System log detection method and device based on spiking neural network and storage medium

Abstract

The invention belongs to the technical field of distributed system management and maintenance, and discloses a system log detection method and device based on a spiking neural network and a storage medium, and the method comprises the steps: achieving the semantic embedding of each log in a log sequence through a pre-training T5 model, and obtaining a word embedding sequence of context semantic association; then, pulse feature coding is carried out on the log semantic information to capture semantic information and time dynamic in the embedded words, and therefore effective packaging of log semantics and time information can be achieved, and a space-time pulse sequence is obtained; and finally, inputting the pulse sequence into the trained pulse neural network model to obtain a log anomaly detection result. Therefore, the time and semantic information of the logs can be effectively packaged, and meanwhile, the association relationship between the logs is captured by virtue of the T5 model and the spiking neural network model, so that the anomaly detection of the logs based on log association and time sensitivity is realized; in this way, the effectiveness and accuracy of log anomaly detection are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of system management and maintenance in a distributed system, and particularly relates to a system log detection method, device and storage medium based on a spiking neural network. Background Art

[0002] Log anomaly detection has become a key task in system management and maintenance of large-scale distributed systems. Logs are the main data sources for tracing system activities and events, and detecting anomalies therein is crucial for identifying faults, security vulnerabilities, and operational inefficiencies. In the actual application process, a fundamental challenge in system log anomaly detection lies in how to effectively represent log data, and such representation needs to encapsulate both time information and semantic information at the same time. Among them, traditional models are not only difficult to cope with the high irregularity and sparsity of system logs, thus unable to effectively represent log data, but also unable to capture the dependencies between logs. In security-critical applications, subtle anomalies in log entries may be early signs of serious problems, but traditional methods often cannot detect such subtle and time-sensitive events, so it is easy to cause false alarms or missed detections. Therefore, based on the above deficiencies, how to provide a system log detection method based on a spiking neural network with high log detection accuracy has become an urgent problem to be solved. Summary of the Invention

[0003] The technical problem to be solved by the present invention is the problem of log anomaly detection in a distributed system. The purpose is to provide a system log detection method, device and storage medium based on a spiking neural network, which solves the problem of easy false alarms or missed detections caused by the inability to effectively encapsulate the time and semantic information of logs and the inability to capture the dependencies between logs in the traditional technology.

[0004] The present invention is achieved by the following technical solutions: In a first aspect, a system log detection method based on a spiking neural network is provided, including: Obtain a system log sequence, where the system log sequence includes a number of system logs; Input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence includes a number of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes the semantic information of the system log corresponding to the any word embedding vector; Perform spiking feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal spiking sequence corresponding to each word embedding vector, and use the obtained spatio-temporal spiking sequences to form a log spiking sequence; Input the log pulse sequence into the log anomaly detection model to obtain the anomaly detection result corresponding to the system log sequence, where the log anomaly detection model uses a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

[0005] Based on the above disclosed content, after obtaining the system log sequence, the present invention first inputs it into the pre-trained T5 model to generate a set of continuous word embedding vectors by using the T5 model, where each word embedding vector contains the semantic information of the corresponding system log. Therefore, the word embedding sequence formed by several word embedding vectors can not only capture the semantics of the log but also capture the context relationship between each log in the sequence. Thus, the semantic embedding based on context association is realized; after obtaining the word embedding sequence corresponding to the system log sequence, pulse feature encoding processing can be performed on it to obtain the spatio-temporal pulse sequence corresponding to each word embedding vector; in this way, by performing pulse feature encoding (i.e., time encoding) on the word embedding sequence, the semantic information and its time dynamics in the embedded words can be captured simultaneously, and a spatio-temporal pulse sequence suitable for processing by the pulse neural network can be formed; based on this, the effective encapsulation of the system log semantics and time information can be realized; finally, input the log pulse sequence obtained after pulse feature encoding into the trained pulse neural network model, and the powerful time processing ability of the pulse neural network can be used to realize the anomaly detection of the time-sensitive log sequence, and then the accurate anomaly detection result of the system log can be obtained.

