Log anomaly detection method and related device

Abstract

The invention discloses a log anomaly detection method and a related device, and relates to the field of software, an iterative expansion convolutional neural network and a classifier are trained in advance based on an attention mechanism to obtain a log anomaly detection model, on one hand, rich features can be extracted through the attention mechanism, and on the other hand, a log anomaly detection model is obtained; and meanwhile, the iterative expansion convolutional neural network is utilized to capture higher-layer and more abstract features, so that the classifier can more accurately classify whether the log is abnormal or not, and for the target log to be detected, the anomaly detection result can be effectively obtained through the log anomaly detection model. Based on the method and the device, log anomaly detection can be more accurate, and an effective basis is provided for subsequent log early warning.

Description

Technical Field

[0001] The present application relates to the field of software technology, and in particular to a log anomaly detection method and related devices. Background Art

[0002] As the scale of storage and computing clusters continues to expand, the amount of log data is also increasing. These logs record various operations and times of system operation, and contain a large amount of information, which hides a lot of value and risks. By analyzing logs, enterprises can detect system operation status, find problems and solve them in time.

[0003] Therefore, how to effectively detect anomalies in logs has become an urgent problem that needs to be solved at this stage. Summary of the invention

[0004] In view of the above problems, the present application provides a log anomaly detection method and related devices to achieve the purpose of effectively detecting anomalies in logs. The specific scheme is as follows:

[0005] The first aspect of the present application provides a log anomaly detection method, comprising:

[0006] Get the target log to be detected;

[0007] Retrieving a log anomaly detection model, where the log anomaly detection model is obtained by pre-training an iteratively expanded convolutional neural network and a classifier based on an attention mechanism;

[0008] The target log is input into the log anomaly detection model to obtain an anomaly detection result of the target log output by the log anomaly detection model.

[0009] In a possible implementation, the process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model includes:

[0010] Obtaining sample logs to be trained and training labels of the sample logs;

[0011] Inputting the sample log into a BERT pre-trained language model to obtain a first feature vector output by the BERT pre-trained language model;

[0012] Processing the first feature vector based on the attention mechanism to obtain a second feature vector;

[0013] Inputting the second eigenvector into the iterative dilated convolutional neural network to obtain a third eigenvector output by the iterative dilated convolutional neural network;

[0014] Inputting the third feature vector into the classifier to obtain an anomaly detection result of the sample log output by the classifier;

[0015] Calculate the cross entropy loss function value according to the anomaly detection result and the training label of the sample log;

[0016] If the gradient value of the cross entropy loss function value does not meet the preset convergence condition, adjust the weight parameters of the BERT pre-trained language model, the iterative dilated convolutional neural network and the classifier, and return to execute the step of obtaining the sample log to be trained and the training label of the sample log until the gradient value of the cross entropy loss function value meets the convergence condition, and terminate the training to obtain the log anomaly detection model.

[0017] In a possible implementation, the processing the first feature vector based on the attention mechanism includes:

[0018] The first feature vector is processed based on a multi-head attention mechanism.

[0019] In a possible implementation, inputting the third feature vector into the classifier includes:

[0020] By performing a skip-layer connection between the BERT pre-trained language model and the iterative dilated convolutional neural network, the third feature vector and the first feature vector are simultaneously input into the classifier.

[0021] In a possible implementation, the process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model also includes:

[0022] Calculating an adversarial perturbation value according to the cross entropy loss function value and the sample log;

[0023] The sample log is processed according to the adversarial perturbation value, and the step of inputting the sample log into the BERT pre-trained language model is returned to be executed.

[0024] A second aspect of the present application provides a log anomaly detection device, comprising:

[0025] Model training module, used to train iteratively expanded convolutional neural network and classifier based on attention mechanism to obtain log anomaly detection model;

[0026] The log acquisition module is used to obtain the target log to be detected;

[0027] The log detection module is used to call the log anomaly detection model; input the target log into the log anomaly detection model, and obtain the anomaly detection result of the target log output by the log anomaly detection model.

[0028] In a possible implementation, the model training module is specifically used to:

[0029] Obtain a sample log to be trained and a training label of the sample log; input the sample log into a BERT pre-trained language model to obtain a first feature vector output by the BERT pre-trained language model; process the first feature vector based on the attention mechanism to obtain a second feature vector; input the second feature vector into the iterative expansion convolutional neural network to obtain a third feature vector output by the iterative expansion convolutional neural network; input the third feature vector into the classifier to obtain an anomaly detection result of the sample log output by the classifier; calculate a cross entropy loss function value based on the anomaly detection result of the sample log and the training label; if the gradient value of the cross entropy loss function value does not meet a preset convergence condition, adjust the weight parameters of the BERT pre-trained language model, the iterative expansion convolutional neural network and the classifier respectively, and return to execute the step of obtaining the sample log to be trained and the training label of the sample log until the gradient value of the cross entropy loss function value meets the convergence condition to terminate the training and obtain the log anomaly detection model.

