Log anomaly detection method and system based on multi-dimensional features and GCN-ATTN

Abstract

The invention discloses a log anomaly detection method and system based on multi-dimensional features and GCN-ATTN, and relates to the technical field of network security, and the method comprises the following steps: obtaining a log template word list, carrying out log analysis on the log template word list based on a dictionary tree to obtain a log template statement, carrying out initialization template semantic coding on the log template statement based on the word list, and obtaining the log template statement; obtaining an initialized template semantic coding result; inputting the initialized template semantic coding result into a pre-constructed multi-dimensional feature extraction layer, extracting component interaction features and log variable features based on a GCN network, and extracting template semantic features based on an encoder constructed by an embedded presentation layer; and inputting the component interaction features, the log variable features and the template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and outputting to obtain a log anomaly detection result.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a log anomaly detection method and system based on multidimensional features and GCN-ATTN. Background Art

[0002] Log anomaly detection is an important auxiliary method for automated system operation and maintenance. In large-scale distributed systems, logs record the operating status and interaction information of each component. Log data not only contains component interaction information, but also involves multi-dimensional features such as various types of operations, alarms, and numerical variables. This information plays a vital role in anomaly detection.

[0003] At present, most technical solutions in the field of log anomaly detection use log key sequences after template parsing as features. Although the semantic features of log statements are introduced in combination with relevant research on NLP, the utilization rate of log variable parameters is not high. Summary of the invention

[0004] In order to solve the deficiencies mentioned in the above background technology, the purpose of the present invention is to provide a log anomaly detection method and system based on multidimensional features and GCN-ATTN.

[0005] In a first aspect, the purpose of the present invention can be achieved by the following technical solution: a log anomaly detection method based on multidimensional features and GCN-ATTN, the method comprising the following steps:

[0006] Obtain a log template vocabulary, perform log parsing on the log template vocabulary based on the dictionary tree to obtain a log template statement, perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result;

[0007] The original log template statement sequence and the initialization template semantic encoding results are input into the pre-built multi-dimensional feature extraction layer. The component interaction features and log variable features are extracted from the original log template statement sequence based on the GCN network. The encoder built based on the embedding representation layer extracts the template semantic features from the initialization template semantic encoding results.

[0008] The component interaction features, log variable features and template semantic features are input into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and the log anomaly detection results are output.

[0009] In combination with the first aspect, in some implementations of the first aspect, the method further includes: encoding the out-of-vocabulary words in the log template vocabulary is performed by an oov representation method that integrates contextual relationships, and the process is as follows:

[0010] Log parsing combines the component modules and timestamps that appear in the original log statements to calculate POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1):

[0011]

[0012] Where j is the k positions before and after the word oov in the original log statement, where k is the specified parameter. If there are less than k positions before and after oov, the missing position is encoded as E j The calculation adopts the mean filling method; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever an oov word is encountered, t i is the timestamp of the log containing the word oov, t i-1 Is the timestamp of the last log.

[0013] In combination with the first aspect, in some implementations of the first aspect, the method further includes: extracting the component interaction feature as follows:

[0014] Component interaction features include the interaction adjacency matrix A C and the behavioral feature matrix X C , A C Elements in It represents the component interaction strength, and is calculated as shown in formula (2):

[0015]

[0016] in, is the interaction count between components c1 and c2; X C The behavior feature matrix is ​​constructed based on regular expressions to identify the alarm type and operation type of the log. The number of occurrences of components in different alarm types: INFO, WARN, ERROR, and different operation types within a fixed time window is counted. The behavior feature matrix of all nodes in the fixed window is constructed and compared with A C As the input of GCN, each component node feature output is matched and concatenated with the first component appearing in the log entry.

[0017] In combination with the first aspect, in some implementations of the first aspect, the method further includes: a process of extracting the log variable feature:

[0018] The log variable feature involves log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v, if the log entry templates in the current time window are inconsistent, the adjacency matrix A L The elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1, and non-adjacent ones are recorded as 0. If there are identical templates, the element values ​​between log entries with the same template are set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entry of non-adjacent relations is calculated according to formula (3):

[0019]

[0020] in, Refers to the path to other entries in l1 Position in; X v To record the characteristics of numerical variables.

