A log anomaly detection method and system based on multi-dimensional features and GCN-ATTN

Abstract

The application discloses a log anomaly detection method and system based on multidimensional features and GCN-ATTN, relates to the technical field of network security, and comprises the following steps: obtaining a log template word table, performing log analysis on the log template word table based on a dictionary tree to obtain a log template sentence, initializing template semantic coding based on the word table to obtain an initialization template semantic coding result; inputting the initialization template semantic coding result into a pre-constructed multidimensional feature extraction layer, extracting component interaction features and log variable features based on a GCN network, and extracting template semantic features based on an encoder constructed based on an embedding representation layer; inputting the component interaction features, the log variable features and the template semantic features into a pre-established multidimensional feature fusion anomaly detection model GCN-ATTN, and outputting a log anomaly detection result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a log anomaly detection method and system based on multi-dimensional features and GCN-ATTN. BACKGROUND

[0002] Log anomaly detection is an important auxiliary method for automated system operation and maintenance. In large-scale distributed systems, logs record the running state and interaction information of each component. Log data not only contains component interaction information, but also involves multiple types of operations, alarms, and numerical variables, etc. These information plays a crucial role in anomaly detection.

[0003] Current technical solutions in the field of log anomaly detection mostly use log key sequences parsed by templates as features. Although related research combining NLP introduces semantic features of log statements, the utilization rate of log variable parameters is not high. SUMMARY

[0004] To solve the problems mentioned in the background, the purpose of the present application is to provide a log anomaly detection method and system based on multi-dimensional features and GCN-ATTN.

[0005] In the first aspect, the purpose of the present application can be achieved by the following technical solution: a log anomaly detection method based on multi-dimensional features and GCN-ATTN, the method comprising the following steps:

[0006] Obtaining a log template vocabulary, performing log parsing on the log template vocabulary based on a dictionary tree to obtain a log template sentence, initializing template semantic encoding based on the vocabulary to obtain an initialization template semantic encoding result;

[0007] Inputting the original log template sentence sequence and the initialization template semantic encoding result into a pre-constructed multi-dimensional feature extraction layer, extracting component interaction features and log variable features from the original log template sentence sequence based on a GCN network, and extracting template semantic features from the initialization template semantic encoding result based on an encoder constructed based on an embedding representation layer;

[0008] Inputting the component interaction features, log variable features, and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and outputting to obtain a log anomaly detection result.

[0009] In combination with the first aspect, in some implementations of the first aspect, the method further comprises: the out-of-vocabulary word encoding processing in the log template vocabulary is performed by an oov representation method that fuses context relationships, and the process is as follows:

[0010] Log parsing combines the component modules and timestamps that appear in the original log statement to calculate POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1):

[0011]

[0012] Where j is the k positions before and after the word oov in the original log statement, where k is the specified parameter. If there are less than k positions before and after oov, the missing code E j The calculation adopts the mean filling method; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever the word oov is encountered, t i is the timestamp of the log where the word oov is located, t i-1 The timestamp of the last log.

[0013] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: extracting the component interaction features as follows:

[0014] Component interaction features include the interaction adjacency matrix A C and behavioral feature matrix X C , A C Elements in It represents the component interaction strength, and is calculated as shown in formula (2):

[0015]

[0016] in, is the interaction count between components c1 and c2; X C The behavioral feature matrix is ​​constructed based on regular expressions to identify the alarm type and operation type of the log. The number of occurrences of components in different alarm types (INFO, WARN, ERROR) and different operation types within a fixed time window is counted. The behavioral feature matrix of all nodes in the fixed window is constructed and compared with A C As the input of GCN, the output node feature of each component is matched and concatenated with the first component appearing in the log entry.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: a process of extracting the log variable feature:

[0018] Log variable features involve log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v, if the log entry templates in the current time window are inconsistent, the adjacency matrix A L The elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1 and non-adjacent ones are recorded as 0. If there is an identical template, the element value between log entries with the same template is set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entries of non-adjacent relations is calculated according to formula (3):

[0019]

[0020] in, Refers to the path to other entries in l1 Position in; X v To record the characteristics of numerical variables.

[0021] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows:

[0022] The GCN output of the log component interaction features and the numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concatenated to obtain the fused feature representation Z. The embedded representation layer of the log key sequence and the log template semantic encoding does not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively:

[0023]

[0024] Among them, [tmp t ] is the encoding vector output by the pre-trained text embedding model of the log template obtained by parsing the log entry, and [l t ] The log entries pointed to by the log keys in the .