[0006] Through the above design, the present invention first uses the pre-trained T5 model to realize the semantic embedding of each system log in the system log sequence, so as to obtain a context-related word embedding sequence containing log semantic information; then, perform pulse feature encoding on it to capture the semantic information and its time dynamics in the embedded words simultaneously. In this way, the effective encapsulation of the system log semantics and time information can be realized, and then a spatio-temporal pulse sequence suitable for processing by the pulse neural network can be obtained; finally, input the encoded pulse sequence into the trained pulse neural network model, and the anomaly detection result of the system log sequence can be obtained; thus, compared with the traditional technology, the present invention can effectively encapsulate the time and semantic information of the log, and at the same time use the T5 model and the pulse neural network model to capture the correlation relationship between the logs, so as to realize the anomaly detection of the log sequence based on log association and time sensitivity; in this way, the present invention improves the effectiveness and accuracy of log anomaly detection, and is therefore very suitable for large-scale application and promotion.

[0007] In a possible design, any word embedding vector contains d word embeddings, and d is the word embedding dimension of the pre-trained T5 model; Among them, performing impulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal impulse sequence corresponding to each word embedding vector includes: For each word embedding in any word embedding vector, use the following formula (1) to perform impulse feature encoding processing on each word embedding to obtain an impulse encoding corresponding to each word embedding, and use the impulse encodings corresponding to each word embedding to form the spatio-temporal impulse sequence corresponding to the any word embedding vector; (1) In the above formula (1), represents the impulse encoding corresponding to the i-th word embedding in the any word embedding vector, represents the scaling factor of the i-th dimension in the any word embedding vector, represents the i-th word embedding, represents the encoding function of the i-th word embedding at the t-th time step; Among them,

[0008] In the formula, represents the activation function, represents the frequency parameter for controlling impulse oscillation, represents the phase shift of the i-th dimension.

[0009] In a possible design, the log anomaly detection model is trained in the following manner; Obtain a training data set, where the training data set includes log impulse sequences corresponding to several sample system log sequences, and the label of each sample system log sequence, and the label of any sample system log sequence is used to characterize whether each sample system log in the any sample system log sequence is an abnormal log; Perform data partitioning processing on the training data set to obtain training data corresponding to each training batch; For the training data corresponding to the k-th training batch in the training data set, use the training data corresponding to the k-th training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch as the output to train the spiking neural network model, and during the training process, calculate a loss function based on the output of the spiking neural network model and the labels of each sample system log sequence; Freeze all model parameters in the spiking neural network model except the target parameters, and use the loss function to perform fine-tuning processing on the target parameters to obtain the spiking neural network model after the k-th training after the fine-tuning processing, where the target parameters include the weights of each network layer in the spiking neural network model; Update the spiking neural network model to the spiking neural network model after the k-th training, increment k by 1, and retrain the spiking neural network model with the training data corresponding to the k-th training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch as the output, until k equals K or the loss function converges, to obtain the log anomaly detection model, where the initial value of k is 1 and K is the total number of training batches.

[0010] In a possible design, calculate the loss function based on the output of the spiking neural network model and the labels of each sample system log sequence, including: Calculate the loss function using the following formula (2); (2) In the above formula (2), represents the loss function, represents the predicted value of the sample system log sequence corresponding to the n-th time step in the training data corresponding to the k-th training batch , and the label of the sample system log sequence corresponding to the n-th time step The error between them, represents the regularization coefficient, represents the L2 regularization of the target parameter, where represents the total number of time steps, and one time step corresponds to one sample system log sequence in the k-th training batch.

[0011] In a possible design, use the loss function to fine-tune the target parameter to obtain the spiking neural network model after the k-th training after the fine-tuning, including: Based on the spike activation function of any neuron in the spiking neural network model, calculate the generation gradient of the any neuron at different time steps during the k-th training. During the k-th training, each training data in the k-th training batch input corresponds to a time step, and the generation gradient of the any neuron at different time steps is used to represent the generation gradient of the any neuron relative to each training data after inputting each training data in the k-th training batch into the spiking neural network model; Calculate the gradient of the loss function with respect to the target parameter according to the generation gradient of the any neuron at different time steps and the loss function; Use the gradient of the loss function with respect to the target parameter to update the target parameter to obtain the spiking neural network model after the k-th training after updating the target parameter.