[0021] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows:

[0022] The GCN output of the log component interaction features and the numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concatenated to obtain the fused feature representation Z, where the embedded representation layer of the log key sequence and the log template semantic encoding do not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively:

[0023]

[0024] Among them, [tmp t ] is the encoding vector of the log template obtained by parsing the log entry and output by the pre-trained text embedding model, and [l t ] The log entries pointed to by the log keys in the .

[0025] After the fused features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. The process is shown in formulas (6) to (11):

[0026] H attn =MultiHeadAttn(Z) (6)

[0027] H fc =ReLU(H attn W fc +b fc ) (7)

[0028] H fc =H fc +Hattn (8)

[0029] H linear =H fc H linear +b linear (9)

[0030] H linear =H linear +H fc (10)

[0031] H o =softmax(H linear ) (11).

[0032] In combination with the first aspect, in some implementations of the first aspect, the method further includes: combining a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, after training based on an existing label data set, embedding a representation layer parameter based on the trained template semantics Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12):

[0033]

[0034] Among them [BERT j ] is the initialization encoding of the in-vocabulary words around the oov word, and the encoding model is based on the context-aware pre-trained text embedding model.

[0035] In combination with the first aspect, in some implementations of the first aspect, the method further includes: inputting the component interaction features, log variable features, and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and outputting a log anomaly detection result:

[0036] The online log anomaly detection method based on weighted voting includes GCN-ATTN cluster construction and model node contribution calculation:

[0037] Divide the labeled log training set D according to the timestamp and log data volume of the log. Assume that the difference in timestamps in the initial GCN-ATTN model node training set is ΔT, and the difference in timestamps in each newly added training set is ΔT. If there is a training set larger than 2*ΔN, slide the timestamp by Δt in the newly added data set, with a window size of ΔN, re-divide the training set, and train GCN-ATTN separately. Take one or more newly added model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp.

[0038] Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

[0039]

[0040] In combination with the first aspect, in some implementations of the first aspect, the method further includes: a method for updating the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN:

[0041] When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14):

[0042]

[0043] in is the maximum importance of the nodes in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sorting is performed, the lowest model node is deleted, and the child node with the highest importance replaces the current node.

[0044] In a second aspect, in order to achieve the above-mentioned object, the present invention discloses a log anomaly detection system based on multidimensional features and GCN-ATTN, comprising:

[0045] A semantic coding module is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree, obtain a log template statement, and perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result;

[0046] The feature extraction module is used to input the original log template sentence sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer, extract component interaction features and log variable features from the original log template sentence sequence based on the GCN network, and extract template semantic features from the initialization template semantic encoding result based on the encoder built on the embedding representation layer;

[0047] The anomaly detection module is used to input component interaction features, log variable features and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection results.

[0048] In another aspect of the present invention, in order to achieve the above-mentioned purpose, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the memory stores a computer program capable of running on the processor, and when the processor loads and executes the computer program, a log anomaly detection method based on multidimensional features and GCN-ATTN as described above is adopted.

[0049] Beneficial effects of the present invention:

[0050] The present invention combines graph convolutional neural networks to extract the interaction and sequence relationship features between different components of the system, and constructs an adjacency matrix based on the correspondence between log templates and log key sequences. It uses numerical and character variables in log data to enrich the feature dimensions of log entries, and splices them with template semantics to improve the information utilization rate of original log data and enhance the feature expression of log entries, thereby improving the accuracy and robustness of log anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 It is a schematic flow chart of the method of the present invention;

[0053] Figure 2 It is a schematic diagram of the workflow of the present invention;

[0054] Figure 3 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Embodiment 1:

[0057] The following is an introduction to the relevant terms involved in the embodiments of the present application:

[0058] Component interaction adjacency matrix: Log statements usually record the operation information of a module or a function, including the interaction with other modules or functions. The present invention defines three types of component interaction relationships, namely: different components appear in a single log statement, different components operate on the same resource in the same time window, and log statements of different components appear together in the same time window. The component interaction adjacency matrix records the existence of the above interaction relationships and assigns different interaction relationships as edge weights.

