Running log anomaly detection method and system

Abstract

The invention provides a running log anomaly detection method and system, and the method comprises the steps: obtaining historical running log data of a target system, and converting unstructured data in the historical running log data into structured data; performing feature extraction on the converted structured data by using a variational auto-encoder, and performing clustering analysis on the extracted features; aiming at each clustering result, using a Transform model to carry out time series data analysis so as to capture a long-distance dependency relationship, and carrying out modeling on time series characteristics in the cluster through a self-attention mechanism so as to identify an abnormal event; the method comprises the following steps: training an anomaly detection model consisting of a variational auto-encoder and a Transform model, and carrying out parameter optimization on the model; and processing real-time running log data of the target system by using the trained anomaly detection model to realize an automatic identification result of an abnormal event. According to the method, the potential distribution characteristics of the log data can be automatically captured, and the recognition precision of abnormal events is improved.

Description

Technical Field

[0001] The present invention belongs to the field of operation log anomaly detection, and in particular relates to an operation log anomaly detection method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In modern power systems, operation logs are an important source of data reflecting the operating status of the system. They contain a large amount of information that is helpful for operation and maintenance management and fault diagnosis. Effective use and analysis of them can significantly improve operation and maintenance efficiency, predict the occurrence of faults in advance and take measures to reduce losses. However, the new generation of acquisition systems uses complex components and is deployed in a multi-node cluster mode. The complexity of the system and the scale of log data are huge. The existing anomaly detection methods have a low utilization rate of these logs, making it difficult to fully tap their potential value, resulting in unsatisfactory anomaly detection results.

[0004] At present, traditional anomaly detection methods, such as threshold methods based on statistics and classification methods based on machine learning, have problems such as limited detection accuracy and high false alarm rate when processing large-scale and complex power system logs. Therefore, there is an urgent need for a method that can process complex log data more efficiently and improve anomaly detection capabilities.

[0005] In recent years, models based on deep learning have been widely used in the field of anomaly detection and have made significant progress. In particular, variational autoencoders (VAEs) have been widely used in unsupervised anomaly detection scenarios due to their powerful feature learning capabilities. At the same time, the Transformer model shows strong long-distance dependency modeling capabilities when processing time series data, and has achieved excellent results in fields such as natural language processing and time series analysis. Although these technologies have shown good performance in different fields, combining them and applying them to anomaly detection in power system operation logs is still a direction with great potential and urgently needs in-depth research. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a method and system for detecting anomalies in operation logs. The present invention combines a variational autoencoder and a Transformer model, which can automatically capture the potential distribution characteristics of log data and improve the recognition accuracy of abnormal events.

[0007] According to some embodiments, the present invention adopts the following technical solutions:

[0008] A method for detecting anomalies in a running log includes the following steps:

[0009] Obtain the historical operation log data of the target system, and convert the unstructured data in the historical operation log data into structured data;

[0010] Use variational autoencoders to extract features from the converted structured data and perform cluster analysis on the extracted features;

[0011] For each clustering result, the Transformer model is used to analyze time series data to capture long-distance dependencies, and the time series features within the cluster are modeled through the self-attention mechanism to identify abnormal events;

[0012] Train the anomaly detection model composed of the variational autoencoder and the Transformer model, and tune the model parameters;

[0013] The trained anomaly detection model is used to process the real-time operation log data of the target system to achieve automatic identification results of abnormal events.

[0014] As an optional implementation method, the Drain-based log parsing method is used to process the power equipment operation log. The log entries are gradually parsed through a hierarchical tree structure. Logs with the same prefix are classified into the same branch. When the leaf node of the tree is reached, if all the log entries under the node have a common pattern, a log template is created, and the specific values ​​in the log entries are replaced with wildcards to obtain structured log data.

[0015] As a further feature, the structured log data includes a template number and a variable value corresponding to a wildcard.

[0016] As an optional implementation, the variational autoencoder includes an encoder and a decoder, the encoder is used to map input data to a latent space and calculate the mean and variance of the latent variables; the decoder is used to sample the latent variables from the latent space and convert them back to the original data space.