[0012] In a possible design, based on the impulse activation function of any neuron in the spiking neural network model, calculating the generation gradient of the any neuron at different time steps during the k-th training includes: For the n-th time step, obtaining the membrane potential of the any neuron at the n-th time step during the k-th training; Using the membrane potential of the any neuron at the n-th time step and the impulse activation function of the any neuron, and adopting the following formula (3), calculating the generation gradient of the any neuron at the n-th time step; (3) In the above formula (3), represents the generation gradient of the any neuron at the n-th time step, represents the partial derivative of the impulse activation function of the any neuron with respect to the membrane potential of the any neuron at the n-th time step, represents the impulse activation function of the any neuron, represents the membrane potential of the any neuron at the n-th time step; wherein, , in the formula, represents the decay factor, represents the membrane potential of the any neuron at the (n - 1)-th time step, represents the impulse input of the any neuron at the n-th time step.

[0013] In a possible design, according to the generation gradient of the any neuron at different time steps and the loss function, calculating the gradient of the loss function with respect to the target parameter includes: Calculating the gradient of the loss function with respect to the target parameter according to the following formula (4); (4) In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the generation gradient of the any neuron at the n-th time step, represents the initial gradient of the loss function with respect to the target parameter, wherein, represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

[0014] In a second aspect, a system log detection device based on a spiking neural network is provided, including: An acquisition unit, configured to acquire a system log sequence, wherein the system log sequence includes a plurality of system logs; A word embedding unit for inputting the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector; An encoding unit for performing pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal pulse sequence corresponding to each word embedding vector, and using the obtained spatio-temporal pulse sequences to form a log pulse sequence; An anomaly detection unit for inputting the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, where the log anomaly detection model uses a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of a plurality of sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

[0015] In a third aspect, another system log detection device based on a pulse neural network is provided. Taking the device as an electronic device as an example, it includes a memory, a processor, and a transceiver that are communicatively connected in sequence. The memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the system log detection method based on a pulse neural network as described in the first aspect or any possible design in the first aspect.

[0016] In a fourth aspect, a storage medium is provided, on which instructions are stored. When the instructions are run on a computer, the system log detection method based on a pulse neural network as described in the first aspect or any possible design in the first aspect is executed.

[0017] In a fifth aspect, a computer program product containing instructions is provided. When the instructions are run on a computer, the computer is made to execute the system log detection method based on a pulse neural network as described in the first aspect or any possible design in the first aspect.

[0018] Compared with the prior art, the present invention has the following advantages and beneficial effects: (1) The present invention first uses a pre-trained T5 model to achieve semantic embedding of each system log in the system log sequence, thereby obtaining a contextually related word embedding sequence that contains log semantic information. Then, pulse feature encoding is performed on it to simultaneously capture the semantic information and its temporal dynamics in the embedded words. In this way, effective encapsulation of system log semantics and time information can be achieved, and then a spatio-temporal pulse sequence suitable for processing by a spiking neural network can be obtained. Finally, the encoded pulse sequence is input into the trained spiking neural network model, and the anomaly detection result of the system log sequence can be obtained. Thus, compared with traditional technologies, the present invention can effectively encapsulate the time and semantic information of logs, and at the same time use the T5 model and the spiking neural network model to capture the correlation relationship between logs, thereby realizing the anomaly detection of log sequences based on log correlation and time sensitivity. In this way, the present invention improves the effectiveness and accuracy of log anomaly detection, and is thus very suitable for large-scale application and promotion.

[0019] (2) The present invention uses a spiking neural network for log anomaly detection. Its internal neurons generate spikes only when the membrane potential reaches the threshold, while traditional neural networks output continuous values at each time step. Therefore, the amount of model data is greatly reduced, thereby reducing the memory occupancy. Based on this, it can be deployed in resource-constrained environments (such as edge computing devices), and thus provides a feasible deployment solution for resource-constrained environments.

