Server anomaly detection method, training method and electronic device

Abstract

The present application provides a server anomaly detection method and electronic device, which can be applied to the field of artificial intelligence technology. The method includes: in response to determining that an initial detection result of a target server indicates an anomaly, using a target model, based on the timestamp of the log to be detected in the log sequence to be detected, embedding a position code in the log sequence to be detected to generate features of the log to be detected; using the target model, based on an attention mechanism, fusing the features of any log to be detected with the features of at least two adjacent logs to be detected to generate a first detection result; the log event types indicated by at least two logs to be detected are different; and in response to determining that the first detection result includes at least two anomaly types with a correlation degree less than a predetermined threshold, using a pre-trained language model to analyze the log sequence to be detected to generate a second detection result; the second detection result indicates the server anomaly type and the cause of the server anomaly.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, specifically to the field of deep learning and anomaly detection technology, and more specifically to a server anomaly detection method, training method and electronic device. Background Art

[0002] With the rapid expansion of data center scale, the number of servers has increased exponentially, the complexity of the operating environment has increased significantly, and the frequency of server failures has increased.

[0003] In order to reduce the frequency of server failures, it is necessary to perform anomaly detection on the server. However, due to the complexity and diversity of server failure types, such as memory corruption, hard disk failure, operating system failure, driver conflict, etc., the detection accuracy is low. Summary of the Invention

[0004] In view of the above problems, the present application provides a server anomaly detection method, a training method and an electronic device.

[0005] According to a first aspect of the present application, a server anomaly detection method is provided, comprising: in response to determining that an initial detection result of a target server indicates an anomaly, using a target model, based on the timestamp of the log to be detected in the log sequence to be detected, embedding a position code in the log sequence to be detected, and generating features of the log to be detected; using the target model, based on an attention mechanism, fusing the features of any log to be detected with the features of at least two adjacent logs to be detected, and generating a first detection result; wherein the log event types indicated by at least two logs to be detected are different; and in response to determining that the first detection result includes at least two anomaly types whose correlation with each other is less than a predetermined threshold, using a pre-trained language model to analyze the log sequence to be detected, and generating a second detection result; wherein the second detection result indicates the server anomaly type and the cause of the server anomaly.

[0006] A second aspect of the present application provides a target model training method, comprising: using an initial model, embedding a sample position code in a sample log sequence based on the timestamp of a sample log in a sample log sequence to generate features of the sample log; using the initial model, fusing the features of any sample log in the sample log sequence with the features of at least two sample logs in their respective adjacent sample log sequences based on an attention mechanism to generate a sample detection result; the log event types indicated by the at least two sample logs are different; training the initial model based on a target loss function, the sample detection results, and the sample labels to generate a target model involved in the server anomaly detection method described above;

[0007] A third aspect of the present application provides a server anomaly detection device, including: a first encoding module, a first detection module and an analysis module.

[0008] The first encoding module is used to, in response to determining that the initial detection result of the target server indicates an abnormality, use the target model to embed a position code in the log sequence to be detected based on the timestamp of the log to be detected in the log sequence to generate a feature of the log to be detected.

[0009] The first detection module is configured to utilize a target model to fuse features of any log to be detected with features of at least two adjacent logs to be detected based on an attention mechanism to generate a first detection result; wherein the log event types indicated by at least two logs to be detected are different.

[0010] The first analysis module is configured to, in response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, analyze the log sequence to be detected using a pre-trained language model to generate a second detection result; wherein the second detection result indicates the server anomaly type and the cause of the server anomaly.

[0011] A fourth aspect of the present application provides a target model training device, comprising: a second encoding module, a second detection module and a training module.

[0012] The second encoding module is used to use the initial model to embed the sample position code in the sample log sequence based on the timestamp of the sample log in the sample log sequence to generate the features of the sample log.

[0013] The second detection module is configured to use the initial model to fuse the features of any sample log in the sample log sequence with the features of at least two sample logs in the respective adjacent sample log sequences based on an attention mechanism to generate a sample detection result; the log event types indicated by the at least two sample logs are different;

[0014] The training module is used to train the initial model based on the target loss function, sample detection results, and sample labels to generate the target model. The target loss function includes parameters for dynamically calling sample category weights and sample recognition difficulty weights; the sample label indicates the abnormal category of the sample log sequence.

[0015] The fifth aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0016] The sixth aspect of the present application further provides a computer-readable storage medium having a computer program or instruction stored thereon, which implements the steps of the above method when the above computer program or instruction is executed by a processor.

[0017] The seventh aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0018] According to an embodiment of the present application, when the initial detection result of the log sequence to be detected for the target server indicates an anomaly, the target model is called for detection. Since the target model integrates the features of any log to be detected with the features of at least two adjacent logs to be detected, the interference of redundant data on the detection results during the feature fusion process is at least reduced, further improving the accuracy of the detection results. When the detection result of the target model includes at least two unrelated anomaly types, the pre-trained language model is called for analysis. The semantic understanding and logical reasoning capabilities of the pre-trained language model are utilized to form an organic whole for collaborative detection with the deep learning model, at least solving the problem of the low accuracy of the target model in detecting complex fault modes due to its low generalization ability, thereby achieving the technical effect of improving the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0020] Figure 1 An application scenario diagram of the server anomaly detection method according to an embodiment of the present application is shown;

[0021] Figure 2 A flow chart of a server anomaly detection method according to an embodiment of the present application is shown;

[0022] Figure 3 A schematic diagram of a server anomaly detection method according to an embodiment of the present application is shown;

[0023] Figure 4 A schematic diagram illustrating calling a pre-trained language model to decompress log files and parse log data to generate a log sequence to be detected according to an embodiment of the present application is shown;

[0024] Figure 5 A schematic diagram showing detection of a log sequence to be detected using a target model according to an embodiment of the present application is shown;

[0025] Figure 6 A schematic diagram showing a collaborative analysis of a log sequence to be detected by calling a pre-trained language model according to an embodiment of the present application is shown;

[0026] Figure 7 A flow chart of a target model training method according to an embodiment of the present application is shown;

[0027] Figure 8 A schematic diagram of a target model training method according to an embodiment of the present application is shown;

[0028] Figure 9 The following is a structural block diagram of a server anomaly detection device according to an embodiment of the present application;

[0029] Figure 10 The following is a structural block diagram of a target model training device according to an embodiment of the present application;

[0030] Figure 11 A block diagram of an electronic device suitable for implementing a server anomaly detection method or a target model training method according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0032] The terms used herein are only for describing specific embodiments and are not intended to limit this application. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0034] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0035] As data centers expand, server operating environments become increasingly complex, and server anomalies and failure types also become more complex and diverse. The methods used in related examples for detecting server anomalies all have their own shortcomings. For example, anomaly detection methods based on statistical models rely on assumptions about data distribution and deviate from actual server operating scenarios. Anomaly detection methods based on expert rules rely on subjective expert experience and lack flexibility to adapt to complex and changing operating environments. Anomaly detection methods based on deep learning models rely on the quality of sample data for detection accuracy.

[0036] In view of this, an embodiment of the present application provides a server anomaly detection method, which forms an organic whole of collaborative detection with the deep learning model, at least solving the problem of low accuracy in detecting complex fault modes due to the low generalization ability of the target model, thereby achieving the technical effect of improving the accuracy of anomaly detection.

[0037] Figure 1 The following diagram shows an application scenario of the server anomaly detection method according to an embodiment of the present application.

[0038] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a terminal device 101, a network 102, and a server 103. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0039] A user may use a terminal device 101 to interact with a server 103 via a network 102 to receive or send messages, etc. Various communication client applications may be installed on the terminal device 101, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, data analysis applications, etc. (for example only).

[0040] The terminal device 101 may be any electronic device having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0041] Server 103 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using terminal device 101. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal device.

[0042] It should be noted that the server anomaly detection method provided in the embodiments of the present application can generally be executed by server 103. Server 103 can be configured with a target model and a pre-trained language model for executing the server anomaly detection method described above. Accordingly, the server anomaly detection device or target model training device provided in the embodiments of the present application can generally be set in server 103.

[0043] For example, a log sequence to be detected is input into terminal device 101, which then sends the log sequence to server 103. Server 103 then uses the target model and a pre-trained language model (LLM) to execute the server anomaly detection method provided by the present application embodiment, generating a detection result 111. Finally, detection result 111 is fed back to terminal device 101.

