segment to be optimized into a vector model to obtain a first vector.

[0071] Step 3: Input each first vector into the trained optimization model, and the optimization model optimizes the input first vector and outputs a second vector.

[0072] Step 4: Use each second vector to replace the corresponding prompt segmentation word in the above-mentioned first prompt segmentation result to obtain the first prompt segmentation result suitable for log anomaly detection.

[0073] In the embodiment of the present application, each second vector is used to replace the prompt word corresponding to it in the above-mentioned first prompt word segmentation result, that is, each second vector is used to replace the prompt word corresponding to the first vector input to the optimization model when outputting the second vector.

[0074] For example, if the above prompt template includes multiple prompt segmentation words T , select the one to remove , and The other prompt word segmentations are optimized, and the first prompt word segmentation result suitable for log anomaly detection is obtained as follows: ; in, Represents the optimized The second vector.

[0075] Optionally, in other embodiments of the present application, the optimization model is trained according to the following steps (1) to (2). Step (1), construct a neural network model.

[0076] Step (2) uses the first prompt word segmentation results of different samples to train the neural network model until a third prompt word segmentation result is obtained according to the second vector output by the adjusted neural network model, and the third prompt word segmentation result is used for the pre-trained language model to detect log anomalies of the training samples. The pre-trained language model meets the requirements for anomaly detection of the training samples. At this time, the adjusted neural network model is the optimized model obtained by training.

[0077] The process of training the neural network model using the first hint word segmentation results of different samples includes the following steps (a) to (a). Among them: Step (a), using the first vector obtained by converting the prompt word in the sample first prompt word segmentation result as the input of the neural network model, using the constructed neural network model to optimize the first vector and output a second vector.

[0078] In step (b), each second vector is used to replace the corresponding prompt word segmentation in the first prompt word segmentation result used in the training to obtain a third prompt word segmentation result.

[0079] Step (c) uses the third prompt word segmentation result to detect log anomalies of training samples using the pre-trained language model, and adjusts the parameters of the neural network model according to the log anomaly detection effect of the pre-trained language model on the training samples.

[0080] Step (d), sequentially executing the above steps (a) to (c) for the first prompt word segmentation results of different samples, continuously adjusting the parameters of the neural network model until a third prompt word segmentation result is obtained according to the second vector output by the adjusted neural network model, and using the third prompt word segmentation result for log anomaly detection of the training samples by the pre-trained language model, and the anomaly detection effect of the pre-trained language model on the training samples meets the requirements, and the adjusted neural network model at this time is the optimized model obtained by training.

[0081] Optionally, in other embodiments of the present application, the above-mentioned optimization model includes a bidirectional LSTM using ReLU as an activation function and an MLP (multi-layer perceptron), the input of the bidirectional LSTM is a randomly initialized first vector, and the output of the bidirectional LSTM is As input to the MLP, the MLP outputs a second vector.

[0082] In the embodiment of the present application, the bidirectional LSTM can capture the contextual semantic information of the first input vector, improve the optimization effect, and thus improve the accuracy of log anomaly detection.

[0083] Based on the same inventive concept, the embodiment of the present application also provides a log anomaly detection device for implementing the log anomaly detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more log anomaly detection device embodiments provided below can refer to the limitations of the log anomaly detection method above, and will not be repeated here.

[0084] In an exemplary embodiment, Figure 2 As shown, a log anomaly detection device 70 is provided, comprising: A preprocessing module 701 is used to preprocess the target log to obtain the log semantics and log sequence of the target log; The word segmentation module 702 performs word segmentation on the log semantics, the log sequence and the input prompt to obtain the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the prompt includes a prompt sentence, which is a sentence that prompts the pre-trained language model to perform log anomaly detection; The embedding module 703 obtains a log feature vector according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first prompt vector includes an embedding vector of each log semantic word in the log semantic word segmentation result, the second prompt vector includes an embedding vector of each log sequence word in the log sequence word segmentation result, and the third vector includes an embedding vector of each prompt word in the first prompt word segmentation result; The detection module 704 inputs the prompt vector into the pre-trained language model, and the pre-trained language model predicts and outputs the anomaly detection result of the target log based on the prompt vector.