[0059] Log entry adjacency matrix: a matrix structure that represents the sequence relationship of log entries. The construction of this matrix needs to be parsed by log templates and is used to analyze the direct adjacent relationship and template association relationship between log entries. The log entries here are different from log keys. Even if the log templates or even statements are the same, but the sequence positions are different, they are still considered different log entries. The template association relationship is a supplement to the direct adjacent relationship of log entries. There are edges between log entries of the same template, and the weights of multiple edges are determined based on the path position after traversal.

[0060] like Figure 1 As shown, a log anomaly detection method based on multidimensional features and GCN-ATTN includes the following steps:

[0061] S101: Obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree to obtain a log template statement, and perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result;

[0062] Initializing the semantic encoding of the log online template requires combining the component modules and timestamps that appear in the original log statement to calculate the POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1):

[0063]

[0064] Where j is the k positions before and after the word oov in the original log sentence (a total of 2k positions) and k is a specified parameter. The actual situation should be set in combination with the statistical characteristics of the length of the log sentence. If there are less than k positions before and after oov, the missing code E j The calculation can be done by using methods such as mean filling; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever an oov word is encountered, t i is the timestamp of the log containing the word oov, t i-1 It is the timestamp of the previous log. The two need to be converted to seconds or milliseconds before calculation.

[0065] Specifically, the model startup methods are divided into offline training mode and online detection mode. In the offline training mode, a log template vocabulary is constructed, and log parsing is performed based on the dictionary tree. The log template sentences in the vocabulary are initialized with template semantic encoding based on the vocabulary; in the online detection mode, when initializing the template semantic encoding, for out-of-vocabulary words, an out-of-vocabulary word encoding processing method that integrates contextual relationships is adopted. The drain parser is mainly used for offline and online template parsing.

[0066] S102: Inputting the original log template sentence sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer, extracting component interaction features and log variable features from the original log template sentence sequence based on the GCN network, and extracting template semantic features from the initialization template semantic encoding result based on the encoder built on the embedding representation layer;

[0067] Component interaction features include the interaction adjacency matrix A C and the behavioral feature matrix X C , A C Elements in It represents the component interaction strength, and its calculation method is shown in formula (2):

[0068]

[0069] in, is the interaction count between components c1 and c2. The log sequences that appear once together in a fixed time window are weak interactions. Incremented by 0.2, appearing together in the same log statement is a medium interaction, Increment by 0.5. Operations on the same resource in a log statement are considered strong interactions. Incremented by 1, the interaction count values ​​of different types are prior parameters; X C The behavior feature matrix is ​​constructed by identifying the alarm type and operation type of the log based on regular expressions, counting the number of occurrences of components in different alarm types (INFO, WARN, ERROR, etc.) and different operation types (file operation, request operation, etc.) within a fixed time window, and constructing the behavior feature matrix of all nodes under the fixed window. C As the input of GCN, each component node feature output is matched and concatenated with the first component appearing in the log entry.

[0070] The log variable feature involves log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v , if the log entry templates in the current time window are inconsistent, the adjacency matrix A LThe elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1, and non-adjacent ones are recorded as 0. If there is an identical template, the element value between log entries with the same template is set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entry of non-adjacent relations is calculated according to formula (3)

[0071]

[0072] in, Refers to the path to other entries in l1 Position in

[0073] X v Record the characteristics of numerical variables. The numerical types include data block size, number of replicas, disk usage, operation time, file size, etc. The original values ​​need to be normalized. Log entries without numerical variables are filled with the mean of the numerical variable characteristics under this window.

[0074] S103: Input component interaction features, log variable features, and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection result.

[0075] The construction of the multi-dimensional feature fusion anomaly detection model GCN-ATTN mainly includes:

[0076] The GCN output of the obtained log component interaction features and numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concatenated to obtain the fused feature representation Z, where the embedded representation layer of the log key sequence and the log template semantic encoding do not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively:

[0077]

[0078] Among them, [tmp t ] is the encoding vector of the log template obtained by parsing the log entry and output by the pre-trained text embedding model, and [l t ] The log entries pointed to by the log keys in the .