[0020] (3) During training, the present invention uses a fine-tuning technique to adjust model parameters, that is, freeze the model parameters in the spiking neural network except for the weight parameters, and then use the generation gradients of neurons at different time steps. Then, combined with the initial gradient of the loss function with respect to the weights, the final gradient of the loss function with respect to the weights is obtained, and this is used for the backward update of the weights. In this way, using the fine-tuning technique can reduce the computational complexity and the required amount of resources and memory space. At the same time, fine-tuning the weights can also make the model more suitable for the log anomaly detection task, and thus improve the performance of the model in the system log anomaly detection task. Description of the Drawings

[0021] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings. In the drawings: Figure 1 It is a schematic flowchart of the steps of the system log detection method based on a spiking neural network provided by an embodiment of the present invention; Figure 2Schematic diagram for detection and comparison of different models provided by embodiments of the present invention; Figure 3 Schematic diagram of the structure of a system log detection device based on a spiking neural network provided by embodiments of the present invention; Figure 4 Schematic diagram of the structure of an electronic device provided by embodiments of the present invention. Detailed implementation manners

[0022] To make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below in conjunction with embodiments and drawings. The illustrative embodiments of the present invention and their descriptions are only used to explain the present invention and do not limit the present invention; it should be understood that although terms such as first and second may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, the first unit may be referred to as the second unit, and similarly, the second unit may be referred to as the first unit, without departing from the scope of the exemplary embodiments of the present invention.

[0023] Embodiment: Refer to Figure 1 As shown, the system log detection method based on a spiking neural network provided in this embodiment uses a pre-trained T5 model to implement semantic embedding of system log sequences, thereby generating a word embedding sequence that connects context semantics; then, pulse feature encoding is performed on the word embedding sequence to simultaneously capture the semantic information and its time dynamics in the embedded words. In this way, effective encapsulation of system log semantics and time information can be achieved, and then a spatio-temporal pulse sequence suitable for processing by a spiking neural network model can be obtained; then, it is input into the trained spiking neural network model, and the anomaly detection result of the system log sequence can be obtained; thus, this method can effectively encapsulate the time and semantic information of the log, and at the same time, with the help of the T5 model and the spiking neural network model, capture the correlation between logs. Based on this, anomaly detection of log sequences based on log correlation and time sensitivity can be achieved; therefore, this method improves the effectiveness and accuracy of log anomaly detection, and is thus very suitable for large-scale application and promotion; among them, for example, this method can be applied but not limited to running on the system monitoring side. Optionally, the system monitoring side can be but not limited to a server or an edge device. It can be understood that the foregoing execution subject does not constitute a limitation to the embodiments of the present application. Correspondingly, the running steps of this method can be but not limited to the following steps S1 to S4.

[0024] S1. Obtain a system log sequence, where the system log sequence contains a number of system logs; in specific applications, it can, but is not limited to, continuously read the system logs generated during the operation of a distributed system to form a system log sequence; thus, after obtaining a system log sequence composed of a number of system logs during the operation of a distributed system, anomaly detection can be performed on it, and based on the anomaly detection results, the management and maintenance of the distributed system can be carried out.

[0025] In this embodiment, an improved anomaly detection method combining a pre-trained T5 model and a spiking neural network (SNN) is provided. This method can effectively encapsulate the time and semantic information of logs, and at the same time, with the help of the T5 model and the spiking neural network, capture the associations between logs, so as to realize the anomaly detection of log sequences based on log associations and time sensitivity; among them, the log anomaly detection process is mainly divided into three parts: semantic embedding, spiking feature encoding, and model detection, and its process can, but is not limited to, the following steps S2 - S4.

[0026] S2. Input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence contains a number of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector contains the semantic information of the system log corresponding to the any word embedding vector; in specific applications, the T5 model is a neural network model for natural language processing. It can process the input data sequence and generate a set of continuous embeddings, where each embedding encodes the semantic information of each data in the data sequence at the current time step, and these embeddings can not only capture the word meaning of the data, but also capture the context relationship between the data in the sequence. Therefore, it is very suitable for the anomaly detection task; based on this, in this embodiment, based on this pre-trained T5 model, the semantic embedding of the system log sequence is realized, so as to generate a word embedding sequence with context semantic associations.

[0027] Optionally, for example, the system log sequence is represented as: , where, is the th system log in the system log sequence (b = 1, 2,..., B), represents the total length of the system log sequence. Therefore, after inputting it into the pre-trained T5 model, a set of continuous embeddings (i.e., the aforementioned word embedding sequence) can be obtained, and it can be expressed as: , in the formula, represents the embedding corresponding to the th system log, that is, corresponding word embedding vector.