[0044] The server anomaly detection method or target model training method provided in the embodiments of the present application may also be executed by a server or server cluster that is different from the server 103 and that is capable of communicating with the terminal device 101 and / or the server 103. Accordingly, the server anomaly detection device or target model training device provided in the embodiments of the present application may also be set in a server or server cluster that is different from the server 103 and that is capable of communicating with the terminal device 101 and / or the server 103.

[0045] For example, the terminal device 101 may be loaded with a target model and a pre-trained language model. When a log sequence to be detected is input into the terminal device 101, the terminal device 101 may call the target model and the pre-trained language model to execute the server anomaly detection method provided by the embodiment of the present application and generate a detection result 111.

[0046] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0047] The following will be based on Figure 1 The scene described by Figures 2 to 6 The server anomaly detection method of the embodiment is described in detail.

[0048] Figure 2 A flow chart of a server anomaly detection method according to an embodiment of the present application is shown.

[0049] like Figure 2 As shown, the server anomaly detection method 200 of this embodiment includes operations S210 to S230.

[0050] In operation S210 , in response to determining that the initial detection result of the target server indicates an anomaly, a target model is used to embed a position code in the log sequence to generate features of the log to be detected based on timestamps of the logs to be detected in the log sequence.

[0051] In operation S220 , the target model is used to fuse features of any log to be detected with features of at least two adjacent logs to be detected based on an attention mechanism to generate a first detection result.

[0052] In operation S230 , in response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, the log sequence to be detected is analyzed using a pre-trained language model to generate a second detection result.

[0053] In some embodiments, the initial detection result can be obtained based on the detection of the log sequence to be detected by the rule engine. The rule engine can be configured with various empirical rules or statistical rules for detecting server anomalies. For example, the empirical rule can be that when the temperature of the hardware Q continues to rise and exceeds a predetermined temperature threshold, it can be determined that the hardware Q has a fault S1. When the temperature of the hardware Q recorded in the log sequence to be detected continues to rise and exceeds the predetermined temperature threshold, it can be determined that it matches the empirical rule, and the initial detection result is determined to be that the hardware Q in the server has a fault S1.

[0054] However, statistical rules often rely on assumptions about data distribution. Data distribution in real-world applications is complex and variable, making it difficult to meet these assumptions. Consequently, initial detection results based on statistical rules may indicate anomalies, such as an initial empty result.

[0055] Similarly, empirical rules are usually summarized based on historical experience. As the complexity of the data center operating environment increases, the types of server anomalies are becoming more complex and varied. Therefore, the initial detection results based on empirical rules may indicate anomalies. For example, the initial detection results may include multiple conflicting anomaly types.

[0056] Therefore, in an embodiment of the present application, when it is determined that the initial detection result indicates an abnormality, the target model is used to embed a position code in the log sequence to be detected based on the timestamp of the log to be detected in the log sequence to generate features of the log to be detected.

[0057] In some embodiments, the target model can be a trained Transformer model. The Transformer model is a neural network architecture based on an attention mechanism that dynamically calculates the association weights of different positions in the input sequence based on the attention mechanism, thereby capturing the dependencies between long-range features in the input sequence.

[0058] Position codes are embedded in the log sequence to be detected based on the timestamps of the logs to be detected. This allows the model to perceive the actual moment when the log occurs rather than the relative position during the detection process, thereby perceiving the density of the log events represented in the log to be detected, further improving the accuracy of the detection results.

[0059] During operation, servers automatically adjust to certain anomalies to reduce the probability of failure. For example, if the CPU power consumption is too high, the CPU temperature will continue to rise. At this time, the fan will start to help dissipate heat from the CPU. During this process, the CPU temperature may fluctuate, first dropping, then rising, and then dropping again. If this normal fluctuation is misidentified as a CPU or fan anomaly, it will lead to false detection.

[0060] Therefore, in this embodiment of the present application, a target model uses an attention mechanism to fuse the features of any log to be detected with the features of at least two adjacent logs to be detected to generate a first detection result. This reduces the model's repeated perception of similar log events occurring at adjacent times, and reduces the probability of false detection of normal fluctuations in the server's self-regulation process.

[0061] Because the target model's detection accuracy is highly dependent on sample data and its generalizability is low, it can detect complex fault modes with poor accuracy. Pretrained language models are based on deep learning technology and are pre-trained on massive amounts of text data. They possess strong semantic understanding and logical reasoning capabilities.

[0062] Therefore, when the first detection result output by the target model includes at least two anomaly types whose correlation is less than a predetermined threshold, the pre-trained language model can be used to analyze the log sequence to be detected. For example, after comprehensively analyzing the detection results of different types of logs to be detected, causal reasoning is performed on the detection results to determine whether there is a logical conflict between the detection results. If not, the detection results can be fused to generate a second detection result.

[0063] According to an embodiment of the present application, when the initial detection result of the target server's log sequence to be detected indicates an anomaly, the target model is called for detection. Since the target model integrates the features of any log to be detected with the features of at least two adjacent logs to be detected, the interference of redundant data on the detection results during the feature fusion process is at least reduced, further improving the accuracy of the detection results. When the detection result of the target model includes at least two unrelated anomaly types, a pre-trained language model is called for analysis. The semantic understanding and logical reasoning capabilities of the pre-trained language model are utilized to at least solve the problem of the target model's low accuracy in detecting complex fault modes due to its low generalization ability, thereby achieving the technical effect of improving the accuracy of anomaly detection.

[0064] In real-world applications, data center server log files are typically stored in compressed file formats. These files are often generated by different systems and have different formats. Therefore, compressed files must be preprocessed to obtain the log sequences to be tested. Preprocessing operations include, but are not limited to, decompressing the log files and parsing the data.

[0065] In addition, the rule engine can quickly identify simple anomaly types. For example, by matching a log message with a rule, it can quickly determine whether the server has an anomaly, thereby improving detection efficiency.

[0066] The following combination Figure 3 A detailed description of the collaborative detection method that integrates the rule engine, target model and pre-trained language model.

[0067] Figure 3 A schematic diagram of a server anomaly detection method according to an embodiment of the present application is shown.

[0068] like Figure 3 As shown, in this embodiment 300, first, a compressed file 301 of a log to be detected is preprocessed to obtain a log sequence 302 to be detected.

[0069] Then, the rule engine 310 is called to detect the log sequence 302 to be detected, and an initial detection result 303 is obtained.

[0070] Next, operation S310 is performed to determine whether the initial detection result 303 indicates an abnormal conflict. If so, operation S320 is performed to call the target model for detection to obtain a first detection result. If not, the initial detection result 303 is determined as the final detection result, and the process ends.

[0071] Then, operation S321 is executed to determine whether the correlation between the abnormality types in the first detection result is less than a predetermined threshold. If so, operation S330 is executed to call the pre-trained language model for detection and produce a second detection result 304. If not, the first detection result is determined as the final detection result and the process ends.

[0072] Next, combine Figures 4 to 6 right Figure 3 The server anomaly detection method shown in is described in detail.

[0073] Figure 4 A schematic diagram is shown of calling a pre-trained language model to decompress log files and parse log data to generate a log sequence to be detected according to an embodiment of the present application.

[0074] Preprocessing the compressed file of the log to be detected to generate a log sequence to be detected may include the following operations: obtaining the compressed file of the log to be detected; determining the type of the compressed file based on the content of the compressed file; based on the type of the compressed file, using a pre-trained language model to call a first tool to decompress the compressed file to generate multiple log files; using the pre-trained language model to call a second tool to parse the multiple log files respectively to generate a log sequence to be detected.

[0075] In some embodiments, the type of a compressed file can be determined based on its extension, such as zip, rar, etc. Alternatively, the type of a compressed file can be determined by identifying its header. Therefore, the contents of a compressed file include, but are not limited to, the header, the extension, and the file information contained within the compressed file.

[0076] Then, based on the type of the compressed file, the pre-trained language model can be called to call the first tool to decompress the compressed file.

[0077] In some embodiments, the mapping relationship between various types of compressed files and decompression tools and parsing tools can be pre-configured, and the calling interfaces of the decompression tools and parsing tools can be configured.