[0017] As an optional implementation, the variational autoencoder adopts a reparameterization method to sample a noise vector from a standard normal distribution, and generates a latent variable based on the mean and variance of the latent space and the noise vector.

[0018] As an optional implementation, the loss function of the variational autoencoder consists of two parts, including reconstruction loss and Kullback-Leibler divergence, wherein the reconstruction loss is used to measure the difference between the original data and the reconstructed data, and is expressed by mean square error. The Kullback-Leibler divergence is used to measure the difference between the latent variable distribution and the standard normal distribution, and the Kullback-Leibler divergence is multiplied by the balance coefficient to form the final loss function of the variational autoencoder together with the reconstruction loss.

[0019] As an optional implementation, during the clustering process, K initial cluster centers are randomly selected from the data set. In each iteration, each log vector is assigned to the nearest cluster center based on the distance between the log vector and each cluster center. The cluster center is updated by calculating the average value of all log entries in each cluster. The above process is continued until the change in the cluster center is less than the set threshold or the maximum number of iterations is reached.

[0020] As an optional implementation, the Transformer model includes an input embedding layer, a position encoding layer, a multi-head self-attention module, a feedforward neural network and an output layer, wherein the input embedding layer receives the features extracted by the variational autoencoder, the position encoding layer adds position encoding to each input vector by using sine and cosine functions to obtain an input vector with position information, the multi-head self-attention module splices the outputs of each attention head and integrates them through linear transformation, the feedforward neural network contains two fully connected layers, and the output layer is a classification layer.

[0021] As an optional implementation, the multi-head self-attention module generates query, key, and value vectors for each input vector, and then calculates the attention score using the dot product between the query vector and the key vector, and generates the attention weight through the softmax function.

[0022] As an optional implementation, the Transformer model is trained using a cross entropy loss function, and the Transformer model learns to identify abnormal logs by minimizing the loss function.

[0023] A running log anomaly detection system, comprising:

[0024] The log parsing module is configured to obtain historical operation log data of the target system and convert unstructured data in the historical operation log data into structured data;

[0025] A feature extraction module is configured to extract features from the converted structured data using a variational autoencoder and perform cluster analysis on the extracted features;

[0026] The time series feature analysis module is configured to use the Transformer model to perform time series data analysis for each clustering result to capture long-distance dependencies and model the time series features within the cluster through the self-attention mechanism to identify abnormal events;

[0027] The model training module is configured to train the anomaly detection model composed of the variational autoencoder and the Transformer model and to tune the parameters of the model;

[0028] The log anomaly recognition module is configured to process the real-time operation log data of the target system using the trained anomaly detection model to achieve automatic recognition results of abnormal events.

[0029] A computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the steps in the above method are completed.

[0030] An electronic device comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above method are completed.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention combines variational autoencoders (VAE), clustering and Transformer for anomaly detection of power system operation logs, forming a multi-level detection framework. VAE is used for unsupervised learning to effectively capture the potential characteristics of complex data, reduce dependence on label data, and improve the ability to detect unknown anomalies. Combined with cluster analysis, data with similar characteristics are grouped to reduce the overlap of normal and abnormal data, thereby enhancing the accuracy of anomaly detection.

[0033] This paper combines VAE and Transformer to optimize the processing and analysis of long-term log data, significantly improving the accuracy and efficiency of anomaly detection.

[0034] The present invention can effectively solve the bottleneck problems of low utilization rate of power system operation log data and insufficient abnormality detection efficiency, thereby providing more effective technical support for the operation and maintenance of smart grids.

[0035] The present invention has a wide range of applications. It can not only provide power companies with more intelligent operation and maintenance management methods, but also has broad application potential and can be promoted and used in other industries with intensive time series data.