[0025] After the fused features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. The process is shown in formulas (6) to (11):

[0026] H attn =MultiHeadAttn(Z) (6)

[0027] H fc =ReLU(H attn W fc +b fc ) (7)

[0028] H fc =H fc +Hattn (8)

[0029] H linear =H fc H linear +b linear (9)

[0030] H linear =H linear +H fc (10)

[0031] H o =softmax(H linear ) (11).

[0032] In combination with the first aspect, in some implementations of the first aspect, the method further includes: combining a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, after training based on an existing label data set, embedding the representation layer parameters based on the trained template semantics Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12):

[0033]

[0034] Among them [BERT j ] is the initialization encoding of the in-vocabulary words around the oov word, and the encoding model is based on the context-aware pre-trained text embedding model.

[0035] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: inputting the component interaction features, log variable features, and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and outputting the log anomaly detection result:

[0036] The online log anomaly detection method based on weighted voting includes GCN-ATTN cluster construction and model node contribution calculation:

[0037] Divide the labeled log training set D according to the log timestamp and log data volume. Let the difference in timestamps in the initial GCN-ATTN model node training set be ΔT, and the difference in timestamps in each newly added training set be ΔT. If there is a training set larger than 2*ΔN, slide the timestamp by Δt in the newly added data set with a window size of ΔN, re-divide the training set, and train GCN-ATTN separately. Use one or more newly added model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp.

[0038] Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is automatically incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

[0039]

[0040] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: a method for updating the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN:

[0041] When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14):

[0042]

[0043] in is the maximum importance of the nodes in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sort by, delete the lowest model node, and replace the current node with the child node with the highest importance.

[0044] In a second aspect, in order to achieve the above-mentioned objectives, the present invention discloses a log anomaly detection system based on multidimensional features and GCN-ATTN, comprising:

[0045] A semantic encoding module is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree, obtain a log template statement, and perform initialization template semantic encoding on the log template statement based on the vocabulary to obtain an initialization template semantic encoding result;

[0046] The feature extraction module is used to input the original log template statement sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer. Based on the GCN network, the component interaction features and log variable features are extracted from the original log template statement sequence. The encoder built based on the embedding representation layer extracts template semantic features from the initialization template semantic encoding result.

[0047] The anomaly detection module is used to input component interaction features, log variable features, and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection results.

[0048] In another aspect of the present invention, in order to achieve the above-mentioned purpose, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores a computer program capable of running on the processor, and when the processor loads and executes the computer program, it adopts the log anomaly detection method based on multidimensional features and GCN-ATTN as described above.

[0049] Beneficial effects of the present invention:

[0050] The present invention combines graph convolutional neural networks to extract the interaction and sequence relationship features between different components of the system, and constructs an adjacency matrix based on the correspondence between log templates and log key sequences. It uses numerical and character variables in log data to enrich the feature dimensions of log entries and combines them with template semantics to improve the information utilization of original log data and enhance the feature expression of log entries, thereby improving the accuracy and robustness of log anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0052] Figure 1 It is a schematic flow chart of the method of the present invention;

[0053] Figure 2 It is a schematic diagram of the workflow of the present invention;

[0054] Figure 3 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0056] Example 1:

[0057] The following is an introduction to the relevant terms involved in the embodiments of this application:

[0058] Component Interaction Adjacency Matrix: Log statements typically record the operation information of a module or function, including interactions with other modules or functions. This paper defines three types of component interaction relationships: different components appearing in a single log statement, different components operating on the same resource within the same time window, and log statements from different components appearing together within the same time window. The component interaction adjacency matrix records the existence of these interaction relationships and assigns edge weights to each interaction relationship.

[0059] Log entry adjacency matrix: This matrix represents the sequence relationships of log entries. This matrix requires log template parsing to construct and analyze direct adjacency relationships and template association relationships between log entries. Log entries here are distinct from log keys. Even if the log template or even the statement is the same, the sequence position is different and they are still considered different log entries. Template association relationships complement direct adjacency relationships. Edges exist between log entries with the same template, and the weights of multiple edges are determined by the position of the traversed path.

[0060] like Figure 1 As shown, a log anomaly detection method based on multidimensional features and GCN-ATTN includes the following steps:

[0061] S101: Obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree to obtain a log template statement, perform initialization template semantic encoding on the log template statement based on the vocabulary to obtain an initialization template semantic encoding result;

[0062] Initializing the semantic encoding of the log online template requires combining the component modules and timestamps that appear in the original log statement to calculate the POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1):

[0063]

[0064] Where j is the k positions before and after the word oov in the original log sentence (a total of 2k positions) and k is a specified parameter. The actual situation should be set in combination with the statistical characteristics of the log sentence length. If there are less than k positions before and after oov, the missing code E j The calculation can be done by using methods such as mean filling; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever an oov word is encountered, t i is the timestamp of the log where the word oov is located, t i-1 The timestamp of the previous log must be converted to seconds or milliseconds before calculation.