[0078] Then, the pre-trained language model can identify the type of compressed file, determine the first tool for decompressing the compressed file of this type and the interface information for calling the first tool, so as to call the first tool based on the interface information of the first tool to decompress the compressed file.

[0079] For example, for zip-type compressed files, the pre-trained language model can call Python tools to decompress them.

[0080] Then, the pre-trained language model can determine the interface information of the second tool to call the second tool to parse the decompressed multiple logs, such as: data deduplication, data analysis, conversion of unstructured log data into structured log data, etc., to generate a log sequence to be detected.

[0081] In the embodiments of the present application, the type of compressed files is identified based on their content, further improving the accuracy of type recognition for compressed log files from different sources and in different storage formats. The pre-trained language model can be used to dynamically select decompression and parsing tools based on the compressed file type, further improving the efficiency of pre-processing operations on the compressed log files to be detected.

[0082] In some embodiments, in addition to pre-configuring the interface information of each parsing tool and decompression tool, the generation capability of the pre-trained language model can also be directly utilized to directly generate parameters for calling the decompression tool and parsing tool that match the compressed file type, thereby further improving data processing efficiency and the flexibility of calling the tool.

[0083] For example: based on the type of the compressed file, using a pre-trained language model to call the first tool to decompress the compressed file and generate multiple log files, can include the following operations: based on the type of the compressed file, determining the parameter information of the first tool; using the pre-trained language model, based on the parameter information of the first tool, generating a first parameter for calling the first tool; and calling the first tool based on the first parameter to decompress the compressed file and generate multiple log files.

[0084] In the embodiment of the present application, the parameter information of the first tool includes but is not limited to information such as the format and content of the input parameters required when calling the first tool.

[0085] like Figure 4 As shown, the compressed file 301 of the log to be detected can be input into the LLM 1410 and the first parameter can be output.

[0086] For example, the compressed file type and the compressed file can be input as a prompt into a pre-trained language model. The pre-trained language model then identifies the compressed file type, determines parameter information for the first tool, and outputs the first parameter. Alternatively, the parameter information for the first tool corresponding to the pre-compressed file type can be first determined, and then the parameter information for the first tool and the compressed file can be input as a prompt into the pre-trained language model to generate the first parameter.

[0087] Finally, the first parameter is used to call the decompression tool 411 to decompress the compressed file of the log to be detected, and generate a log file 401.

[0088] Similarly, using a pre-trained language model to call a second tool to parse multiple log files respectively to generate a log sequence to be detected, including the following operations: determining parameter information of the second tool based on the parsing requirements of the logs to be detected; using the pre-trained language model, based on the parameter information of the second tool, generating a second parameter for calling the second tool; and calling the second tool based on the second parameter to parse multiple log files to generate a log sequence to be detected.

[0089] In the embodiment of the present application, the parameter information of the second tool includes but is not limited to information such as the format and content of the input parameters required when calling the second tool.

[0090] The parsing requirements for the logs to be tested can be determined based on the log source, including but not limited to removing redundant data and converting unstructured log data into structured log data. Removing redundant data reduces data storage and processing overhead. Redundant data removal is typically achieved by finding duplicate records. The parsed structured log data can be used in subsequent rule engines and target models to extract key fields, format log timestamps, or identify log event types.

[0091] like Figure 4 As shown, the log file 401 can be input into the LLM2420 and the second parameter can be output.

[0092] For example, the parsing requirements and log file can be input as prompts into a pre-trained language model. The pre-trained language model then identifies the parsing requirements, determines the parameters for the second tool, and outputs the second parameters. Alternatively, the parameters for the second tool corresponding to the pre-compressed file type can be determined first. The parameters and log file can then be input into the pre-trained language model as prompts to generate the second parameters.

[0093] Finally, the parsing tool 421 is called using the second parameter to perform data parsing on the log file 401 to generate the log sequence 302 to be detected.

[0094] By utilizing the generation capability of the pre-trained model, the parameters for calling the decompression tool for decompressing log files and the parsing tool for parsing log files are dynamically generated, which further improves the flexibility of the preprocessing operation of the compressed files of the logs to be tested and adapts to the increasingly complex and changeable server operating environment.

[0095] In actual application scenarios, there are still some anomaly types that can be detected based on rule engines. The method of using rule engines to detect server anomalies has the characteristics of fast data processing speed and is suitable for detection scenarios with high timeliness requirements.

[0096] However, as the operating environment of servers in data centers becomes more complex and changeable, the rules for detecting server anomalies are becoming more and more complex. There may be correlations between different rules. The recurrence rate of abnormal logs adapted by such complex judgment rules is low.

[0097] Therefore, when there are a large number of association rules in the historical rule base, the processing speed of the rule engine is reduced.

[0098] In view of this, the embodiment of the present application extracts unrelated rule sets from the historical rule base by performing the following operations to obtain a predetermined rule base.

[0099] For example, the association strength between rules can be defined as follows:

[0100] (1)

[0101] In the embodiment of the present application, two rules whose correlation degree is greater than a predetermined correlation threshold may be determined to be associated with each other.

[0102] Then, the rules in the historical rule base are scored according to the following scoring rules:

[0103] (2)

[0104] Next, the rules in the historical rule base are sorted based on the scoring results obtained by formula (2), and the first N rules can be taken to construct the predetermined rule base. N can be a positive integer greater than 1, and the specific value can be configured according to actual needs, for example: N = 100.

[0105] Finally, the log sequence to be detected can be matched based on a predetermined rule base to generate an initial detection result. The predetermined rule base includes multiple predetermined rules for detecting server anomalies; the correlation between the multiple predetermined rules is less than a predetermined correlation threshold.

[0106] Since the multiple predetermined rules for detecting server anomalies included in the predetermined rule base are not related to each other, the number of rules matched and the matching difficulty when calling the rule engine are reduced, and the detection efficiency of the initial detection stage is further improved.

[0107] The following combination Figure 5 An embodiment of detecting a log sequence to be detected by using a target model is described in detail.

[0108] Figure 5 A schematic diagram of detecting a log sequence to be detected using a target model according to an embodiment of the present application is shown.

[0109] In server anomaly detection scenarios, the actual time when an anomaly event occurs is often more important than the relative time when the anomaly occurs.

[0110] Therefore, in the embodiment of the present application, when position encoding is performed on the log sequence to be detected, the timestamp of the log to be detected is introduced to truly express the actual event interval between different log events.

[0111] like Figure 5 As shown, first, the time interval 520 is introduced to perform position encoding on the log sequence 302 to be detected, and features F1, F2, ..., Fn 521 of the log to be detected are generated.

[0112] In some embodiments, utilizing a target model, based on the timestamps of the logs to be detected in the log sequence to be detected, embedding position codes in the log sequence to be detected, and generating features of the logs to be detected may include the following operations: obtaining a first time interval between adjacent logs to be detected in the log sequence to be detected based on the timestamps of the logs to be detected in the log sequence to be detected; generating a position code based on the timestamps and the first time interval of the logs to be detected; and embedding the position code in the log sequence to be detected to generate features of the logs to be detected.

[0113] For example, the position code can be generated according to formula (3) :

[0114] (3)

[0115] Where k = 1, 2, ... d model , represents the dimension in the log sequence to be detected; t represents the timestamp of the log; Indicates the first time interval between adjacent logs to be detected in the log sequence to be detected; Position code representing absolute time; A position code representing a relative time interval.

[0116] In this embodiment, absolute time position encoding is used to preserve the global temporal information of log events, such as the specific moment of a failure in the server's operating cycle. Relative time interval position encoding is used to capture the local temporal relationship between adjacent log events. For example, whether the interval between two abnormal logs is "sudden and continuous" is unclear.

[0117] Based on the time interval of log events, the position encoding is dynamically adjusted so that the target model can perceive the density of log events while perceiving the global temporal information of log events, further improving the accuracy of server anomaly detection.

[0118] Because each log sequence to be tested may include multiple log messages, feature fusion can be performed hierarchically. For example, a sentence-level attention mechanism can be first performed, treating each log message as a sentence and performing self-attention fusion. The fused features can then be fused at the chapter level, using a mutual attention mechanism to fuse the features of the entire log sequence to be tested, generating fused features 523. The fused features 523 are then tested to generate a first test result 524.