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0038] Figure 1 is a schematic diagram of a method flow of an embodiment;

[0039] Figure 2is a model structure diagram of an embodiment;

[0040] Figure 3 is a structural diagram of a variational autoencoder of an embodiment;

[0041] Figure 4 is a Transformer structure diagram of an embodiment;

[0042] Figure 5 This is a diagram showing comparison results of an ablation experiment in an embodiment. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0044] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0045] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0046] In the absence of conflict, the embodiments in this application and the features in the embodiments may be combined with each other.

[0047] Embodiment 1

[0048] This embodiment provides a hybrid model combining VAE and Transformer to solve the problem of abnormal detection of provincial-side base operation logs of power systems. The trained hybrid model is used to process real-time operation logs.

[0049] Specifically, a method for detecting anomalies in running logs is as follows: Figure 1 As shown, the following steps are included:

[0050] Firstly, the system operation log data is collected from a provincial base. Then the unstructured log data is converted into structured log data using a Drain-based method. This method can extract the timestamp, event type, status information and other fields from the original log and convert them into log data with a structured format.

[0051] After completing data preprocessing, the variational autoencoder (VAE) is used to extract features from structured data. The encoder maps the input data to the latent space to generate effective feature representation.

[0052] The extracted features are clustered and analyzed, and clustering algorithms such as K-means are used to group similar features into the same cluster to identify normal behavior patterns and distinguish potential anomalies. Subsequently, for each clustering result, the Transformer model is used to perform time series data analysis to capture long-distance dependencies, and the time series features within the cluster are modeled through the self-attention mechanism to identify abnormal events.

[0053] After the model training is completed, it is evaluated through the reserved test set, and the performance is measured using indicators such as precision, recall, accuracy, and F1 score. The model parameters are tuned to improve the detection effect.

[0054] Finally, based on the constructed anomaly detection model, real-time processing of operation log data and automatic identification of abnormal events are carried out, thus providing real-time warnings for operation and maintenance personnel and supporting rapid response and decision-making.

[0055] The following is a detailed introduction:

[0056] The overall structure of the constructed anomaly detection model includes log parsing module, variational autoencoder module, adaptive clustering module and Transformer module. The model structure diagram is as follows: Figure 2 shown.

[0057] The current new generation of electricity consumption information collection system adopts the "base + microservice" operation mode. Since different microservices often choose different tools for development, the heterogeneity of log data format and semantics is aggravated, and it is difficult to directly and uniformly process all equipment operation logs. Therefore, it is necessary to parse the log first, identify the fixed and variable parts in the log, and generate a log template.

[0058] The process of hierarchy parsing includes:

[0059] Log parsing refers to converting semi-structured log data into a structured format for better analysis and information extraction. This paper applies a log parsing method based on Drain to process the operation log of power equipment. Drain is a log parsing algorithm that is specifically used to convert unstructured log data into a structured form. It extracts templates based on a hierarchical tree structure and can efficiently process and analyze a large number of logs. The core idea is to parse log entries step by step through a hierarchical tree structure. Each node in the tree is embedded with certain heuristic rules in advance. Log messages are divided into different log groups according to the length of the log and the position of the words, thereby extracting fixed-format log templates and corresponding parameters, and generating log templates with a general form.

[0060] Drain uses a hierarchical grouping method to gradually divide log entries according to log content, and finally classify similar log entries into the same template. Drain first decomposes the log entries. Each log entry l i is decomposed into a series of tokens {t1, t2, …, t m}. For example, for log data l i = "Power outage at stationA dueto overload.", decompose it into {"Power","outage","at","station","A","due","to","overload."}. After that, build a hierarchical tree. Drain takes each token as a node in the hierarchical tree and builds the tree according to the lexical order in the log entries. Logs with the same prefix will be classified into the same branch.

[0061] The process of generating a log template includes:

[0062] When reaching a leaf node of the tree, if all log entries under that node have a common pattern, Drain will create a log template, and the specific values ​​in the log entries, such as variables in the log, will be replaced by the wildcard "*". i , the template t generated by Drain j It can be expressed as t j = “Power outrage at station*due to load”. The wildcard * in the template represents the variable part of the log entry, i.e. A.