[0065] Specifically, the model startup methods are divided into offline training mode and online detection mode. In the offline training mode, a log template vocabulary is constructed, and log parsing is performed based on the dictionary tree. The log template sentences in the vocabulary are initialized based on the vocabulary to perform template semantic encoding; in the online detection mode, when initializing the template semantic encoding, for out-of-vocabulary words, an out-of-vocabulary word encoding processing method that integrates contextual relationships is adopted. Offline and online template parsing mainly uses the drain parser.

[0066] S102: Inputting the original log template sentence sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer, extracting component interaction features and log variable features from the original log template sentence sequence based on the GCN network, and extracting template semantic features from the initialization template semantic encoding result based on the encoder built on the embedding representation layer;

[0067] Component interaction features include the interaction adjacency matrix A C and behavioral feature matrix X C , A C Elements in It represents the component interaction strength, which is calculated as shown in formula (2):

[0068]

[0069] in, is the interaction count of components c1 and c2. Log sequences that appear once together within a fixed time window are considered weak interactions. Increment 0.2, appearing together in the same log statement is considered a medium interaction, Increment by 0.5. Operations on the same resource in a log statement are considered strong interactions. Increment by 1, the interaction count values ​​of different types are prior parameters; X C The behavioral feature matrix is ​​constructed by identifying the alarm type and operation type of the log based on regular expressions, counting the number of times the component appears in different alarm types (INFO, WARN, ERROR, etc.) and different operation types (file operation, request operation, etc.) within a fixed time window, and constructing the behavioral feature matrix of all nodes in the fixed window. C As the input of GCN, the output node feature of each component is matched and concatenated with the first component appearing in the log entry.

[0070] Log variable features involve log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v , if the log entry templates in the current time window are inconsistent, the adjacency matrix A LThe elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1 and non-adjacent ones are recorded as 0. If there is an identical template, the element value between log entries with the same template is set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entry of non-adjacent relations is calculated according to formula (3)

[0071]

[0072] in, Refers to the path to other entries in l1 Position in

[0073] X v Records the characteristics of numeric variables, including data block size, number of replicas, disk usage, operation duration, file size, etc. The original values ​​must be normalized. Log entries without numeric variables are filled with the mean value of the numeric variable characteristics in the window.

[0074] S103: Input component interaction features, log variable features, and template semantic features into a pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection results.

[0075] The construction of the multi-dimensional feature fusion anomaly detection model GCN-ATTN mainly includes:

[0076] The GCN output of the obtained log component interaction features and numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concat-spliced ​​to obtain the fused feature representation Z, where the embedded representation layer of the log key sequence and the log template semantic encoding do not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively:

[0077]

[0078] Among them, [tmp t ] is the encoding vector output by the pre-trained text embedding model of the log template obtained by parsing the log entry, and [l t ] The log entries pointed to by the log keys in the .

[0079] After the fusion features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. For the specific process, see formula (6) to formula (11):

[0080] H attn =MultiHeadAttn(Z) (20)

[0081] H fc =ReLU(H attn W fc +b fc ) (twenty one)

[0082] H fc =H fc +H attn (twenty two)

[0083] H linear =H fc H linear +b linear (twenty three)

[0084] H linear =H linear +H fc (twenty four)

[0085] H o =softmax(H linear ) (25)

[0086] In offline mode, the cross entropy function is combined with the Adam optimizer to complete model training.

[0087] In online mode, during online template parsing and semantic encoding initialization, encoding of out-of-vocabulary words requires combining the trained embedding representation layer parameters and pre-trained text embedding model, mainly including:

[0088] Combined with the anomaly detection model GCN-ATTN, after training on the existing label data set, the semantic embedding representation layer parameters based on the trained template are Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12):

[0089]

[0090] Among them [BERT j ] is the initialization encoding of the words in the vocabulary around the oov word, and the encoding model can be a pre-trained text embedding model based on context awareness.

[0091] During the online detection of the anomaly detection model, the training set and detection model are regularly updated, a tree-shaped GCN-ATTN cluster is constructed, online log anomaly detection is performed based on weighted voting integration, and the importance is calculated to achieve cluster optimization.