[0119] In some embodiments, using a target model, the features of any log to be detected are fused with the features of at least two adjacent logs to be detected based on an attention mechanism to generate a first detection result, which may include the following operations: based on the attention mechanism, the features of the log to be detected are fused with the features of at least two adjacent logs to be detected to generate a fused feature; and the fused feature is detected to generate a first detection result.

[0120] Because the actual intervals between log events are included in the position encoding process, the model pays more attention to log events occurring within shorter time intervals during feature fusion. However, since the server has an automatic control mechanism, this process may cause the same type of log events to be repeatedly triggered within a short period of time. This repeated triggering of the same type of log event within a short period of time is not actually a sign of server abnormality, but rather the activation of the server's automatic control mechanism. Therefore, when performing feature fusion based on the attention mechanism, the penalty parameter 522 can be introduced to make the model pay more attention to different types of log events occurring at adjacent moments.

[0121] In some embodiments, based on the attention mechanism, the features of the log to be detected are fused with the features of at least two adjacent logs to be detected to generate a fused feature, which can include the following operations: obtaining a penalty parameter based on the timestamps and target information of at least two logs to be detected; based on the attention mechanism and the penalty parameter, the features of the log to be detected are fused with the features of at least two adjacent logs to be detected to generate a fused feature.

[0122] In the embodiment of the present application, the target information is used to indicate whether the types of log events indicated by at least two logs to be detected are the same.

[0123] For example, fusion features can be generated based on the attention mechanism and penalty parameters according to formula (4):

[0124] (4)

[0125] Among them, Q, K, and V represent the query matrix, key matrix, and value matrix respectively. Indicates the dimension of the key vector, scaling factor Used to prevent the gradient from disappearing when the number of dot products is too large. λ∈[0,1] represents the penalty coefficient, which is used to control the strength of repeated suppression. R∈ Represents the penalty matrix, and the dimension of the penalty matrix is ​​the same as that of the Q, K, and V matrices.

[0126] In some embodiments, the penalty coefficient and penalty matrix may be pre-configured to reduce the attention paid to log events of the same type within adjacent time periods.

[0127] Due to the repeated occurrence of log events within a short period of time caused by the triggering of the server's automatic control mechanism, the model pays attention to the false detection events caused by the intensive occurrence of repeated log events. By introducing a penalty parameter in the attention mechanism, the probability of false detection events is reduced.

[0128] In addition to pre-configuring the penalty coefficient and penalty matrix, in some embodiments, the penalty parameter can also be obtained based on the timestamps and target information of at least two logs to be detected, so as to dynamically adapt the penalty intensity according to changes in the actual detection scenario and further improve the detection accuracy.

[0129] In some embodiments, a second time interval between at least two logs to be detected may be obtained according to timestamps of at least two logs to be detected; and a penalty parameter may be generated based on the second time interval and target information.

[0130] For example, we can define the elements R in the penalty matrix ij as follows:

[0131] (5)

[0132] Among them, t i Indicates the timestamp of log event i, t j Represents the timestamp of log event j, and τ represents the event decay constant, which is used to control the decay rate. For example, when τ = 60, the penalty parameter value decays to 1 / e of its original value for every 60 seconds between log events i and j. Represents a type matching function, which is used to impose a penalty when log event i and log event j have the same type.

[0133] Therefore, the type matching function is defined as follows:

[0134] (6)

[0135] In the embodiment of the present application, the target information is calculated using formula (6).

[0136] It's understandable that the elements in the penalty matrix measure the temporal proximity between log event i and log event j. As the time interval between log event i and log event j decreases, the penalty parameter increases, approaching 1, resulting in a stronger penalty. As the time interval increases, the penalty parameter's value decays exponentially.

[0137] By using the elements in the penalty matrix to measure the temporal proximity between different log events, the value of the penalty parameter can be dynamically determined, further improving the matching degree between the penalty parameter and the actual detection scenario requirements, and further improving the detection accuracy.

[0138] Although the detection accuracy of the target model can be improved by incorporating the time intervals between log events into positional encoding and introducing a penalty factor into the attention calculation process, the target model's detection accuracy is highly dependent on training samples. Therefore, when faced with complex and comprehensive failure modes, multiple unrelated anomaly types may be identified, making it difficult to perform root cause analysis of server anomalies.

[0139] In view of this, the embodiment of the present application introduces a pre-trained language model and uses the causal reasoning ability of the pre-trained language model to perform in-depth root cause analysis on the log sequence to be detected, thereby further improving the accuracy of the detection results.

[0140] The following combination Figure 6 An embodiment of analyzing a log sequence to be detected using a pre-trained language model is described in detail.

[0141] In some embodiments, the pre-trained language models include: a first pre-trained language model for performing conflict identification and a plurality of second pre-trained language models for performing logic analysis.

[0142] In an embodiment of the present application, in response to determining that the first detection result includes at least two anomaly types whose correlation with each other is less than a predetermined threshold, using a pre-trained language model to analyze the log sequence to be detected and generate a second detection result, can include the following operations: based on the type of the log to be detected in the log sequence to be detected, using the second pre-trained language model corresponding to each type to perform logical analysis on the log to be detected respectively to generate multiple initial analysis results; using the first pre-trained language model to identify conflicts between the multiple initial analysis results; and when it is determined that there is no conflict between the multiple initial analysis results, generating a second detection result for fusing the multiple initial analysis results.

[0143] In an embodiment of the present application, the log sequence to be detected may include multiple types of logs, for example: system logs responsible for analyzing operating system and kernel related logs, network logs used to analyze network equipment and communication data, storage logs used to pay attention to the operating status of the storage system, etc.

[0144] Because calling a pre-trained language model requires a lot of computing resources, to reduce redundant data input to the pre-trained language model, you can first configure data filtering rules to filter out logs that do not contain abnormal fields and normal logs used for periodic health checks or heartbeat signals. This reduces the resource consumption of the pre-trained language model and further improves detection speed.

[0145] Figure 6 A schematic diagram is shown of calling a pre-trained language model to perform collaborative analysis on a log sequence to be detected according to an embodiment of the present application.

[0146] like Figure 6 As shown, the log sequence 302 to be detected may include system log 3021, network log 3022, and storage log 3033. Then, according to the type of the log to be detected, the system log 3021, network log 3022, and storage log 3033 may be respectively assigned to the corresponding second pre-trained language model for log analysis.

[0147] For example, assign system log 3021 to LLM3 610 for log analysis, generating initial system log analysis results. Assign network log 3022 to LLM4 620 for log analysis, generating initial network log analysis results. Assign storage log 3033 to LLM5 630 for log analysis, generating initial storage log analysis results.

[0148] Then, the initial analysis results of the system log, the initial analysis results of the network log, and the initial analysis results of the storage log are input into LLM0 640 for conflict identification and result fusion.

[0149] For example, the prompt for inputting LLM0 640 may include role information, instruction information, initial analysis results of system logs, initial analysis results of network logs, and initial analysis results of storage logs. Role information can be used to indicate the identity information used by the first pre-trained language model during conflict identification and result fusion, for example, if you are a data analyst with extensive experience in logical conflict analysis. Instruction information can be used to indicate the operations that the first pre-trained language model needs to perform, such as conflict identification, information summarization, and correction of analysis direction.

[0150] In operation S3301 , if the recognition result of the first pre-trained language model for the multiple initial analysis results is that there is no conflict, information of the multiple initial analysis results is summarized to generate a second detection result 303 .

[0151] By leveraging the causal reasoning capabilities of pre-trained language models, we can further improve the accuracy of detection results by identifying initial analysis results for various types of logs and then conducting in-depth root cause analysis on multiple initial analysis results.

[0152] In some embodiments, using a first pre-trained language model to perform conflict identification on multiple initial analysis results may include the following operations: obtaining associated information associated with the multiple initial analysis results based on a predetermined knowledge graph; and using the first pre-trained language model to perform conflict identification on the multiple initial analysis results based on the associated information.

[0153] In an embodiment of the present application, a predetermined knowledge graph indicates the topological relationship and failure mode between the components configured in the server. When the first pre-trained language model performs conflict identification, it can first query the information associated with the initial analysis result from the predetermined knowledge graph. For example, when the initial analysis result output by the second pre-trained language model used to detect system logs indicates an abnormal increase in CPU usage, by querying the predetermined knowledge graph, the queried related information may include processes, services, and hardware failures that cause excessive CPU load. Then, based on the queried related information, conflict identification of multiple initial analysis results can be performed.