[0085] Optionally, in other embodiments of the present application, the preprocessing module 701 is further used to: Convert the target log into a structured log; Extract the semantics of each log in the structured log to obtain the first log semantics; Remove special symbols in each first log semantics, and keep the repeated words in each first log semantics as one word, to obtain the second log semantics; The same second log semantics is retained as a log event, and all log events are sorted into a sequence according to timestamps to obtain the log sequence of the target log.

[0086] Optionally, in other embodiments of the present application, the above-mentioned embedding module 703 is further used for: Each of the log semantic segmentation in the log semantic segmentation result, each log sequence segmentation in the log sequence segmentation result, and each prompt segmentation in the first prompt segmentation result are respectively embedded to obtain a first vector, a second vector, and a third vector.

[0087] In the embodiment of the present application, the obtained first vector, second vector and third vector are log feature vectors.

[0088] Optionally, in other embodiments of the present application, the above-mentioned embedding module 703 is further used for: The first vector, the second vector, and the third vector are concatenated to obtain a log feature vector.

[0089] Optionally, in other embodiments of the present application, the prompt includes a log semantic word segmentation placeholder and / or a log sequence word segmentation placeholder, and the prompt word segmentation of the first prompt word segmentation result includes a log semantic word segmentation placeholder and / or a log sequence word segmentation placeholder, as well as multiple non-placeholder word segmentations, where the non-placeholder word segmentation is a prompt word segmentation that is not a log semantic word segmentation placeholder and a log sequence word segmentation placeholder.

[0090] The above-mentioned embedding module 703 is also used for: All log semantic segmentations in the log semantic segmentation result are used to replace the log semantic segmentation placeholder in the first prompt segmentation result, and / or all log sequence segmentations in the log sequence segmentation result are used to replace the log sequence segmentation placeholder in the first prompt segmentation result, to obtain a second prompt segmentation result; Each prompt word in the second prompt word segmentation result is embedded to obtain a log feature vector; or each prompt word in the second prompt word segmentation result and each log semantic word in the log semantic word segmentation result or each log sequence word in the log sequence word segmentation result are respectively embedded to obtain a fourth vector and the first vector or the second vector, wherein the fourth vector includes the embedding vector of each prompt word in the second prompt word segmentation result, and the fourth vector and the first vector or the second vector are concatenated to obtain a log feature vector.

[0091] Optionally, in other embodiments of the present application, the prompt includes a log semantic word segmentation placeholder and a log sequence word segmentation placeholder, and the prompt word segmentation of the first prompt word segmentation result includes a log semantic word segmentation placeholder, a log sequence word segmentation placeholder and multiple non-placeholder word segmentations.

[0092] The above-mentioned embedding module 703 is also used for: Each log semantic segmentation in the log semantic segmentation result, each log sequence segmentation in the log sequence segmentation result, and each prompt segmentation in the first prompt segmentation result are respectively embedded to obtain a first vector, a second vector, and a fifth vector; wherein the fifth vector includes the third vector, the embedding vector of the log semantic segmentation placeholder, and the embedding vector of the log sequence segmentation placeholder; The log semantic vector is used to replace the embedding vector of the log semantic word segmentation placeholder in the fifth vector, and the log sequence vector is used to replace the embedding vector of the log sequence word segmentation placeholder in the fifth vector to obtain the log feature vector.

[0093] Optionally, in other embodiments of the present application, the prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, the prompt template includes a prompt statement and a template mask, wherein the first label phrase corresponds to a category representing that the target log is an abnormal log, and the second label phrase corresponds to a category representing that the target log is a normal log, and each label word of the first label phrase and the second label phrase is located in the vocabulary of the pre-trained language model.