[0028] Furthermore, any word embedding vector contains d word embeddings, that is , where represents the d-th word embedding at the current time step t, and d represents the word embedding dimension of the pre-trained T5 model; therefore, the pre-trained T5 model encodes each system log in the system log sequence into a word embedding vector with a dimension of d; at the same time, after the system log sequence is input into the pre-trained T5 model, through the operation and processing of its internal multi-head attention and multi-layer perceptron, a word embedding sequence is finally generated (that is, obtained by weighted sum calculation using the embedding matrix and position encoding matrix of multi-head attention and multi-layer perception); of course, the pre-trained T5 model is an existing model for generating word embeddings, and its internal operation principle will not be elaborated here.

[0029] After completing the semantic embedding of the system log sequence, time encoding (pulse feature encoding) can be performed to simultaneously capture the semantic information and its time dynamics in the embedded words, so as to generate a spatio-temporal pulse sequence suitable for processing by a spiking neural network. Among them, the pulse feature encoding process can be but is not limited to the following steps shown in S3.

[0030] S3. Perform pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal pulse sequence corresponding to each word embedding vector, and use the obtained spatio-temporal pulse sequences to form a log pulse sequence; in this embodiment, the pulse feature encoding is essentially time encoding, which is used to capture the semantic information and its time dynamics in the embedded words (that is, the aforementioned word embeddings), and at the same time effectively represent high-dimensional continuous data as pulse signals for subsequent processing by a spiking neural network, so as to detect abnormal situations in the system logs.

[0031] Optionally, the pulse feature encoding maps the embedding values (that is, word embeddings) in each word embedding vector to time-based pulse encoding. In this way, combined with the aforementioned embedding dimension, each word embedding vector can be converted into a spatio-temporal pulse sequence based on the current time step t (that is, combining the time dimension and the embedding dimension to obtain the spatio-temporal pulse sequence); among them, the following takes any word embedding vector as an example to specifically elaborate, and its encoding process is as follows: For each word embedding in any word embedding vector, perform pulse feature encoding processing on each word embedding to obtain the pulse encoding corresponding to each word embedding, and use the pulse encoding corresponding to each word embedding to form the spatio-temporal pulse sequence corresponding to the any word embedding vector.

[0032] Among them, for example, but not limited to, the following formula (1) can be used to perform pulse feature encoding on each word embedding.

[0033] (1) In the above formula (1), represents the pulse coding corresponding to the i-th word embedding in any of the word embedding vectors, represents the scaling factor (a preset value) of the i-th dimension in any of the word embedding vectors, represents the i-th word embedding, represents the encoding function of the i-th word embedding at the t-th time step; in this embodiment, the t-th time step is the current time step, that is, the generation time of the system log sequence.

[0034] Further,

[0035] In the formula, represents the activation function, represents the frequency parameter that controls the pulse oscillation, represents the phase shift of the i-th dimension; in specific applications, for example, the activation function can be but is not limited to the sigmoid activation function, which is used to ensure that the pulse value remains within a bounded range while the cosine function introduces the necessary time oscillation to ensure that the pulse changes with time. At the same time, the frequency parameter and the phase shift can control the time interval of the pulse, so that the model can capture the temporal dynamics of the system log. These temporal features are crucial for accurate anomaly detection because abnormal patterns usually manifest as unusual temporal sequences; based on this, the purpose of feature encoding is to encode the word embedding vector into a pulse sequence while retaining the time features of the log data; in addition, the phase shift of the aforementioned i-th dimension is a constant and can be preset in advance.

[0036] Thus, through the aforementioned formula (1), the pulse coding of each word embedding in any of the word embedding vectors can be achieved. In this way, each pulse coding can be used to form the spatio-temporal pulse sequence corresponding to any of the word embedding vectors , that is , of course, the pulse feature encoding process of the remaining word embedding vectors is the same as the encoding process of any of the word embedding vectors mentioned above, and will not be elaborated here.

[0037] Through the above design, the pulse feature encoding can incorporate time dynamics into the encoding process, thereby realizing the effective encapsulation of the semantics and time information of the log sequence; based on this, by converting each semantic embedding encoding into a spatio-temporal pulse sequence, the time characteristics of the log data can be utilized, and with the help of the pulse neural network model, accurate anomaly detection of the system log can be achieved.