[0154] When the initial analysis results of other types of logs to be detected include a hardware fault that causes excessive CPU usage, it can be determined that there is no conflict among the multiple initial analysis results.

[0155] However, if the hardware failure included in the initial analysis results of other types of logs to be detected does not cause excessive CPU usage, it can be determined that there may be a conflict among the multiple initial analysis results.

[0156] By using the predetermined knowledge graph, background information or contextual information such as the hardware topology or failure mode associated with the abnormal log can be queried, so as to conduct in-depth analysis between multiple initial analysis results in combination with the background information or contextual information to determine whether there is a conflict, thereby further improving the accuracy of the analysis results.

[0157] In addition to the predetermined knowledge graph, the logical reasoning ability of the pre-trained language model can also be used to identify conflicts among multiple initial analysis results.

[0158] In some embodiments, using a first pre-trained language model to identify conflicts on multiple initial analysis results based on association information may include the following operations: using the first pre-trained language model to perform causal reasoning on multiple initial analysis results based on association information to generate at least two causes of server abnormality; in response to determining that at least two causes are associated with each other, determining that there is no conflict between the multiple initial analysis results; and in response to determining that at least two causes are not associated with each other, determining that there is a conflict between the multiple initial analysis results.

[0159] In the server anomaly detection scenario, there is not only correlation between hardware or patterns between various anomaly types, but also causal relationships between different log events.

[0160] Therefore, causal reasoning can be performed on multiple initial analysis results based on the correlation information to generate the cause of the server anomaly. For example, whether the cause of the server anomaly is a configuration error or a hardware failure causing service performance degradation.

[0161] In server anomaly detection scenarios, the causes of server anomalies obtained through causal reasoning belong to the deep-seated root causes. It can be understood that the log events describe only the superficial characteristics. The root causes obtained through causal reasoning should be the same, or at least related, for the logs to be detected collected in the same period.

[0162] Therefore, when at least two reasons obtained through analysis are correlated with each other, it can be determined that there is no conflict between the multiple initial analysis results. When at least two reasons obtained through analysis are not correlated with each other, it can be determined that there is a conflict between the multiple initial analysis results.

[0163] The causal reasoning capabilities of the pre-trained language model are used to explore the root causes of abnormal logs, thereby more accurately judging intermittent or complex failures during server operation.

[0164] The first pre-trained language model can not only assign different types of logs to be detected to different second pre-trained language models to perform logical analysis operations through task scheduling, but also identify conflicts among multiple initial analysis results output by multiple second pre-trained language models, and adjust the analysis direction in a timely manner to guide each second pre-trained language model to perform log analysis in the correct analysis direction, thereby reducing repeated calls to pre-trained language models and excessive consumption of computing resources.

[0165] In view of this, the embodiment of the present application may further include the following operations when it is determined that there is a conflict between multiple initial analysis results: generating a direction to be corrected corresponding to the cause of the abnormality; determining a target initial analysis result associated with the direction to be corrected from multiple initial analysis results; using a second pre-trained language model for outputting the target initial analysis result, correcting the target initial analysis result based on the direction to be corrected to generate an intermediate analysis result; updating the target initial analysis result in the multiple initial analysis results to an intermediate analysis result to obtain multiple intermediate analysis results; using the first pre-trained language model to identify conflicts between the multiple intermediate analysis results, and generating a second detection result for fusing the multiple intermediate analysis results when it is determined that there is no abnormality between the multiple intermediate analysis results.

[0166] like Figure 6 As shown, in operation S3301, when it is determined that there is a conflict between the multiple initial detection results, the analysis direction is corrected, and the multiple second pre-trained language models are rescheduled to perform analysis tasks according to the corrected analysis direction. This iterative cycle is repeated until there are no conflicts between the generated analysis results, and a second detection result is generated.

[0167] In some embodiments, when the detection is initially performed, the degree of match between the direction to be corrected corresponding to the cause of the abnormality generated by the first pre-trained language model and the user's intention may be low, and therefore, the number of iterative cycles will be high.

[0168] In order to reduce the number of iteration cycles of the pre-trained language model, feedback information regarding the second detection result may be received; and based on the feedback information, a processing strategy of the pre-trained language model may be adjusted.

[0169] Since the second detection result information includes the cause of the server abnormality, it may also include evidence link information generated by the pre-trained language model to support the above cause. Therefore, relevant personnel can provide feedback by querying the evidence link information.

[0170] For example, feedback information may include whether the test results are correct, whether key information is missing, whether the causal reasoning process is reasonable, etc.

[0171] Based on the feedback information, the processing strategy of the pre-trained language model at each stage can be adjusted.

[0172] For example, the processing strategy may include at least one of the following: a conflict identification strategy, a logic analysis strategy, a cause analysis strategy, and a correction strategy.

[0173] A conflict identification strategy can be used to determine whether there are conflicts between multiple initial detection results. A logical analysis strategy can be a strategy for log analysis by each second pre-trained language model. A cause analysis strategy can be an analysis strategy for causal reasoning by the first pre-trained language model using a knowledge graph. A correction strategy can be a strategy generated by the first pre-trained language model to correct the logical analysis direction of each second pre-trained language model.

[0174] The processing strategy of the pre-trained model is adjusted based on feedback information. As the number of detections increases and the model usage time grows, the matching degree between these processing strategies and the user's detection intentions will become higher and higher, thereby continuously improving the accuracy of the model in detecting complex faults.

[0175] Figure 7 A flowchart of a target model training method according to an embodiment of the present application is shown.

[0176] like Figure 7 As shown, the training method 700 may include operations S710 to S730.

[0177] In operation S710 , an initial model is used to embed a sample position code in the sample log sequence based on a timestamp of the sample log in the sample log sequence, thereby generating features of the sample log.

[0178] In operation S720 , the initial model is used to fuse features of any sample log in the sample log sequence with features of at least two sample logs in sample log sequences at adjacent moments based on an attention mechanism to generate a sample detection result.

[0179] In operation S730 , the initial model is trained based on the target loss function, the sample detection results, and the sample labels to generate a target model.

[0180] Due to the complex server operating environment, the numerous types of exceptions, and the uneven distribution of the number of different types of exceptions or failures, when training a Transformer architecture model, it is easy for the imbalance of training sample categories to cause imbalanced gradient propagation during the training process, resulting in low prediction accuracy of the trained model.

[0181] In view of this, the target loss function of the embodiment of the present application includes parameters for dynamically calling sample category weights and sample recognition difficulty weights.

[0182] For example, the objective loss function L can be expressed as follows:

[0183] (7)

[0184] in, represents the class imbalance compensation coefficient; , is the number of samples of category c; is the focusing parameter, which can be 2~5; is the regularization coefficient; is the L2 loss function; represents the predicted probability.

[0185] The L2 loss function can be expressed as follows:

[0186] (8)

[0187] in, represents the sample label of the i-th sample log; represents the sample detection result of the i-th sample log; m represents the number of samples.

[0188] In the embodiment of the present application, the initial model is trained using the target loss function. Automatically reduce the loss weight of the majority class; if =1 means the current sample is a rare fault, then =1 / (1+1)=0.5, therefore, the weight of the current sample is significantly improved, allowing the model to focus on the characteristics of the minority class samples.

[0189] Secondly, the initial model is trained using the target loss function, which can be achieved by using (1- )γ term, so that the model focuses on the features of difficult samples for learning during training. Difficult samples can, for example, be sample logs under mixed failure modes composed of multiple abnormal types.

[0190] Again, the target loss function is used to train the initial model. →1,(1- )γ→0, the loss weight decreases, when →0,(1- )γ→1, the loss weight remains high, so that the model continues to optimize samples near the classification boundary, thereby solving the problem of gradient propagation imbalance caused by imbalanced sample categories.

[0191] Figure 8 A schematic diagram of a target model training method according to an embodiment of the present application is shown.

[0192] like Figure 8 As shown, in this embodiment 800, the initial model 810 can be a neural network model of the Transformer architecture. The definition scope of the sample log sequence 801 is the same as that of the log sequence to be detected in the server anomaly detection method described above, and will not be repeated here.