[0094] Accordingly, the above detection module 704 is also used for: The pre-trained language model predicts and outputs the first label word probability and the second label word probability according to the log feature vector; wherein the first label word probability is the probability of predicting each label word in the first label word group as a template mask, and the second label word probability is the probability of predicting each label word in the second label word group as a template mask; According to the probability of the first label word and the probability of the second label word, the anomaly detection result of the target log is obtained: If the first probability is not less than the second probability, the anomaly detection result of the target log is a category that characterizes the target log as an abnormal log; otherwise, the anomaly detection result of the target log is a category that characterizes the target log as a normal log; wherein the first probability is the average of all first label word probabilities, and the second probability is the average of all second label word probabilities.

[0095] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection device 70 further includes: A prompt selection module is used to select a prompt to be input from a prompt library before segmenting the input prompt; wherein the prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, Accordingly, the above-mentioned word segmentation module 702 is also used for: The input prompt template is segmented, and the obtained prompt template including multiple prompt segmented words (words) is the first prompt segmentation result.

[0096] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection device 70 further includes: The model adjustment module is used to adjust the pre-trained language model before inputting the log feature vector into the pre-trained language model, specifically including: The pre-trained language model is trained using training samples. During the training process, the focal loss function shown in the following formula is used L F As the loss function of the pre-trained language model: ; in, Represents the log label of the input training sample, which includes abnormal logs and normal logs. It indicates the probability that the pre-trained language model predicts that the input training sample is an abnormal log or a normal log. is the weight factor, is a hyperparameter.

[0097] Optionally, in other embodiments of the present application, the above-mentioned log anomaly detection device 70 further includes: The template optimization module is used to optimize the prompt template including multiple prompt segmentations, namely the first prompt segmentation result, before obtaining the log feature vector according to the log semantic segmentation result, the log sequence segmentation result and the first prompt segmentation result, so as to obtain the first prompt segmentation result suitable for log anomaly detection.

[0098] Optionally, in other embodiments of the present application, the above template optimization module is further used to: Select the prompt segmentation or all segmentations to be optimized in the first prompt segmentation result; Convert each prompt word segment to be optimized into a vector mode to obtain a first vector; Input each first vector into the trained optimization model, and the optimization model optimizes the input first vector and outputs a second vector; Each second vector is used to replace the corresponding prompt segmentation word in the above-mentioned first prompt segmentation result to obtain the first prompt segmentation result suitable for log anomaly detection.

[0099] Optionally, in other embodiments of the present application, the above template optimization module is further used to: Build a neural network model; The neural network model is trained using the first prompt word segmentation results of different samples until the third prompt word segmentation result is obtained according to the second vector output by the adjusted neural network model. The third prompt word segmentation result is used for the pre-trained language model to detect log anomalies of the training samples. The anomaly detection effect of the pre-trained language model on the training samples meets the requirements. At this time, the adjusted neural network model is the optimized model obtained by training. For detailed introduction, please refer to the records of the above method embodiment, which will not be repeated here.

[0100] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data of the log anomaly detection method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a log anomaly detection method is implemented.

[0101] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0102] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0103] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0104] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0105] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0107] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0108] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A log anomaly detection method, characterized in that: The log anomaly detection method comprises: Preprocessing the target log to obtain the log semantics and log sequence of the target log; Segmenting the log semantics, the log sequence and the input prompt to obtain a log semantic segmentation result, a log sequence segmentation result and a first prompt segmentation result; wherein the prompt includes a prompt sentence, and the prompt sentence is a sentence that prompts the pre-trained language model to perform log anomaly detection; A log feature vector is obtained according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first vector includes an embedding vector of each log semantic word in the log semantic word segmentation result, the second vector includes an embedding vector of each log sequence word in the log sequence word segmentation result, and the third vector includes an embedding vector of each prompt word in the first prompt word segmentation result; The log feature vector is input into the pre-trained language model, and the pre-trained language model predicts and outputs an anomaly detection result of the target log according to the log feature vector.