[0063] The structured log data output by Drain includes the template number and the variable value corresponding to the wildcard, that is, (t1, ["A"]), where t1 = "Power outrage at station*due to vcerload" and "A" is a parameter in the parameter list.

[0064] Next, sample adaptive clustering based on variational autoencoder is performed.

[0065] First, using Variational Autoencoder (VAE) can extract meaningful features from the original data, which is helpful for subsequent anomaly detection tasks.

[0066] VAE is a generative model that can learn the probability distribution of data and map high-dimensional data to a low-dimensional latent space. Unlike traditional autoencoders, VAE introduces probability models and variational inference to make the encoder output the distribution parameters of the latent variables instead of a fixed point. VAE mainly consists of two parts: the encoder, which is responsible for mapping the input data to the latent space and calculating the mean and variance of the latent variables; the decoder, which samples the latent variables from the latent space and converts them back to the original data space. The structure of VAE is as follows: Figure 3 shown.

[0067] Represent each log entry as a vector x i , the input of VAE is X = {x1,x2,…,x N}, where x i ∈R d In the encoder, the input x i The mean μ mapped to the latent space i and variance σ i 2 , the parameters μ of the output latent space i and σ i , μ i =f μ (x i ), log(σ i 2 ) = f σ (x i ), where f μ (·) and f σ (·) is the mapping function implemented by the neural network.

[0068] In order to make VAE capable of gradient descent optimization, we use the reparameterization technique to sample a noise vector e from a standard normal distribution and generate latent variables c as follows i :

[0069] c i =μ i +σ i ×e (1)

[0070] Among them, e~N(0, I).

[0071] The decoder receives the latent variable c i and maps it back to the original data space, generating the reconstructed log entry x i ':

[0072] x' i =g(c i ) (2)

[0073] Among them, g(·) is the mapping function implemented by the neural network.

[0074] The loss function of VAE consists of two parts, including reconstruction loss and Kullback-Leibler divergence (KL divergence). The reconstruction loss measures the difference between the original data and the reconstructed data, expressed as mean square error, and the KL divergence measures the difference between the latent variable distribution and the standard normal distribution, calculated as follows:

[0075]

[0076] The total loss function is:

[0077] L=L reconstruction +βL KL (5)

[0078] Among them, β is the coefficient that balances the reconstruction loss and KL divergence.

[0079] After training, the latent variable c generated by the encoder i It is the feature representation of log data, which can be used for subsequent log anomaly detection tasks.

[0080] Then, adaptive clustering based on K-means is performed.

[0081] Since log data is not labeled, it is time-consuming and labor-intensive to manually annotate log data. Therefore, this paper uses adaptive clustering to divide the log sample data encoded by VAE into normal data sample class and abnormal data sample class. The core idea of ​​the adaptive clustering method is to divide the log data into different clusters through a clustering algorithm. The goal is to maximize the similarity between data points in each cluster and minimize the similarity between different clusters. It is assumed that most clusters represent normal log data, while a few abnormal clusters contain possible abnormal log data. This method is suitable for unlabeled log data. The number and shape of clusters are adaptively adjusted through the clustering model to capture the intrinsic structure of the data.

[0082] Since there may be many different types of anomalies in the data, it is difficult to predetermine the number of clusters K when performing adaptive clustering. In order to effectively distinguish normal logs from various abnormal logs, a method of dynamically determining the number of clusters is adopted. Through experiments and analysis of data characteristics, the K value is gradually adjusted to ensure that the clustering results can be reasonably divided. The clustering process first randomly selects K initial cluster centers {μ1, μ2, ..., μ k}. In each iteration, we first calculate the log vector x i The distance between each cluster center, assigning each log vector to the nearest cluster center:

[0083] c i = arg min k ||x i -μ k || 2 (6)

[0084] Among them, c i is the cluster label assigned to the i-th log entry. Next, the cluster center is updated by calculating the average of all log entries in each cluster:

[0085]

[0086] Among them, Ck is the set of log entries contained in the kth cluster. This process will continue until the change of the cluster center is less than the set threshold, or the maximum number of iterations is reached, the algorithm will terminate.