[0193] First, a sample log sequence 801 is input into an initial model 810, which outputs a sample detection result 802. The sample detection result 802 represents the server predicted anomaly category associated with the sample log sequence. The sample label 803 indicates the anomaly category of the sample log sequence.

[0194] In the embodiment of the present application, the position encoding and feature fusion operations involved in using the initial model to process the sample log sequence to generate the sample detection result and the process of using the target model to process the log sequence to be detected to generate the first detection result in the server anomaly detection method described above are the same, and will not be repeated here.

[0195] In an embodiment of the present application, using an initial model, based on the timestamps of the sample logs in the sample log sequence, embedding position codes in the sample log sequence to generate features of the sample logs can include the following operations: based on the timestamps of the sample logs in the sample log sequence, obtaining the first sample time interval between sample logs with adjacent positions in the sample log sequence; based on the timestamps of the sample logs and the first sample time interval, generating sample position codes; embedding the sample position codes in the sample log sequence to generate features of the sample logs.

[0196] For example, the sample position code can be calculated based on the formula (3) described above, and the sample position code can be embedded in the sample log sequence to generate the features of the sample log.

[0197] Based on the time intervals between sample log events, the position encoding is dynamically adjusted so that the initial model learns the global temporal information of log events during training while also learning the density of sample log events, thereby improving the target model's ability to perceive the actual occurrence time and density of log events.

[0198] In an embodiment of the present application, the initial model is used to fuse the features of any sample log in the sample log sequence with the features of at least two sample logs in the respective adjacent sample log sequences based on the attention mechanism to generate a sample detection result, which may include the following operations: based on the attention mechanism, fusing the features of the sample log with the features of at least two adjacent sample logs to generate a sample fusion feature; and detecting the sample fusion feature to generate a sample detection result.

[0199] In some embodiments, based on the attention mechanism, the features of the sample log are fused with the features of at least two adjacent sample logs to generate sample fusion features, which may include the following operations: obtaining a sample penalty parameter based on the timestamps and sample information of the at least two sample logs; wherein the sample information is used to indicate whether the types of log events indicated by the at least two sample logs are the same; and based on the attention mechanism and the sample penalty parameter, the features of the sample log are fused with the features of at least two adjacent sample logs to generate sample fusion features.

[0200] For example, feature fusion can be performed based on formula (4) in the server anomaly detection method described above to generate sample fusion features, which will not be described in detail here.

[0201] Due to the repeated occurrence of log events in a short period of time caused by the triggering of the server automatic control mechanism, the model pays attention to the false detection events caused by the intensive occurrence of repeated log events. By introducing a penalty parameter in the attention mechanism, the model can learn the characteristics of the repeated occurrence of log events in a short period of time caused by the server automatic control mechanism in actual application scenarios, further improving the model's ability to perceive repeated events.

[0202] In an embodiment of the present application, obtaining a sample penalty parameter based on the timestamps and sample information of at least two sample logs may include the following operations: using an initial model to obtain a second time interval between at least two sample logs based on the timestamps of at least two sample logs; and using the initial model to generate a sample penalty parameter based on the second time interval and the sample information.

[0203] For example, the sample penalty parameter can be calculated based on formula (5) in the server anomaly detection method described above, which will not be described here.

[0204] By using the elements in the penalty matrix to measure the temporal proximity between different sample log events, the model can learn how to dynamically adjust to the penalty parameters that match the sample detection scenario requirements. This enables the trained model to dynamically determine the penalty parameters that match the actual detection scenario in the actual detection scenario, further improving the model's perception of the detection scenario.

[0205] Then, the loss value 804 can be calculated based on the target loss function shown in formula (7).

[0206] Next, operation S810 is performed to determine whether the loss value 804 has converged. If not, the model parameters are adjusted to continue training. If so, a target model 720 for executing the server anomaly detection method described above is obtained.

[0207] In an embodiment of the present application, the loss value convergence condition includes but is not limited to the loss value being less than a predetermined loss threshold or reaching the maximum number of training times.

[0208] Based on the above server anomaly detection method, the present application embodiment also provides a server anomaly detection device. Figure 9 Provide detailed explanation.

[0209] Figure 9 The figure shows a structural block diagram of a server anomaly detection device according to an embodiment of the present application.

[0210] like Figure 9 As shown, the server anomaly detection device 900 may include: a first encoding module 910, a first detection module 920 and an analysis module 930.

[0211] The first encoding module 910 is configured to, in response to determining that the initial detection result of the target server indicates an abnormality, embed a position code in the log sequence to be detected based on the timestamp of the log to be detected in the log sequence to generate a feature of the log to be detected using the target model.

[0212] The first detection module 920 is configured to utilize a target model to fuse features of any log to be detected with features of at least two adjacent logs to be detected based on an attention mechanism to generate a first detection result; wherein the log event types indicated by at least two logs to be detected are different.

[0213] Analysis module 930 is used to analyze the log sequence to be detected using a pre-trained language model in response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, and generate a second detection result; wherein the second detection result indicates the server anomaly type and the cause of the server anomaly.

[0214] According to an embodiment of the present application, the first encoding module 910 includes: a first obtaining submodule, a first generating submodule and an embedding submodule.

[0215] The first obtaining submodule is configured to obtain, based on the timestamps of the logs to be detected in the log sequence to be detected, a first time interval between adjacent logs to be detected in the log sequence to be detected.

[0216] The first generating submodule is configured to generate a location code based on a timestamp of the log to be detected and a first time interval.

[0217] The embedding submodule is used to embed position codes in the log sequence to be detected and generate features of the log to be detected.

[0218] According to an embodiment of the present application, the first detection module 920 may include: a first fusion submodule and a first detection submodule.

[0219] The first fusion submodule is configured to fuse the features of the log to be detected with the features of at least two adjacent logs to be detected based on an attention mechanism to generate a fused feature.

[0220] The first detection submodule is used to detect the fusion feature and generate a first detection result.

[0221] According to an embodiment of the present application, the first fusion submodule includes: a first obtaining unit and a first fusion unit.

[0222] The first obtaining unit is configured to obtain a penalty parameter according to the timestamps and target information of at least two logs to be detected; wherein the target information is used to indicate whether the types of log events indicated by the at least two logs to be detected are the same.

[0223] The first fusion unit is configured to fuse the features of the log to be detected with the features of at least two adjacent logs to be detected based on an attention mechanism and a penalty parameter to generate a fused feature.

[0224] According to an embodiment of the present application, the first obtaining unit includes: a first obtaining subunit and a first generating subunit.

[0225] The first obtaining subunit is configured to obtain a second time interval between at least two logs to be detected according to the timestamps of the at least two logs to be detected.

[0226] The first generating subunit is configured to generate a penalty parameter based on the second time interval and the target information.

[0227] According to an embodiment of the present application, the pre-trained language model includes: a first pre-trained language model for performing conflict identification and multiple second pre-trained language models for performing logical analysis; the analysis module 930 may include: a logical analysis sub-module, a conflict identification sub-module and a result fusion sub-module.

[0228] The logic analysis submodule is used to perform logic analysis on the logs to be detected based on the types of the logs to be detected in the log sequence, using the second pre-trained language model corresponding to each type, and generate multiple initial analysis results.

[0229] The conflict identification submodule is used to perform conflict identification on the multiple initial analysis results using the first pre-trained language model.

[0230] The first result fusion submodule is used to generate a second detection result for fusing the multiple initial analysis results when it is determined that there is no conflict between the multiple initial analysis results.

[0231] According to an embodiment of the present application, the analysis module 930 further includes: a direction generation submodule, a determination submodule, a correction submodule, an update submodule, and a second result fusion submodule.

[0232] The direction generation submodule is used to generate a direction to be corrected corresponding to the cause of the abnormality when it is determined that there is a conflict between multiple initial analysis results.

[0233] The determination submodule is used to determine a target initial analysis result associated with the direction to be corrected from the multiple initial analysis results.

[0234] The correction submodule is used to use the second pre-trained language model for outputting the target initial analysis result to correct the target initial analysis result based on the direction to be corrected, and generate an intermediate analysis result.

[0235] The updating submodule is used to update the target initial analysis result among the multiple initial analysis results to the intermediate analysis result to obtain multiple intermediate analysis results.