[0038] Among them, the log anomaly detection process can be but is not limited to the steps shown in the following step S4.

[0039] S4. Input the log pulse sequence into the log anomaly detection model to obtain the anomaly detection result corresponding to the system log sequence. Among them, the log anomaly detection model uses a trained spiking neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

[0040] In this embodiment, for example, a trained spiking neural network model is used to detect anomalies in system logs, that is: generate the spatio-temporal pulse sequence corresponding to each word embedding vector, and after forming the log pulse sequence corresponding to the entire system log sequence, it can be transmitted to the trained spiking neural network model for processing; specifically, in the spiking neural network model, each neuron maintains a membrane potential and updates it according to the input pulses at each time step. Therefore, it provides a biologically inspired mechanism to activate neurons according to the incoming pulse sequence, thereby allowing the spiking neural network to effectively process the encoded time information and detect anomalies in the system log sequence data.

[0041] Among them, one of the training processes of the foregoing log anomaly detection model is disclosed as shown in the following steps S41 to S45.

[0042] S41. Obtain a training data set. Among them, the training data set includes the log pulse sequences corresponding to several sample system log sequences and the label of each sample system log sequence, and the label of any sample system log sequence is used to characterize whether each sample system log in the any sample system log sequence is an abnormal log; in this embodiment, for the generation process of the log pulse sequences corresponding to each sample system log sequence, reference can be made to the foregoing steps S1 to S3, which will not be elaborated here; at the same time, for example, the label of any sample system log sequence is a vector, and the vector contains the label values of each sample system log in the any sample system log sequence, and the label value of any sample system log is 1 or 0, where 1 indicates that the any sample system log is an abnormal log, and 0 indicates that the any sample system log is a normal log.

[0043] In this way, after obtaining the training data set, the total number of training batches can be determined, and based on the total number of training batches, the training data set can be divided, and the process is as shown in the following step S42.

[0044] S42. Perform data partitioning processing on the training data set to obtain the training data corresponding to each training batch; in specific implementation, the total number of training batches can be specifically set according to actual use and will not be specifically limited here; therefore, after obtaining the training data corresponding to each training batch according to the total number of training batches, the spiking neural network model can be trained in multiple batches.

[0045] Among them, in specific applications, this embodiment provides a model fine-tuning technique to enhance the learning ability of the spiking neural network, so as to learn signals more effectively and optimize the performance of the model in the system log anomaly detection task; at the same time, using the fine-tuning technique for model training can also reduce the amount of resources and memory space required for model training, thereby reducing the hardware requirements.

[0046] Optionally, the model fine-tuning process can be but is not limited to the steps shown in S43 to S45 below.

[0047] S43. For the training data corresponding to the k-th training batch in the training dataset, use the training data corresponding to the k-th training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch as the output to train the spiking neural network model. During the training process, calculate the loss function based on the output of the spiking neural network model and the labels of each sample system log sequence.

[0048] In this embodiment, assume that the training data of one training batch is 10. Then, one training batch contains 10 log pulse sequences corresponding to 10 sample system log sequences. Based on this, the 10 log pulse sequences corresponding to 10 sample system log sequences are sequentially input into the spiking neural network model to complete the model training of this training batch.

[0049] Furthermore, in each training batch of this embodiment, the model output and labels corresponding to the training data of each training batch are used to calculate the loss function, and based on this, the parameter fine-tuning of the spiking neural network model is performed; among them, this embodiment mainly fine-tunes the weight parameters of each network layer in the spiking neural network model to improve the anomaly detection ability; optionally, in specific applications, each sample system log sequence in each training batch corresponds to a time step. Therefore, at the k-th training batch, it is equivalent to using the model output and labels corresponding to all time steps (i.e., all training data in this batch) in the k-th training batch to calculate the loss function at the k-th training.

[0050] Among them, the following discloses the calculation process of the loss function of the spiking neural network model in the k-th training batch: In this embodiment, for example, but not limited to, the following formula (2) can be used to calculate the loss function.