[0030] A third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the log anomaly detection method of the first aspect or any implementation of the first aspect.

[0031] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0032] The memory is used to store computer programs;

[0033] The processor is used to execute the computer program so that the electronic device can implement the log anomaly detection method of the first aspect or any implementation manner of the first aspect.

[0034] In a fifth aspect, the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the log anomaly detection method of the above-mentioned first aspect or any implementation method of the first aspect.

[0035] By means of the above technical scheme, the log anomaly detection method and related devices provided by the present application pre-train the iterative expansion convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model. On the one hand, rich features can be extracted through the attention mechanism, and at the same time, the iterative expansion convolutional neural network is used to capture higher-level and more abstract features, so that the classifier can more accurately classify whether the log is abnormal. For the target log to be detected, its anomaly detection result can be effectively obtained through the log anomaly detection model. Based on the present invention, log anomaly detection can be made more accurate, providing an effective basis for subsequent log warnings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0037] Figure 1 A method flow chart of a log anomaly detection method provided by this application;

[0038] Figure 2 A partial flow chart of a log anomaly detection method provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the structure of the log anomaly detection model provided in the embodiment of the present application;

[0040] Figure 4 A schematic diagram of another part of the flow chart of a log anomaly detection method provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of another part of the flow chart of a log anomaly detection method provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of another part of the flow chart of a log anomaly detection method provided in an embodiment of the present application;

[0043] Figure 7 A schematic diagram of the structure of a log anomaly detection device provided in an embodiment of the present application;

[0044] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0046] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0047] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0048] In order to effectively detect anomalies in logs, an embodiment of the present application provides a method for detecting anomalies in logs. The method for detecting anomalies in logs in an embodiment of the present application is described in detail below in conjunction with the accompanying drawings.

[0049] See also Figure 1 , Figure 1 A flow chart of a log anomaly detection method provided in an embodiment of the present application. Figure 1 As shown, the log anomaly detection method provided in the embodiment of the present application may include steps S101 to S103, and these steps are described in detail below.

[0050] S101, obtaining a target log to be detected.

[0051] S102, retrieve a log anomaly detection model, where the log anomaly detection model is obtained by pre-training an iteratively expanded convolutional neural network and a classifier based on an attention mechanism.

[0052] S103, inputting the target log into the log anomaly detection model to obtain an anomaly detection result of the target log output by the log anomaly detection model.

[0053] In the embodiment of the present application, the target log is the log to be detected, which can be the log generated in real time when the system is running. The log anomaly detection model is obtained by pre-training the iterative expansion convolutional neural network and the classifier based on the attention mechanism. This is because the attention mechanism can extract rich features, and the iterative expansion convolutional neural network is used to capture higher-level and more abstract features, so that the classifier can more accurately classify whether the log is abnormal.

[0054] Therefore, for the log anomaly detection model, the features of the target log can be extracted based on the attention mechanism combined with the iterative expansion convolutional neural network, and then the extracted features can be classified by the classifier to obtain the anomaly detection result of the target log, so as to determine whether the target log has an abnormality.

[0055] See also Figure 2 , Figure 2 A partial flow chart of a log anomaly detection method provided in an embodiment of the present application. Figure 2 As shown, the process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model may include steps S201 to S207, and these steps are described in detail below.

[0056] S201, obtaining sample logs to be trained and training labels of the sample logs.

[0057] S202: Input the sample log into the BERT pre-trained language model to obtain the first feature vector output by the BERT pre-trained language model.

[0058] S203: Process the first eigenvector based on the attention mechanism to obtain a second eigenvector.

[0059] S204, input the second eigenvector into the iterative dilated convolutional neural network to obtain a third eigenvector output by the iterative dilated convolutional neural network.

[0060] S205: Input the third feature vector into the classifier to obtain an anomaly detection result of the sample log output by the classifier.

[0061] S206: Calculate the cross entropy loss function value based on the anomaly detection result of the sample log and the training label.