[0236] The second result fusion submodule is used to use the first pre-trained language model to identify conflicts among multiple intermediate analysis results, and generate a second detection result for fusing the multiple intermediate analysis results when it is determined that there is no conflict between the multiple intermediate analysis results.

[0237] According to an embodiment of the present application, the conflict identification submodule includes: a first acquisition unit and a first identification unit.

[0238] The first acquisition unit is used to acquire associated information associated with multiple initial analysis results based on a predetermined knowledge graph; wherein the predetermined knowledge graph indicates the topological relationship and failure mode between each component configured in the server.

[0239] The first recognition unit is configured to perform conflict recognition on the plurality of initial analysis results based on the association information by using the first pre-trained language model.

[0240] According to an embodiment of the present application, the first identification unit includes: an inference subunit and a determination subunit.

[0241] The reasoning subunit is configured to use the first pre-trained language model to perform causal reasoning on the multiple initial analysis results based on the associated information to generate at least two causes for causing the server abnormality.

[0242] The determining subunit is configured to determine that there is no conflict between the multiple initial analysis results in response to determining that there is a correlation between at least two causes; and determine that there is a conflict between the multiple initial analysis results in response to determining that there is no correlation between at least two causes.

[0243] According to an embodiment of the present application, the above-mentioned device may further include: a receiving module and an adjustment module.

[0244] The receiving module is configured to receive feedback information regarding the second detection result.

[0245] An adjustment module is used to adjust the processing strategy of the pre-trained language model based on feedback information; wherein the processing strategy includes at least one of the following: conflict identification strategy, logic analysis strategy, cause analysis strategy, and correction strategy.

[0246] According to an embodiment of the present application, the above-mentioned device may further include an acquisition module, a determination module, a decompression module and a parsing module.

[0247] The acquisition module is used to obtain the compressed file of the log to be detected.

[0248] The determination module is used to determine the type of the compressed file based on the content of the compressed file.

[0249] The decompression module is used to call the first tool to decompress the compressed file based on the type of the compressed file using the pre-trained language model to generate multiple log files.

[0250] The parsing module is used to use the pre-trained language model to call the second tool to parse multiple log files respectively to generate a log sequence to be detected.

[0251] According to an embodiment of the present application, the decompression module includes: a first determination submodule, a first generation submodule and a decompression submodule.

[0252] The first determining submodule is configured to determine parameter information of the first tool based on the type of the compressed file.

[0253] The first generating submodule is configured to generate first parameters for calling the first tool based on parameter information of the first tool by using a pre-trained language model.

[0254] The decompression submodule is used to call the first tool based on the first parameter to decompress the compressed file and generate multiple log files.

[0255] According to an embodiment of the present application, the parsing module includes: a second determination submodule, a second generation submodule and a parsing submodule.

[0256] According to an embodiment of the present application, the above-mentioned device also includes: a rule matching module, which is used to perform rule matching on the log sequence to be detected based on a predetermined rule base to generate an initial detection result; wherein the predetermined rule base includes multiple predetermined rules for detecting server anomalies; the correlation between the multiple predetermined rules is less than a predetermined correlation threshold.

[0257] Figure 10A structural block diagram of a target model training device according to an embodiment of the present application is shown.

[0258] like Figure 10 As shown, the target model training device 1000 may include: a second encoding module 1010, a second detection module 1020 and a training module 1030.

[0259] The second encoding module 1010 is configured to use the initial model to embed sample position codes in the sample log sequence based on the timestamps of the sample logs in the sample log sequence, thereby generating features of the sample logs.

[0260] The second detection module 1020 is used to use the initial model to fuse the features of any sample log in the sample log sequence with the features of at least two sample logs in the respective adjacent sample log sequences based on the attention mechanism to generate a sample detection result; the log event types indicated by at least two sample logs are different.

[0261] The training module 1030 is used to train the initial model based on the target loss function, sample detection results and sample labels to generate a target model.

[0262] According to an embodiment of the present application, the second encoding module 1010 includes: a second obtaining submodule, a second generating submodule and a second embedding submodule.

[0263] The second obtaining submodule is configured to obtain a first sample time interval between adjacent sample logs in the sample log sequence based on the timestamps of the sample logs in the sample log sequence.

[0264] The second generating submodule is configured to generate a sample position code based on the timestamp of the sample log and the first sample time interval.

[0265] The second embedding submodule is used to embed the sample position code in the sample log sequence to generate the features of the sample log.

[0266] According to an embodiment of the present application, the second detection module 1020 includes: a second fusion submodule and a second detection submodule.

[0267] The second fusion submodule is used to fuse the features of the sample log with the features of at least two adjacent sample logs based on the attention mechanism to generate a sample fusion feature.

[0268] The second detection submodule is used to detect the sample fusion features and generate sample detection results.

[0269] According to an embodiment of the present application, the second fusion submodule includes: a second obtaining unit and a second fusion unit.

[0270] The second obtaining unit is configured to obtain a sample penalty parameter according to the timestamps and sample information of at least two sample logs; wherein the sample information is used to indicate whether the types of log events indicated by the at least two sample logs are the same.

[0271] The second fusion unit is used to fuse the features of the sample log with the features of at least two adjacent sample logs based on the attention mechanism and the sample penalty parameter to generate a sample fusion feature.

[0272] According to an embodiment of the present application, the second fusion unit includes: a second obtaining subunit and a second generating subunit.

[0273] The second obtaining subunit is configured to obtain a second time interval between at least two sample logs according to the timestamps of the at least two sample logs using the initial model.

[0274] The second generating subunit is configured to generate a sample penalty parameter based on the second time interval and the sample information by using the initial model.

[0275] According to embodiments of the present application, any multiple modules among the first encoding module 910, the first detection module 920, and the analysis module 930, or the second encoding module 1010, the second detection module 1020, and the training module 1030 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present application, at least one of the first encoding module 910, the first detection module 920, and the analysis module 930, or the second encoding module 1010, the second detection module 1020, and the training module 1030 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the first encoding module 910, the first detection module 920 and the analysis module 930, or the second encoding module 1010, the second detection module 1020 and the training module 1030 can be at least partially implemented as a computer program module, which can perform the corresponding function when it is executed.

[0276] Figure 11 A block diagram of an electronic device suitable for implementing a server anomaly detection method or a target model training method according to an embodiment of the present application is shown.

[0277] like Figure 11 As shown, the electronic device 1100 according to an embodiment of the present application includes a processor 1101, which can perform various appropriate actions and processes according to the program stored in the ROM 1102 or the program loaded from the storage part 1108 into the RAM 1103. The processor 1101 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or related chipsets and / or a special-purpose microprocessor (such as an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present application. ROM is read-only memory, and RAM is random access memory.

[0278] Various programs and data required for the operation of the electronic device 1100 are stored in the RAM 1103. The processor 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. The processor 1101 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 1102 and / or the RAM 1103. It should be noted that the programs may also be stored in one or more memories other than the ROM 1102 and the RAM 1103. The processor 1101 may also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in the one or more memories.

[0279] According to an embodiment of the present application, electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to bus 1104. Electronic device 1100 may also include one or more of the following components connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 1108 including a hard disk; and a communication section 1109 including a network interface card such as a LAN card or modem. Communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. Removable media 1111, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 1110 as needed, so that computer programs read from the removable media can be installed into storage section 1108 as needed.

[0280] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0281] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 902 and / or RAM 1103 described above, and / or one or more memories other than ROM 1102 and RAM 1103.

[0282] Embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the server anomaly detection method or target model training method provided in the embodiments of the present application.

[0283] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the computer program is executed by the processor 1101. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0284] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0285] In such an embodiment, the computer program can be downloaded and installed from the network through the communication section 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above-mentioned functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0286] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0287] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0288] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

[0289] The embodiments of the present application have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present application, those skilled in the art may make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present application.