2. The log anomaly detection method according to claim 1, characterized in that: The preprocessing of the target log to obtain the log semantics and log sequence of the target log specifically includes: Converting the target log into a structured log; Extracting the semantics of each log in the structured log to obtain the first log semantics; Removing special symbols from each of the first log semantics, and retaining repeated words in each of the first log semantics as a word, to obtain a second log semantics; The same second log semantics is retained as a log event, and all the log events are sorted according to timestamps to form a sequence, so as to obtain a log sequence of the target log.

3. The log anomaly detection method according to claim 1, characterized in that: The prompt includes a prompt template and a first label phrase and a second label phrase of the prompt template, wherein the prompt template includes a prompt sentence and a template mask; wherein the first label phrase corresponds to a category characterizing that the target log is an abnormal log, and the second label phrase corresponds to a category characterizing that the target log is a normal log, and each of the label words of the first label phrase and the second label phrase is located in the vocabulary of the pre-trained language model; The pre-trained language model predicts and outputs an anomaly detection result of the target log according to the log feature vector, specifically including: The pre-trained language model predicts and outputs a first label word probability and a second label word probability according to the log feature vector; wherein the first label word probability is a probability of predicting each label word in the first label word group as the template mask, and the second label word probability is a probability of predicting each label word in the second label word group as the template mask; According to the first label word probability and the second label word probability, the anomaly detection result of the target log is obtained: If the first probability is not less than the second probability, the anomaly detection result of the target log is a category that characterizes the target log as an abnormal log; otherwise, the anomaly detection result of the target log is a category that characterizes the target log as a normal log; wherein the first probability is the average of all the first label word probabilities, and the second probability is the average of all the second label word probabilities.

4. The log anomaly detection method according to claim 3, characterized in that: Also includes: Before segmenting the inputted prompt, selecting the prompt to be inputted from a prompt library; The word segmentation of the input prompt includes: The input prompt template is segmented, and the obtained prompt template including multiple prompt segmented words is the first prompt segmented word result.

5. The log anomaly detection method according to claim 1, characterized in that: Also includes: Before inputting the log feature vector into the pre-trained language model, adjusting the pre-trained language model specifically includes: The pre-trained language model is trained using training samples. During the training process, the focus loss function shown in the following formula is used L F As the loss function of the pre-trained language model: ； in, represents the log label of the input training sample, wherein the log label includes abnormal log and normal log, represents the probability that the pre-trained language model predicts that the input training sample is an abnormal log or a normal log, is the weight factor, is a hyperparameter.

6. The log anomaly detection method according to claim 1, characterized in that: Also includes: Before obtaining the log feature vector according to the log semantic segmentation result, the log sequence segmentation result and the first prompt segmentation result, the first prompt segmentation result is optimized to obtain a first prompt segmentation result suitable for log anomaly detection.

7. A log anomaly detection device, characterized in that: The log anomaly detection device comprises: A preprocessing module, used to preprocess the target log to obtain the log semantics and log sequence of the target log; A word segmentation module is used to segment the log semantics, the log sequence and the input prompt to obtain a log semantic segmentation result, a log sequence segmentation result and a first prompt segmentation result; wherein the prompt includes a prompt sentence, and the prompt sentence is a sentence that prompts the pre-trained language model to perform log anomaly detection; An embedding module, configured to obtain a log feature vector according to the log semantic word segmentation result, the log sequence word segmentation result and the first prompt word segmentation result; wherein the log feature vector includes a first vector, a second vector and a third vector, the first vector includes an embedding vector of each log semantic word in the log semantic word segmentation result, the second vector includes an embedding vector of each log sequence word in the log sequence word segmentation result, and the third vector includes an embedding vector of each prompt word in the first prompt word segmentation result; The detection module is used to input the log feature vector into the pre-trained language model, and the pre-trained language model predicts and outputs the abnormality detection result of the target log according to the log feature vector.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the log anomaly detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the log anomaly detection method described in any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the log anomaly detection method described in any one of claims 1 to 6 are implemented.

Images