[0087] Since the types of anomalies in log data may be diverse, in practical applications, the appropriate number of clusters may be determined by gradually adjusting the K value and combining the rationality of the clustering results. Finally, through K-means clustering, the log data is divided into different classes, some of which represent normal samples and other classes represent possible abnormal samples.

[0088] Finally, Transformer-based operation anomaly detection is performed.

[0089] Transformer is a model based on the self-attention mechanism. It is good at processing sequence data and can effectively capture the complex dependencies between data. The Transformer model uses the self-attention mechanism and feed-forward neural network to achieve efficient feature extraction and information transmission.

[0090] The core components of Transformer include input embedding layer, position encoding, multi-head self-attention mechanism, feedforward neural network and output layer. The specific structure of these components is as follows: Figure 4 shown.

[0091] The feature c extracted from the VAE is used as the input of the Transformer for training. Given that the data processed by the Transformer lacks explicit temporal information, it is necessary to add positional encoding to each input vector so that the model can understand the order of the data. Positional encoding is generated by using sine and cosine functions, which are specifically defined as:

[0092]

[0093]

[0094] Among them, pos represents the position of the input vector, and i represents the dimension index of the vector.

[0095] Add the positional encoding to the input features to obtain an input vector with position information:

[0096]

[0097] The input vector is fed into the multi-head self-attention module, which is the core part of the Transformer model, which can process data in multiple subspaces in parallel while capturing the relationship between them. For each attention head, the calculation method includes generating query, key, and value vectors for each input vector, and then calculating the attention score using the dot product between the query vector Q and the key vector K, and generating the attention weight through the softmax function:

[0098]

[0099] Among them, d k is the dimension of the key vector, where the denominator exists to avoid gradient explosion.

[0100] The multi-head self-attention mechanism concatenates the outputs of each attention head and integrates this information through linear transformation.

[0101] MultiHead(Q,K,V)=Concat(head1,...,head h )W O (12)

[0102] Where h is the number of attention heads, W O is the linear transformation matrix.

[0103] The output of the attention layer is normalized (Layer Normalization) and residual connection (ResidualConnection) before being passed to the feedforward neural network, which contains two fully connected layers. The final output of the Transformer model is passed through a classification layer (i.e., a fully connected layer plus a softmax function) to determine whether the log is abnormal. The cross entropy loss function is used to train the model:

[0104]

[0105] By minimizing the loss function, the model learns how to identify abnormal logs.

[0106] Through the above process, the Transformer model can effectively use the features extracted from VAE to detect log anomalies. Through the self-attention mechanism and multi-layer neural network, the model can capture complex patterns in log data and accurately identify anomalies.

[0107] This embodiment is also simulated through experiments.

[0108] The experimental data comes from the operation log of the provincial side base of the new generation acquisition system of a provincial company of State Grid in 2023. The system adopts the combination of x86 / ARM architecture servers and cloud platform resources to deploy multiple data components and multi-type servers, and obtains the provincial side base, components, system software and operating environment log data based on the above system. Among them, the message middleware (Kafka) realizes the read-write separation and fast storage of logs, and records and summarizes the operating status, error codes and alarm information in real time to form a continuous and detailed log data set.

[0109] The experimental data mainly consists of unstructured text logs, each of which records the operation of the system at a specific point in time. The data types of logs mainly include system logs (system and software and hardware startup and shutdown record data), communication logs (including data transmission success or failure, transmission delay, network status, etc.), and alarm logs (including the type of abnormality, occurrence time, etc.). Logs are stored in text format and contain a variety of information fields, such as timestamp, device ID, log level, message content, alarm information, error code, etc. An example of log data is as follows:

[0110] 2023-08-09 10:45:32,Service_ID:BillingService,Level:INFO,Message:Billing data processed successfully.

[0111] 2023-08-09 10:47:10,Device_ID:12345,Level:WARNING,Message:Voltagefluctuation detected,Alarm_Code:VFLT-02.