[0079] After the fused features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. For the specific process, see formula (6) to formula (11):

[0080] H attn =MultiHeadAttn(Z) (20)

[0081] H fc =ReLU(H attn W fc +b fc ) (twenty one)

[0082] H fc =H fc +H attn (twenty two)

[0083] H linear =H fc H linear +b linear (twenty three)

[0084] H linear =H linear +H fc (twenty four)

[0085] H o =softmax(H linear ) (25)

[0086] In offline mode, the cross entropy function is combined with the Adam optimizer to complete model training.

[0087] In online mode, during online template parsing and semantic encoding initialization, the out-of-vocabulary word encoding needs to be combined with the trained embedding representation layer parameters and the pre-trained text embedding model, mainly including:

[0088] Combined with the anomaly detection model GCN-ATTN, after training on the existing labeled dataset, the parameters of the representation layer are embedded based on the trained template semantics Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12):

[0089]

[0090] Among them [BERT j ] is the initialization encoding of the words in the vocabulary around the oov word, and the encoding model can be a pre-trained text embedding model based on context awareness.

[0091] During the online detection of the anomaly detection model, the training set and detection model are updated regularly, a tree-shaped GCN-ATTN cluster is constructed, online anomaly detection of logs is performed based on weighted voting integration, and the importance is calculated to achieve cluster optimization.

[0092] The steps for building the GCN-ATTN cluster and calculating the contribution of model nodes are as follows:

[0093] Divide the labeled log training set D according to the timestamp and log data volume of the log. Assume that the difference in timestamps (converted to seconds or milliseconds) in the initial GCN-ATTN model node training set is ΔT, and the difference in timestamps of each newly added training set is ΔT. If there is a training set with a size exceeding 2*ΔN, slide the timestamp by Δt in the newly added data set, with a window size of ΔN, re-divide the training set, and train the GCN-ATTN model separately. Take one or more newly added model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp.

[0094] Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

[0095]

[0096] The model online updating method in step S4 mainly includes:

[0097] When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14):

[0098]

[0099] in is the maximum importance of the nodes in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sorting is performed, the lowest model node is deleted, and the child node with the highest importance replaces the current node, thereby achieving cluster optimization and reducing redundancy.

[0100] Embodiment 2: In the second aspect, as Figure 3 As shown, in order to achieve the above purpose, the present invention discloses a log anomaly detection system based on multidimensional features and GCN-ATTN, including:

[0101] The semantic coding module 11 is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree, obtain a log template statement, and perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result;

[0102] The feature extraction module 12 is used to input the original log template sentence sequence and the initialization template semantic encoding result into a pre-built multi-dimensional feature extraction layer, extract component interaction features and log variable features from the original log template sentence sequence based on the GCN network, and extract template semantic features from the initialization template semantic encoding result based on the encoder built on the embedding representation layer;

[0103] The anomaly detection module 13 is used to input component interaction features, log variable features and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection result.

[0104] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors, and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, specifically for loading and executing one or more instructions in a computer storage medium to implement the above method.

[0105] It needs to be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium, on which a computer program is stored, and the computer program is executed by a processor to execute the above method. The storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0106] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0107] The above shows and describes the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present disclosure. Without departing from the spirit and scope of the present disclosure, the present disclosure may have various changes and improvements, and these changes and improvements fall within the scope of the present disclosure to be protected.

Claims

1. A log anomaly detection method based on multidimensional features and GCN-ATTN, characterized in that: The method comprises the following steps: Obtain a log template vocabulary, perform log parsing on the log template vocabulary based on the dictionary tree to obtain a log template statement, perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result; The original log template statement sequence and the initialization template semantic encoding results are input into the pre-built multi-dimensional feature extraction layer. The component interaction features and log variable features are extracted from the original log template statement sequence based on the GCN network. The encoder built based on the embedding representation layer extracts the template semantic features from the initialization template semantic encoding results. The component interaction features, log variable features and template semantic features are input into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and the log anomaly detection results are output.

2. According to claim 1, a log anomaly detection method based on multidimensional features and GCN-ATTN is characterized in that: The out-of-vocabulary word encoding process in the log template vocabulary is performed by the oov representation method integrating the context relationship, and the process is as follows: Log parsing combines the component modules and timestamps that appear in the original log statements to calculate POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1): Where j is the k positions before and after the word oov in the original log statement, where k is the specified parameter. If there are less than k positions before and after oov, the missing position is encoded as E j The calculation adopts the mean filling method; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever an oov word is encountered, t i is the timestamp of the log containing the word oov, t i-1 Is the timestamp of the last log.