[0092] The steps for building a GCN-ATTN cluster and calculating the contribution of model nodes are as follows:

[0093] Divide the labeled log training set D according to the log timestamp and log data volume. Assume that the difference in timestamps (converted to seconds or milliseconds) in the initial GCN-ATTN model node training set is ΔT, and the difference in timestamps in each newly added training set is ΔT. If there is a training set larger than 2*ΔN, slide the timestamp by Δt in the newly added data set with a window size of ΔN, re-divide the training set, and train the GCN-ATTN model separately. Use the newly added one or more new model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp.

[0094] Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is automatically incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

[0095]

[0096] The model online updating method in step S4 mainly includes:

[0097] When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14):

[0098]

[0099] in is the maximum importance of the nodes in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sorting is performed, the lowest model node is deleted, and the child node with the highest importance replaces the current node, thereby achieving cluster optimization and reducing redundancy.

[0100] Example 2: The second aspect, as Figure 3 As shown, in order to achieve the above purpose, the present invention discloses a log anomaly detection system based on multidimensional features and GCN-ATTN, including:

[0101] The semantic encoding module 11 is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree to obtain a log template statement, and perform initialization template semantic encoding on the log template statement based on the vocabulary to obtain an initialization template semantic encoding result;

[0102] The feature extraction module 12 is configured to input the original log template sentence sequence and the initialized template semantic coding result into a pre-constructed multi-dimensional feature extraction layer, extract component interaction features and log variable features from the original log template sentence sequence based on a GCN network, and extract template semantic features from the initialized template semantic coding result based on an encoder constructed based on an embedding representation layer;

[0103] The anomaly detection module 13 is configured to input the component interaction features, the log variable features and the template semantic features into a pre-constructed multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output a log anomaly detection result.

[0104] Based on the same inventive concept, the application further provides a computer device, which comprises one or more processors and a memory for storing one or more computer programs; the program comprises program instructions, and the processor is configured to execute the program instructions stored in the memory. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal and are configured to implement one or more instructions, and are specifically configured to load and execute one or more instructions in the computer storage medium to implement the above method.

[0105] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium having a computer program stored thereon, which executes the above method when executed by a processor. The storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component.

[0106] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0107] The above shows and describes the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present disclosure. Various changes and improvements may be made to the present disclosure without departing from the spirit and scope of the present disclosure, and such changes and improvements shall fall within the scope of the present disclosure.

Claims

1. A log anomaly detection method based on multidimensional features and GCN-ATTN, characterized by: The method comprises the following steps: Obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree to obtain a log template statement, perform initialization template semantic encoding on the log template statement based on the vocabulary to obtain an initialization template semantic encoding result; The original log template statement sequence and the initialization template semantic encoding results are input into the pre-built multi-dimensional feature extraction layer. The component interaction features and log variable features are extracted from the original log template statement sequence based on the GCN network. The encoder built based on the embedding representation layer extracts template semantic features from the initialization template semantic encoding results. The extraction of the component interaction features is as follows: Component interaction features include the interaction adjacency matrix A C and behavioral feature matrix X C , A C Elements in It represents the component interaction strength, and is calculated as shown in formula (2): in, is the interaction count between components c1 and c2; X C The behavioral feature matrix is ​​constructed based on regular expressions to identify the alarm type and operation type of the log. The number of occurrences of components in different alarm types (INFO, WARN, ERROR) and different operation types within a fixed time window is counted. The behavioral feature matrix of components of all nodes within a fixed time window is constructed. C As the input of GCN, the output node feature of each component is matched and concatenated with the first component appearing in the log entry; The process of extracting the log variable features: Log variable features involve log template parsing, including the log entry adjacency matrix A L and variable feature matrix X v , if the log entry templates in the current time window are inconsistent, the adjacency matrix A L The elements in only record the adjacent relationship of log entries that appear in the current window. Adjacent ones are recorded as 1 and non-adjacent ones are recorded as 0. If there is an identical template, the element value between log entries with the same template is set to 1, and a BFS traversal is performed to obtain the path P from each log entry to other entries. log , then the edge weight of the log entries of non-adjacent relations is calculated according to formula (3): in, Refers to the path to other entries in l1 Position in; X v To record the characteristics of numerical variables; The component interaction features, log variable features, and template semantic features are input into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and the log anomaly detection results are output.

2. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 1 is characterized in that: The out-of-vocabulary word encoding process in the log template vocabulary is performed using the oov representation method that integrates the context relationship. The process is as follows: Log parsing combines the component modules and timestamps that appear in the original log statement to calculate POS oov , and calculate the oov code by combining the oov word context code. The calculation method is shown in formula (1): Where j is the k positions before and after the word oov in the original log statement, where k is the specified parameter. If there are less than k positions before and after oov, the missing code E j The calculation adopts the mean filling method; where p i is the module log count of the log statement where the current oov word is located, V is the count of all log statements, p i and V are updated whenever an oov word is encountered, t i is the timestamp of the log where the word oov is located, t i-1 The timestamp of the last log.

3. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 1 is characterized in that: The pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows: The GCN output of the log component interaction features and the numerical variable features, the embedded representation of the log key sequence and the log template semantic encoding are concatenated to obtain the fused feature representation Z. The embedded representation layer of the log key sequence and the log template semantic encoding does not share parameters. The calculation process of the log key sequence and the log template semantic encoding through the embedded representation layer is shown in formulas (4) and (5) respectively: Among them, [tmp t ] is the encoding vector output by the pre-trained text embedding model of the log template obtained by parsing the log entry, and [l t ] The log entries pointed to by the log keys in the . Embedding the representation layer parameters for the trained template semantics; After the fused features are input into the multi-head attention layer, they are passed to the fully connected feedforward layer and the linear layer using residual connections. The process is shown in formulas (6) to (11): H attn =MultiHeadAttn(Z) (6) A fc =ReLU(H attn W fc +b fc ) (7) H fc =H fc +H attn (8) H linear =H fc H linear +b linear (9) H linear =H linear +H fc (10) H o =softmax(H linear ) (11)。 4. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 3 is characterized in that: Combined with the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, after the training of the existing label dataset is completed, the semantic embedding representation layer parameters of the trained template are Template word encoding E in the context vocabulary j The calculation method of is shown in formula (12): Among them [BERT j ] is the initialization encoding of the in-vocabulary words around the oov word, and the encoding model is based on the context-aware pre-trained text embedding model.

5. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 1 is characterized in that: The process of inputting component interaction features, log variable features, and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN and outputting the log anomaly detection results: The online log anomaly detection method based on weighted voting includes GCN-ATTN cluster construction and model node contribution calculation: Divide the labeled log training set D according to the log timestamp and log data volume. Let the timestamp difference in the initial GCN-ATTN model node training set be ΔT, and the timestamp difference in each newly added training set be Δt. If there is a training set larger than 2*ΔN, slide the timestamp by Δt in the newly added data set with a window size of ΔN, re-divide the training set, and train GCN-ATTN separately. Use one or more newly added model nodes as the next layer nodes, and build a hierarchical GCN-ATTN cluster from top to bottom according to the timestamp. Whenever a new training set is generated, all model nodes are verified and the contribution r of each model node is calculated. m , r m The initial value is 0, and the predicted result is automatically incremented by 1 if it is consistent with the true label. The weight calculation formula of the voting weighted integration is shown in formula (13):

6. The log anomaly detection method based on multidimensional features and GCN-ATTN according to claim 5 is characterized in that: The updating method of the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN is as follows: When the number of model nodes in the log anomaly detection cluster exceeds the set threshold M, the latest generated model node is retained, and the importance of each old model node is calculated as shown in formula (14): in is the maximum importance of the node in the next layer of node m, the importance of the latest model node is its own contribution, ρ is the probability that the real-time data stream detection result of node m is consistent with the cluster result, according to α m Sort by, delete the lowest model node, and replace the current node with the child node with the highest importance. m The contribution of each model node.

7. A log anomaly detection system based on multidimensional features and GCN-ATTN, which adopts the log anomaly detection method based on multidimensional features and GCN-ATTN according to any one of claims 1 to 6, characterized in that: include: A semantic encoding module is used to obtain a log template vocabulary, perform log parsing on the log template vocabulary based on a dictionary tree, obtain a log template statement, and perform initialization template semantic encoding on the log template statement based on the vocabulary to obtain an initialization template semantic encoding result; The feature extraction module is used to input the original log template statement sequence and the initialization template semantic encoding result into the pre-built multi-dimensional feature extraction layer. Based on the GCN network, the component interaction features and log variable features are extracted from the original log template statement sequence. The encoder built based on the embedding representation layer extracts template semantic features from the initialization template semantic encoding result. The anomaly detection module is used to input component interaction features, log variable features, and template semantic features into the pre-established multi-dimensional feature fusion anomaly detection model GCN-ATTN, and output the log anomaly detection results.

8. A terminal device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: The memory stores a computer program that can be run on the processor. When the processor loads and executes the computer program, the log anomaly detection method based on multidimensional features and GCN-ATTN according to any one of claims 1 to 6 is adopted.

Images