[0112] 2023-08-09 10:48:05, Service_ID: DataSyncService, Level: ERROR, Message: Failed to sync data with central server, Error_Code: DSYNC-01.

[0113] In view of the fact that the provincial base of the new generation of acquisition system is in the early stage of construction, especially in the trial operation stage, relatively diverse system operation log data samples containing alarm information can be obtained. This experiment screened a total of 1,378 abnormal log sample data containing alarm information; based on the encoding features extracted from the abnormal log sample data, K-means clustering was used to obtain 2,525 suspected abnormal samples in the unlabeled sample data, and 1,469 abnormal samples were obtained after manual screening, so a total of 2,847 abnormal log sample data were obtained; a total of 5,600 samples of normal system operation sample data were screened. The above samples are collectively used as the system operation log sample set, and 70% of the sample data are randomly selected as the training set, 15% of the sample data are used as the verification set, and 15% of the sample data are used as the test set.

[0114] This article selects precision, recall, accuracy and F1-Score as evaluation indicators. Precision is used to evaluate how many of the log sample data identified by the model are truly abnormal log samples; recall is used to measure the proportion of anomalies accurately identified by the model in all actual abnormal logs; accuracy reflects the overall performance of the model on the entire data set; F1-Score balances the relationship between precision and recall.

[0115] The calculation formula of the evaluation index is as follows:

[0116] Precision:

[0117]

[0118] Recall:

[0119]

[0120] Accuracy:

[0121]

[0122] F1-Score:

[0123]

[0124] Since unrecognized system operation anomalies may have serious consequences, the study pays special attention to the recall rate of the model. Although precision is also an important consideration, in log anomaly detection, the study prefers to ensure a high recall rate, even if this may lead to some false positives (reducing precision). Therefore, the study adjusts the decision threshold of the model to achieve the best recall rate while maintaining a high F1-Score.

[0125] The comparative experiments compare the proposed VAE and Transformer-based models with several methods, including SVM (Support Vector Machine), Random Forest, Autoencoder, CNN (Convolutional Neural Network), LSTM (Long Short-Term Memory Network), DeepLog. All experiments are conducted on the same dataset. The experimental results are shown in Table 1.

[0126] Table 1 Performance comparison with other methods

[0127]

[0128]

[0129] It can be seen that the methods based on variational autoencoders (VAE) and Transformers are significantly better than other methods in terms of recall and F1-Score. Traditional machine learning methods such as SVM and random forests perform well on small-scale data sets, but their accuracy and recall drop significantly when processing high-dimensional and sequence data. This shows that traditional methods have certain limitations when dealing with complex log data. As an unsupervised learning method, Autoencoder's reconstruction error is worse than traditional machine learning methods for detecting anomalies, but it is not as effective as deep learning methods such as LSTM and Transformer when processing time-series related data. In addition, CNN is good at extracting local features, but its ability to capture time dependencies is weak. Although LSTM performs well in processing time series data, it is slightly insufficient in anomaly detection of high-dimensional data because it is inferior to Transformer in its ability to handle data dependencies. DeepLog, as a deep learning method specifically for log analysis, can effectively identify abnormal events in logs, but it still has challenges in handling data complexity and generalization capabilities.

[0130] In summary, through comparative experiments, the proposed anomaly detection method based on variational autoencoder (VAE) and Transformer is superior in processing power equipment log data. The model combines unsupervised feature learning and the self-attention mechanism of sequence data, and performs well in capturing complex dependencies and improving anomaly detection accuracy. The experimental results show that the proposed method has significant advantages in processing system log anomaly detection tasks.

[0131] In order to verify the contribution of each module in the provincial base system log anomaly detection model based on VAE and Transformer proposed in this paper, an ablation experiment was designed to gradually remove or replace the key components in the model and observe the changes in model performance. This paper designed three groups of ablation experiments, namely: 1) removing the feature extraction module composed of variational autoencoders; 2) removing the adaptive clustering module; 3) replacing the Transformer module with a long short-term memory network (LSTM), and observing the performance changes of the model in these three groups of ablation experiments. The ablation experiment comparison results are shown in the figure. Figure 5 As shown in the figure, it can be seen that the model is superior to other ablation comparison groups in terms of precision, recall, accuracy and F1-Score.