[0062] S207, if the gradient value of the cross entropy loss function value does not meet the preset convergence condition, adjust the weight parameters of the BERT pre-trained language model, the iterative expansion convolutional neural network and the classifier, and return to execute step S201 until the gradient value of the cross entropy loss function value meets the convergence condition to end the training and obtain the log anomaly detection model.

[0063] In the embodiment of the present application, the log used for training is used as a sample log to obtain its training label, and the training label includes a first label representing that the log is abnormal and a second label representing that the log is normal.

[0064] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of the log anomaly detection model provided in the embodiment of the present application. Figure 3As shown, the sample log is input into the BERT (Bidirectional Encoder Representation from Transformers) pre-trained language model. For a given sample log Get the input representation through the input layer ,in, , is the word embedding representation of the sample log, Embedding representation for the segments of sample logs, Embedding representation for the location of sample logs, Indicates the [CLS] tag, Indicates the [SEP] mark, enter the Input into the BERT pre-trained language model to obtain feature representation , the acquisition process is expressed as .

[0065] Therefore, the sample log can obtain the corresponding feature vector after the BERT pre-trained language model, that is, the first feature vector, expressed as Based on the attention mechanism, the first feature vector is input into the self-attention mechanism layer to obtain the corresponding feature vector, that is, the second feature vector. In practical applications, in order to obtain deeper features, the multi-head attention mechanism can be used to process the first feature vector. Figure 4 , Figure 4 Another partial flow chart of a log anomaly detection method provided in an embodiment of the present application. Figure 4 As shown, step S203 may adopt the following steps:

[0066] S2031, process the first eigenvector based on the multi-head attention mechanism.

[0067] In the embodiment of the present application, based on the multi-head attention mechanism, the first eigenvector can be input into the multi-head attention mechanism layer. Specifically, the multi-head attention mechanism layer is composed of multiple self-attention mechanism layers, and the first eigenvector is passed to different self-attention mechanism layers respectively, and then the output results of the multiple self-attention mechanism layers are spliced. When splicing, each attention mechanism layer has a corresponding weight matrix, and the splicing result is passed to the linear layer to obtain the final output result, that is, the second eigenvector.

[0068] Furthermore, the second eigenvector is input into the iterative dilated convolutional neural network (IDCNN) to capture higher-level and more abstract features and obtain the corresponding eigenvector, i.e., the third eigenvector, expressed as Specifically, multiple iterative unit neural networks with the same structure are connected together to form an iterative dilated convolutional neural network. The training output result of the first iterative unit neural network is used as the input representation of the next iterative unit neural network. The training parameters used by the iterative unit neural network in each iteration are consistent. A single iterative unit neural network contains dilated convolutional neural networks with different dilation rates. The structure of the iterative dilated convolutional neural network can extract features with richer meanings than ordinary convolutional neural networks.

[0069] Furthermore, the third feature vector is input into the classifier, and the third feature vector is classified and processed by the classifier to obtain the predicted anomaly detection result of the sample log. According to the anomaly detection result of the sample log and the training label of the sample log, the cross entropy loss function value of this training is calculated. The purpose is to make the cross entropy loss function value meet the convergence condition and reach the minimum value. If the cross entropy loss function value does not meet the convergence condition, the weight parameters of the BERT pre-trained language model, the iterative expansion convolutional neural network and the classifier are adjusted, and the next training is performed by returning to step S201 until the cross entropy loss function value meets the convergence condition and the training is terminated to obtain the log anomaly detection model.

[0070] In practical applications, in order to effectively prevent network degradation and loss of underlying features, a residual network is introduced to directly transfer the features learned by the underlying network to the high-level network, that is, to directly transfer the output of the BERT pre-trained language model to the high-level network. This form of skip-layer connection allows the network layer behind the model to learn the residual, which is helpful for solving the problem of network degradation. In addition, in the process of transferring the underlying features to the high-level model, there will be problems such as loss and loss of the underlying features. Using skip-layer connections to directly transfer the underlying features to the high-level model is helpful for retaining the underlying features.

[0071] See also Figure 5 , Figure 5 Another partial flow chart of a log anomaly detection method provided in an embodiment of the present application. Figure 5 In step S205, "inputting the third feature vector into the classifier" can be performed by the following steps:

[0072] S2051, by skip-connecting the BERT pre-trained language model and the iterative dilated convolutional neural network, the third feature vector and the first feature vector are simultaneously input into the classifier.

[0073] In the embodiment of the present application, the residual network is used to avoid gradient disappearance, thereby obtaining higher-level features with contextual information.