[0051]

[0052] In the above formula (2), represents the loss function, Denote the predicted value of the sample system log sequence corresponding to the n-th time step in the training data corresponding to the k-th training batch (In this embodiment, what the spiking neural network model outputs are the binary classification values of each sample system log in the sample system log sequence, that is, 1 or 0. Therefore, it is also a vector containing 1 or 0), and the label of the sample system log sequence corresponding to the n-th time step The error between them Denote the regularization coefficient Denote the L2 regularization of the target parameter, where Denote the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

[0053] In this way, through the foregoing formula (2), the loss function of the spiking neural network model in the k-th training batch can be calculated; then, based on the loss function, the weight fine-tuning can be performed, and the process is as shown in the following step S44.

[0054] S44. Freeze all model parameters except the target parameter in the spiking neural network model, and use the loss function to perform fine-tuning on the target parameter to obtain the spiking neural network model after the k-th training after the fine-tuning process, where the target parameter includes the weights of each network layer in the spiking neural network model; in this embodiment, different from the traditional network, the spiking neural network (SNN) is event-driven and involves spike events rather than continuous activations. Therefore, when performing backpropagation through errors, these discrete spike events must be taken into account; based on this, this embodiment provides a backpropagation method that combines the loss function and the gradient of the neuron with respect to the membrane potential (that is, the new gradient of the following loss function with respect to the target parameter) to update the model parameters, so as to use the continuous dynamics of the approximate membrane potential to improve the model's ability to distinguish spike events.

[0055] Optionally, the following steps S44a to S44c can be used as an example to implement the k-th fine-tuning of the spiking neural network model.

[0056] S44a. Calculate the generation gradient of any neuron in the spiking neural network model at different time steps during the k-th training based on the spike activation function of any neuron in the spiking neural network model. During the k-th training, each training data in the k-th training batch corresponds to a time step, and the generation gradient of any neuron at different time steps is used to represent the generation gradient of any neuron with respect to each training data after inputting each training data in the k-th training batch into the spiking neural network model. In this embodiment, as previously described, one training data in the k-th training batch corresponds to one time step. Therefore, for each time step in the model (i.e., each time a training data is input), each neuron corresponds to a membrane potential. Thus, to calculate the gradient during the backpropagation process, this embodiment first calculates the generation gradient of the neuron at different time steps, and then combines the initial gradient of the loss function with respect to the target parameter to obtain the gradient of the loss function with respect to the target parameter, that is, the gradient with respect to the weight parameter.

[0057] Further, taking the n-th time step during the k-th training process as an example for illustration, the process is as follows: First, obtain the membrane potential of any neuron at the n-th time step during the k-th training; then, use the membrane potential of any neuron at the n-th time step and the spike activation function of any neuron to calculate the generation gradient of any neuron at the n-th time step.

[0058] Furthermore, for any neuron, its membrane potential is updated according to the following formula: , where represents the decay factor, represents the membrane potential of any neuron at the (n - 1)-th time step, represents the spike input of any neuron at the n-th time step; in this embodiment, is the membrane potential of this any neuron when the previous training data is input into the spiking neural network model; if the k-th training batch has a total of 10 training data, when n is 2, is the membrane potential of this any neuron when the first training data in the k-th training batch is input into the spiking neural network model; meanwhile, is the spike input of this any neuron when the second training data in the k-th training batch is input into the spiking neural network model, which is output by the previous spiking neuron.

[0059] At the same time, when exceeds the threshold, a spike event will be triggered, that is, a spike is generated and output to the next neuron it is connected to; otherwise, no spike event is triggered.

[0060] Thus, after determining the membrane potential of any neuron at the nth time step, the surrogate gradient of the any neuron at the nth time step can be calculated; for example, but not limited to, the following formula (3) can be used for calculation.

[0061] (3) In the above formula (3), represents the surrogate gradient of the any neuron at the nth time step, represents the partial derivative of the pulse activation function of the any neuron with respect to the membrane potential of the any neuron at the nth time step, represents the pulse activation function of the any neuron, represents the membrane potential of the any neuron at the nth time step; for example, the pulse activation function can be, but not limited to, a threshold activation function or a leaky integrate-and-fire function.