3. According to claim 1, a log anomaly detection method based on multidimensional features and GCN-ATTN is characterized in that: The extraction of the component interaction features is as follows: Component interaction features include the interaction adjacency matrix A C and the behavioral feature matrix X C , A C Elements in It represents the component interaction strength, and is calculated as shown in formula (2): in, is the interaction count between components c1 and c2; X C The behavior feature matrix is ​​constructed based on regular expressions to identify the alarm type and operation type of the log. The number of occurrences of components in different alarm types: INFO, WARN, ERROR, and different operation types within a fixed time window is counted. The behavior feature matrix of all nodes in the fixed window is constructed and compared with A C As the input of GCN, each component node feature output is matched and concatenated with the first component appearing in the log entry.

4. According to claim 1, a log anomaly detection method based on multidimensional features and GCN-ATTN is characterized in that: The process of extracting the log variable features: The log variable feature involves log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v , if the log entry templates in the current time window are inconsistent, the adjacency matrix A L The elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1, and non-adjacent ones are recorded as 0. If there are identical templates, the element values ​​between log entries with the same template are set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entry of non-adjacent relations is calculated according to formula (3): in, Refers to the path to other entries in l1 Position in; X v To record the characteristics of numerical variables.

5. According to claim 1, a log anomaly detection method based on multidimensional features and GCN-ATTN is characterized in that: The pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows: The GCN output of the log component interaction features and the numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concatenated to obtain the fused feature representation Z, where the embedded representation layer of the log key sequence and the log template semantic encoding do not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively: Among them, [tmp t ] is the encoding vector of the log template obtained by parsing the log entry and output by the pre-trained text embedding model, and [l t ] The log entries pointed to by the log keys in the . After the fused features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. The process is shown in formulas (6) to (11): H attn =MultiHeadAttn(Z) (6) A fc =ReLU(H attn W fc +b fc ) (7) H fc =H fc +H attn (8) H linear =H fc H linear +b linear (9) H linear =H linear +H fc (10) H o =softmax(H linear ) (11)。 6. According to claim 5, a log anomaly detection method based on multidimensional features and GCN-ATTN is characterized in that: Combined with the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, after training based on the existing label data set, the parameters of the representation layer are embedded based on the trained template semantics Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12): Among them [BERT j ] is the initialization encoding of the in-vocabulary words around the oov word, and the encoding model is based on the context-aware pre-trained text embedding model.

7. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 1 is characterized in that: The process of inputting component interaction features, log variable features and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and outputting the log anomaly detection results: The online log anomaly detection method based on weighted voting includes GCN-ATTN cluster construction and model node contribution calculation: Divide the labeled log training set D according to the timestamp and log data volume of the log. Assume that the difference in timestamps in the initial GCN-ATTN model node training set is ΔT, and the difference in timestamps in each newly added training set is ΔT. If there is a training set larger than 2*ΔN, slide the timestamp by Δt in the newly added data set, with a window size of ΔN, re-divide the training set, and train GCN-ATTN separately. Take one or more newly added model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp. Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

8. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 6 is characterized in that: The updating method of the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows: When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14): in is the maximum importance of the nodes in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sorting is performed, the lowest model node is deleted, and the child node with the highest importance replaces the current node.

9. A log anomaly detection system based on multidimensional features and GCN-ATTN, characterized in that: include: A semantic coding module is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree, obtain a log template statement, and perform initialization template semantic coding on the log template statement based on the vocabulary to obtain an initialization template semantic coding result; The feature extraction module is used to input the original log template sentence sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer, extract component interaction features and log variable features from the original log template sentence sequence based on the GCN network, and extract template semantic features from the initialization template semantic encoding result based on the encoder built on the embedding representation layer; The anomaly detection module is used to input component interaction features, log variable features and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection results.

10. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: The memory stores a computer program that can be run on the processor. When the processor loads and executes the computer program, a log anomaly detection method based on multidimensional features and GCN-ATTN according to any one of claims 1 to 8 is adopted.

Images