[0132] Experiment 1. Removing the VAE feature extraction module

[0133] Remove the VAE module and directly use the numerical representation of the log for adaptive clustering, which is then input into the Transformer. The experimental results and method data are shown in Table 2.

[0134] Table 2 Comparison of model performance after removing VAE

[0135]

[0136] The experimental results show that after removing the VAE module, all evaluation indicators of the model have decreased, indicating that the VAE module can effectively compress and retain the key feature information of the log during the feature extraction process, extract the complex structure information of the abnormal log samples as the input data of the Transformer, and ensure that the adaptive clustering link can effectively cluster according to the key feature data, thereby effectively expanding the number of abnormal samples.

[0137] Experiment 2. Removing the adaptive clustering module

[0138] In order to explore the impact of K-means clustering on the provincial base system log anomaly detection model, this paper experimentally designs a scheme that does not use K-means clustering, and directly uses VAE to extract feature vectors from the original log data. The extracted feature vectors are then passed as input to the Transformer model to complete the training and anomaly detection tasks. The purpose is to evaluate how the model performs when the K-means clustering step is omitted. The experiment found that due to the removal of K-means clustering, the difference in the number of positive and negative samples became more significant, resulting in a decrease in the performance of the model in anomaly recognition. K-means clustering can usually effectively expand the number of abnormal log sample data in the preprocessing stage, thereby improving the balance of the data set. After removing the clustering step, the model's anomaly recognition performance deteriorated due to the serious imbalance of positive and negative sample data. The experimental results are shown in Table 3.

[0139] Table 3 Model performance after removing adaptive clustering

[0140]

[0141] It can be seen that after removing the clustering module, the performance of the model is significantly reduced, indicating that unsupervised clustering can improve the balance of positive and negative samples, thereby improving the detection performance of the model.

[0142] Experiment 3. Replace Transformer with LSTM

[0143] In order to further explore the impact of different model architectures on the anomaly detection effect, this paper conducted another set of tests under the same experimental framework, replacing the Transformer with a long short-term memory network (LSTM), keeping other settings unchanged, and using LSTM to process the features extracted by VAE. LSTM is a sequence modeling algorithm that is suitable for capturing long-term dependencies in time series data. However, compared with the Transformer model, LSTM may have certain limitations when processing very long sequence data. LSTM relies on a recursive structure to transfer information, which means that as the length of the sequence grows, the efficiency of information transfer may decrease, leading to gradient vanishing or explosion problems. In addition, LSTM is not as efficient as Transformer in parallel computing. The latter can simultaneously consider the information of all positions in the sequence through the self-attention mechanism, and has better performance and speed advantages when processing large-scale data. The experimental results are shown in Table 4.

[0144] Table 4 Model performance after replacing Transformer

[0145]

[0146] The results show that the performance decreases after replacing the Transformer with LSTM, indicating that the Transformer is more effective than LSTM in processing complex dependencies.

[0147] Through the above ablation experiments, we can clearly understand the key role of VAE feature extraction, K-means clustering and Transformer structure in the overall model performance. The experimental results further prove the importance of each module of the model constructed in this paper for the task of detecting anomaly in the provincial base system log, and also illustrate the design rationality and effectiveness of the proposed model.

[0148] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0149] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0150] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0152] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principle of the present invention without creative labor shall be included in the protection scope of the present invention.

Claims

1. A method for detecting anomalies in a running log, characterized in that: The following steps are involved: Obtain the historical operation log data of the target system, and convert the unstructured data in the historical operation log data into structured data; Use variational autoencoders to extract features from the converted structured data and perform cluster analysis on the extracted features; For each clustering result, the Transformer model is used to analyze time series data to capture long-distance dependencies, and the time series features within the cluster are modeled through the self-attention mechanism to identify abnormal events; Train the anomaly detection model composed of the variational autoencoder and the Transformer model, and tune the model parameters; The trained anomaly detection model is used to process the real-time operation log data of the target system to achieve automatic identification results of abnormal events.