[0074] The BERT pre-trained language model is skip-connected with the iterative dilated convolutional neural network, and the third feature vector is concatenated with the first feature vector to obtain the final feature representation. , which is input into the classifier, and the classifier makes classification predictions for the sample logs based on this.

[0075] In addition, adversarial training can be added during the training process to improve the generalization ability of the model and achieve accurate log anomaly detection. Figure 6 , Figure 6 Another partial flow chart of a log anomaly detection method provided in an embodiment of the present application. Figure 6 As shown in FIG. 1 , the process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model also includes the following steps:

[0076] S208, calculating the adversarial perturbation value according to the cross entropy loss function value and the sample log; processing the sample log according to the adversarial perturbation value, and returning to execute step S202.

[0077] In an embodiment of the present application, in order to effectively enhance the generalization ability of the model, adversarial training is introduced, that is, a subtle adversarial perturbation value is added to each word in the output layer of the BERT pre-trained language model to form an adversarial sample, which is used for specified training.

[0078] First, the model needs to obtain the initial cross entropy loss function value of the forward propagation based on the input sample log, and then back-propagate to obtain the original gradient of the model parameters, that is, calculate the gradient of the input layer parameters of the BERT pre-trained language model, and calculate the adversarial perturbation value based on the gradient through the L2 norm.

[0079] After adding the adversarial perturbation value to the input layer parameters of the BERT pre-trained language model, the cross entropy loss function value is calculated again and back-propagated to obtain the gradient of the adversarial sample on the parameters of this log anomaly detection model. The gradient calculated by the adversarial sample is added to the original gradient to update the model parameters. After completing an iteration of adversarial training, the input layer parameters of the BERT pre-trained language model are restored.

[0080] Through the above description, the log anomaly detection method provided by the embodiment of the present application, the BERT pre-trained language model has been trained on large-scale text data, has better generalization ability, can perform well on smaller-scale labeled data, and can reduce the demand for computing resources. The BERT pre-trained language model can process inputs in parallel through the self-attention mechanism, thereby improving computing efficiency and thus improving the performance of log anomaly detection. The iterative expansion convolutional neural network can not only encode information of different sequence lengths, but also extract higher-level and more abstract features through continuous iterations, so as to capture a wider range of contextual information. At the same time, adversarial training is used to improve the generalization ability of the model.

[0081] A log anomaly detection method provided in an embodiment of the present application is introduced above. The following will introduce a device for executing the above log anomaly detection method.

[0082] See also Figure 7 , Figure 7 This is a schematic diagram of the structure of the log anomaly detection device provided in the embodiment of the present application. Figure 7 As shown, the log anomaly detection device includes:

[0083] A model training module 10 is used to train an iterative expansion convolutional neural network and a classifier based on an attention mechanism to obtain a log anomaly detection model;

[0084] The log acquisition module 20 is used to acquire the target log to be detected;

[0085] The log detection module 30 is used to retrieve the log anomaly detection model; input the target log into the log anomaly detection model, and obtain the anomaly detection result of the target log output by the log anomaly detection model.

[0086] In a possible implementation, the model training module 10 is specifically used to:

[0087] The method comprises the following steps: obtaining a sample log to be trained and a training label of the sample log; inputting the sample log into a BERT pre-trained language model to obtain a first feature vector output by the BERT pre-trained language model; processing the first feature vector based on an attention mechanism to obtain a second feature vector; inputting the second feature vector into an iterative expansion convolutional neural network to obtain a third feature vector output by the iterative expansion convolutional neural network; inputting the third feature vector into a classifier to obtain an anomaly detection result of the sample log output by the classifier; calculating a cross entropy loss function value according to the anomaly detection result and the training label of the sample log; if the gradient value of the cross entropy loss function value does not meet a preset convergence condition, adjusting the weight parameters of the BERT pre-trained language model, the iterative expansion convolutional neural network and the classifier respectively, and returning to execute the step of obtaining the sample log to be trained and the training label of the sample log, until the gradient value of the cross entropy loss function value meets the convergence condition to terminate the training and obtain the log anomaly detection model.

[0088] In a possible implementation, the model training module 10 for processing the first feature vector based on the attention mechanism is specifically used to:

[0089] The first eigenvector is processed based on the multi-head attention mechanism.

[0090] In a possible implementation, the model training module 10 for inputting the third feature vector into the classifier is specifically used for:

[0091] By performing skip-layer connection between the BERT pre-trained language model and the iterative dilated convolutional neural network, the third feature vector and the first feature vector are simultaneously input into the classifier.