Claims

1. A server anomaly detection method, characterized in that: The method comprises: In response to determining that the initial detection result of the target server indicates an abnormality, using the target model, based on timestamps of the logs to be detected in the sequence of logs to be detected, obtain a first time interval between adjacent logs to be detected in the sequence of logs to be detected; Based on the timestamp of the log to be detected, generating a position code of the absolute time for retaining the global timing information of the log event; Based on the first time interval, generating a position code of a relative time interval for capturing a local temporal relationship between adjacent log events; Embedding the position code of the absolute time and the position code of the relative time interval in the log sequence to be detected to generate features of the log to be detected; Using the target model, and based on an attention mechanism, fusing features of any log to be detected with features of at least two adjacent logs to be detected to generate a first detection result; wherein the log event types indicated by the at least two logs to be detected are different; and In response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, the log sequence to be detected is analyzed using a pre-trained language model to generate a second detection result; wherein, the second detection result indicates the server anomaly type and the cause of the server anomaly.

2. The method according to claim 1, characterized in that The generating a first detection result by utilizing the target model and fusing the features of any log to be detected with the features of at least two adjacent logs to be detected based on an attention mechanism includes: Based on the attention mechanism, the feature of the log to be detected is fused with the features of the at least two adjacent logs to be detected to generate a fused feature; and The fusion feature is detected to generate the first detection result.

3. The method according to claim 2, characterized in that The step of fusing the feature of the log to be detected with the features of the at least two adjacent logs to be detected based on the attention mechanism to generate a fused feature includes: Obtaining a penalty parameter based on the timestamps and target information of at least two logs to be detected; wherein the target information is used to indicate whether the types of log events indicated by the at least two logs to be detected are the same; and Based on the attention mechanism and the penalty parameter, the feature of the log to be detected is fused with the features of the at least two adjacent logs to be detected to generate the fused feature.

4. The method according to claim 3, characterized in that Obtaining a penalty parameter based on the timestamps and target information of at least two logs to be detected includes: Obtaining a second time interval between the at least two logs to be detected according to the timestamps of the at least two logs to be detected; and The penalty parameter is generated based on the second time interval and the target information.

5. The method according to claim 1, wherein The pre-trained language models include: a first pre-trained language model for performing conflict identification and a plurality of second pre-trained language models for performing logic analysis; In response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, analyzing the log sequence to be detected using a pre-trained language model to generate a second detection result includes: Based on the types of the logs to be detected in the sequence of logs to be detected, using a second pre-trained language model corresponding to each type to perform logical analysis on the logs to be detected, and generate multiple initial analysis results; performing conflict identification on the plurality of initial analysis results using the first pre-trained language model; and In the case where it is determined that no conflict exists between the multiple initial analysis results, a second detection result for fusing the multiple initial analysis results is generated.

6. The method according to claim 5, characterized in that In response to determining that the first detection result includes at least two anomaly types whose correlation is less than a predetermined threshold, analyzing the log sequence to be detected using a pre-trained language model to generate a second detection result, further comprising: If it is determined that there is a conflict between the plurality of initial analysis results, generating a direction to be corrected corresponding to the cause of the abnormality; determining a target initial analysis result associated with the direction to be corrected from the plurality of initial analysis results; Correcting the target initial analysis result based on the direction to be corrected using a second pre-trained language model for outputting the target initial analysis result to generate an intermediate analysis result; Updating a target initial analysis result among the multiple initial analysis results to the intermediate analysis result to obtain multiple intermediate analysis results; and Conflict identification is performed on the multiple intermediate analysis results using the first pre-trained language model, and when it is determined that no conflict exists between the multiple intermediate analysis results, a second detection result for fusing the multiple intermediate analysis results is generated.

7. The method according to claim 5, characterized in that The performing conflict identification on the multiple initial analysis results using the first pre-trained language model includes: Based on a predetermined knowledge graph, obtaining association information associated with the plurality of initial analysis results; wherein the predetermined knowledge graph indicates topological relationships and failure modes between components configured in the server; and Utilizing the first pre-trained language model, conflict identification is performed on the multiple initial analysis results based on the association information.

8. The method according to claim 7, characterized in that The using the first pre-trained language model to perform conflict identification on the multiple initial analysis results based on the association information includes: Using the first pre-trained language model, perform causal reasoning on the multiple initial analysis results based on the association information to generate at least two causes causing the server abnormality; In response to determining that the at least two causes are associated with each other, determining that there is no conflict between the plurality of initial analysis results; and In response to determining that the at least two causes are not associated with each other, it is determined that there is a conflict between the plurality of initial analysis results.

9. The method according to any one of claims 5 to 8, characterized in that The method further comprises: receiving feedback information regarding the second detection result; and Based on the feedback information, a processing strategy of the pre-trained language model is adjusted; wherein the processing strategy includes at least one of the following: a conflict identification strategy, a logic analysis strategy, a cause analysis strategy, and a correction strategy.

10. The method according to claim 1, characterized in that The method further comprises: Get the compressed file of the log to be tested; Determining the type of the compressed file based on the content of the compressed file; Based on the type of the compressed file, calling a first tool to decompress the compressed file using the pre-trained language model to generate a plurality of log files; and The pre-trained language model is used to call a second tool to parse the multiple log files respectively to generate the log sequence to be detected.

11. The method according to claim 10, characterized in that The method of decompressing the compressed file by using the pre-trained language model based on the type of the compressed file to generate multiple log files includes: Determining parameter information of the first tool based on the type of the compressed file; generating, using the pre-trained language model and based on parameter information of the first tool, a first parameter for calling the first tool; and The first tool is called based on the first parameter to decompress the compressed file and generate multiple log files.

12. The method according to claim 10, characterized in that The method of using the pre-trained language model to call a second tool to parse the plurality of log files respectively to generate the log sequence to be detected includes: Determining parameter information of the second tool based on the analysis requirements of the log to be detected; generating, using the pre-trained language model and based on the parameter information of the second tool, a second parameter for calling the second tool; and The second tool is called based on the second parameter to parse the multiple log files and generate the log sequence to be detected.

13. The method according to claim 1, wherein The method further comprises: Based on a predetermined rule base, rule matching is performed on the log sequence to be detected to generate the initial detection result; The predetermined rule base includes a plurality of predetermined rules for detecting server anomalies; and the correlation between the plurality of predetermined rules is less than a predetermined correlation threshold.

14. A method for training a target model, comprising: Obtaining, by using the initial model and based on timestamps of the sample logs in the sample log sequence, a first sample time interval between adjacent sample logs in the sample log sequence; Based on the timestamp of the sample log, generating a position code of the sample absolute time for retaining the global timing information of the sample log event; Based on the first sample time interval, generating a position code of a sample relative time interval for capturing a local temporal relationship between adjacent sample log events; Embedding the position code of the absolute time of the sample and the position code of the relative time interval of the sample in the sample log sequence to generate features of the sample log; Using the initial model, a feature of any sample log in the sample log sequence is fused with features of at least two sample logs in the respective adjacent sample log sequences based on an attention mechanism to generate a sample detection result; the log event types indicated by the at least two sample logs are different; Training the initial model based on the target loss function, the sample detection results, and the sample labels to generate a target model according to any one of claims 1 to 13; The target loss function includes parameters for dynamically calling sample category weights and sample recognition difficulty weights; and the sample label indicates the abnormal category of the sample log sequence.

15. The method according to claim 14, characterized in that The generating of a sample detection result by utilizing the initial model and fusing the features of any sample log in the sample log sequence with the features of at least two sample logs in the adjacent sample log sequences based on an attention mechanism includes: Based on the attention mechanism, the feature of the sample log is fused with the features of the at least two adjacent sample logs to generate a sample fusion feature; and The sample fusion feature is detected to generate the sample detection result.

16. The method according to claim 15, characterized in that The step of fusing the feature of the sample log with the features of the at least two adjacent sample logs based on the attention mechanism to generate a sample fusion feature includes: Obtaining a sample penalty parameter based on the timestamps and sample information of at least two sample logs; wherein the sample information is used to indicate whether the types of log events indicated by the at least two sample logs are the same; and Based on the attention mechanism and the sample penalty parameter, the feature of the sample log is fused with the features of the at least two adjacent sample logs to generate the sample fusion feature.

17. The method according to claim 16, characterized in that The obtaining of a sample penalty parameter according to the timestamps and sample information of at least two sample logs includes: Using the initial model, and according to the timestamps of the at least two sample logs, obtaining a second time interval between the at least two sample logs; and The sample penalty parameter is generated by utilizing the initial model based on the second time interval and the sample information.

18. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 17.

Images