2. A method for detecting anomalies in operation logs according to claim 1, characterized in that: The Drain-based log parsing method is used to process the operation logs of power equipment. The log entries are parsed step by step through a hierarchical tree structure. Logs with the same prefix are classified into the same branch. When the leaf node of the tree is reached, if all the log entries under the node have a common pattern, a log template is created and the specific values ​​in the log entries are replaced with wildcards to obtain structured log data.

3. A method for detecting anomalies in operation logs as claimed in claim 2, characterized in that: The structured log data includes a template number and a variable value corresponding to a wildcard.

4. A method for detecting anomalies in operation logs according to claim 1, characterized in that: The variational autoencoder includes an encoder and a decoder, wherein the encoder is used to map input data to a latent space and calculate the mean and variance of latent variables; the decoder is used to sample latent variables from the latent space and convert them back to the original data space; The variational autoencoder adopts a reparameterization method to sample a noise vector from a standard normal distribution, and generates a latent variable according to the mean and variance of the latent space and the noise vector.

5. A method for detecting anomalies in operation logs according to claim 1 or 4, characterized in that: The loss function of the variational autoencoder consists of two parts, including reconstruction loss and Kullback-Leibler divergence, wherein the reconstruction loss is used to measure the difference between the original data and the reconstructed data, and is represented by the mean square error. The Kullback-Leibler divergence is used to measure the difference between the latent variable distribution and the standard normal distribution. After the Kullback-Leibler divergence is multiplied by the balance coefficient, it forms the final loss function of the variational autoencoder together with the reconstruction loss.

6. A method for detecting anomalies in operation logs according to claim 1, characterized in that: During the clustering process, K initial cluster centers are randomly selected from the data set. In each iteration, each log vector is assigned to the nearest cluster center according to the distance between the log vector and each cluster center. The cluster center is updated by calculating the average value of all log entries in each cluster. The above process is continued until the change in the cluster center is less than the set threshold or the maximum number of iterations is reached.

7. A method for detecting anomalies in operation logs according to claim 1, characterized in that: The Transformer model includes an input embedding layer, a position encoding layer, a multi-head self-attention module, a feedforward neural network and an output layer, wherein the input embedding layer receives the features extracted by the variational autoencoder, the position encoding layer adds position encoding to each input vector by using sine and cosine functions to obtain an input vector with position information, the multi-head self-attention module splices the outputs of each attention head and integrates them through linear transformation, the feedforward neural network includes two fully connected layers, and the output layer is a classification layer.

8. The method for detecting anomalies in operation logs according to claim 1, characterized in that: The multi-head self-attention module generates query, key, and value vectors for each input vector, and then calculates the attention score using the dot product between the query vector and the key vector, and generates the attention weight through the softmax function.

9. A method for detecting anomalies in operation logs according to claim 1, characterized in that: The Transformer model is trained using a cross entropy loss function. By minimizing the loss function, the Transformer model learns to identify abnormal logs.

10. A running log anomaly detection system, characterized in that: include: The log parsing module is configured to obtain historical operation log data of the target system and convert unstructured data in the historical operation log data into structured data; A feature extraction module is configured to extract features from the converted structured data using a variational autoencoder and perform cluster analysis on the extracted features; The time series feature analysis module is configured to use the Transformer model to perform time series data analysis for each clustering result to capture long-distance dependencies and model the time series features within the cluster through the self-attention mechanism to identify abnormal events; The model training module is configured to train the anomaly detection model composed of the variational autoencoder and the Transformer model and to tune the parameters of the model; The log anomaly recognition module is configured to process the real-time operation log data of the target system using the trained anomaly detection model to achieve automatic recognition results of abnormal events.

Images