[0092] In a possible implementation, the model training module 10 is further used to:

[0093] Calculate the adversarial perturbation value based on the cross entropy loss function value and the sample log; process the sample log according to the adversarial perturbation value, and return to execute the step of inputting the sample log into the BERT pre-trained language model.

[0094] It should be noted that the detailed functions of each module in the embodiment of the present application can be found in the corresponding public part of the above-mentioned log anomaly detection method embodiment, and will not be repeated here.

[0095] The present application also provides an electronic device in an embodiment. Figure 8 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 8The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0096] like Figure 8 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 to a random access memory (RAM) 803. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0097] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a memory card, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0098] An embodiment of the present application also provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any log anomaly detection method provided in the embodiment of the present application.

[0099] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any log anomaly detection method provided in an embodiment of the present application.

[0100] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0101] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0102] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0103] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A log anomaly detection method, characterized in that: include: Get the target log to be detected; Retrieving a log anomaly detection model, where the log anomaly detection model is obtained by pre-training an iteratively expanded convolutional neural network and a classifier based on an attention mechanism; The target log is input into the log anomaly detection model to obtain an anomaly detection result of the target log output by the log anomaly detection model.

2. The log anomaly detection method according to claim 1, characterized in that: The process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model includes: Obtaining sample logs to be trained and training labels of the sample logs; Inputting the sample log into a BERT pre-trained language model to obtain a first feature vector output by the BERT pre-trained language model; Processing the first feature vector based on the attention mechanism to obtain a second feature vector; Inputting the second eigenvector into the iterative dilated convolutional neural network to obtain a third eigenvector output by the iterative dilated convolutional neural network; Inputting the third feature vector into the classifier to obtain an anomaly detection result of the sample log output by the classifier; Calculate the cross entropy loss function value according to the anomaly detection result and the training label of the sample log; If the gradient value of the cross entropy loss function value does not meet the preset convergence condition, adjust the weight parameters of the BERT pre-trained language model, the iterative dilated convolutional neural network and the classifier, and return to execute the step of obtaining the sample log to be trained and the training label of the sample log until the gradient value of the cross entropy loss function value meets the convergence condition, and terminate the training to obtain the log anomaly detection model.

3. The log anomaly detection method according to claim 2, characterized in that: The processing of the first feature vector based on the attention mechanism includes: The first feature vector is processed based on a multi-head attention mechanism.

4. The log anomaly detection method according to claim 2, characterized in that: The step of inputting the third feature vector into the classifier comprises: By performing a skip-layer connection between the BERT pre-trained language model and the iterative dilated convolutional neural network, the third feature vector and the first feature vector are simultaneously input into the classifier.

5. The log anomaly detection method according to claim 2, characterized in that: The process of pre-training the iterative dilated convolutional neural network and the classifier based on the attention mechanism to obtain the log anomaly detection model also includes: Calculating an adversarial perturbation value according to the cross entropy loss function value and the sample log; The sample log is processed according to the adversarial perturbation value, and the step of inputting the sample log into the BERT pre-trained language model is returned to be executed.

6. A log anomaly detection device, characterized in that: include: Model training module, used to train iteratively expanded convolutional neural network and classifier based on attention mechanism to obtain log anomaly detection model; The log acquisition module is used to obtain the target log to be detected; The log detection module is used to call the log anomaly detection model; input the target log into the log anomaly detection model, and obtain the anomaly detection result of the target log output by the log anomaly detection model.

7. The log anomaly detection device according to claim 6, characterized in that: The model training module is specifically used for: Obtain a sample log to be trained and a training label of the sample log; input the sample log into a BERT pre-trained language model to obtain a first feature vector output by the BERT pre-trained language model; process the first feature vector based on the attention mechanism to obtain a second feature vector; input the second feature vector into the iterative expansion convolutional neural network to obtain a third feature vector output by the iterative expansion convolutional neural network; input the third feature vector into the classifier to obtain an anomaly detection result of the sample log output by the classifier; calculate a cross entropy loss function value based on the anomaly detection result of the sample log and the training label; if the gradient value of the cross entropy loss function value does not meet a preset convergence condition, adjust the weight parameters of the BERT pre-trained language model, the iterative expansion convolutional neural network and the classifier respectively, and return to execute the step of obtaining the sample log to be trained and the training label of the sample log until the gradient value of the cross entropy loss function value meets the convergence condition to terminate the training and obtain the log anomaly detection model.

8. A computer program product, characterized in that The method comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the log anomaly detection method as claimed in any one of claims 1 to 5.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the log anomaly detection method as described in any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the log anomaly detection method as described in any one of claims 1 to 5.

Images