[0062] Thus, after obtaining the surrogate gradient of any neuron at the nth time step through the foregoing formula (3), the gradient of the loss function with respect to the weight parameter can be calculated in combination with the foregoing loss function, and the process is as shown in the following step S44b.

[0063] S44b. Calculate the gradient of the loss function with respect to the target parameter according to the surrogate gradients of the any neuron at different time steps and the loss function; in specific implementation, for example, but not limited to, the following formula (4) can be used to calculate the gradient of the loss function with respect to the target parameter, that is, a new gradient of the loss function with respect to the target parameter is obtained (to distinguish it from the gradient of the traditional loss function with respect to the target parameter, in this embodiment, the foregoing surrogate gradient is introduced when calculating the gradient of the loss function with respect to the target parameter).

[0064] (4) In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the surrogate gradient of the any neuron at the nth time step, represents the initial gradient of the loss function with respect to the target parameter, where represents the total number of time steps, and one time step corresponds to a sample system log sequence in the kth training batch; in this embodiment, the initial gradient is the gradient of the loss function with respect to the target parameter calculated by the traditional method, and then, in combination with the surrogate gradients of the any neuron at each time step, a new gradient can be obtained, that is .

[0065] Thus, based on the generation gradients of any of the foregoing neurons at different time steps and the initial gradient of the loss function with respect to the target parameter, when the gradient of the loss function with respect to the weight parameter is calculated during the k-th training, the weight parameter can be updated based on this, and the process is as shown in the following step S44c.

[0066] S44c. Use the gradient of the loss function with respect to the target parameter to update the target parameter, so as to obtain the spiking neural network model after the k-th training after updating the target parameter; in this embodiment, by using the gradient of the loss function with respect to the weight parameter and combining the learning rate, the update of the weight parameter can be realized, so as to obtain the spiking neural network after the k-th training; of course, using the gradient of the loss function to update the weights is a common technique for updating the parameters of the neural network model, and its specific update formula will not be elaborated.

[0067] Thus, through the foregoing steps S44a to S44c, the training data of the k-th training batch can be used to complete one training of the spiking neural network, that is, one fine-tuning; then, the spiking neural network model after the k-th training can be used as the initial model for the next batch of training. Until all batches of training are completed or the loss function converges, the model training process can be ended to obtain the log anomaly detection model; among them, the multi-batch training process is as shown in the following step S45.

[0068] S45. Update the spiking neural network model to the spiking neural network model after the k-th training, increment k by 1, and retrain the spiking neural network model with the training data corresponding to the k-th training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch as the output until k is equal to K or the loss function converges, to obtain the log anomaly detection model, where the initial value of k is 1 and K is the total number of training batches; in this embodiment, for example, but not limited to, when the loss change is less than the threshold for 5 consecutive iterations, it is determined that the loss function converges; of course, the specific convergence condition can be specifically set according to actual use, and the foregoing example is not limited here.

[0069] Through the foregoing steps S41 to S45, the training of the spiking neural network model can be completed, thereby obtaining a log anomaly detection model. Among them, the use of the fine-tuning technique for model training can reduce the computational complexity and the required amount of resources and memory space. At the same time, fine-tuning the weights can also make the model more suitable for the log anomaly detection task, thereby improving the performance of the model in the system log anomaly detection task. In addition, when using a spiking neural network for log anomaly detection, its internal neurons generate pulses only when the membrane potential reaches the threshold, while traditional neural networks output continuous values at each time step. Therefore, this embodiment can also greatly reduce the model data volume, thereby reducing the memory occupancy. Based on this, it can be deployed in resource-constrained environments (such as edge computing devices), thereby providing a feasible deployment solution for resource-constrained environments.

[0070] In this way, after completing the training of the spiking neural network model and obtaining the log anomaly detection model, the log pulse sequence corresponding to the system log sequence obtained in the foregoing step S3 can be input into the log anomaly detection model, thereby obtaining the binary classification value of each system log in the system log sequence. Based on this, the anomaly detection result of the system log sequence can be obtained based on the binary classification value of each system log, that is, which logs in the sequence are abnormal logs. In this way, system maintenance can be performed based on the abnormal logs.

[0071] Through the method for detecting system logs based on a spiking neural network described in detail in the foregoing steps S1 to S4, the present invention can effectively encapsulate the time and semantic information of logs, and at the same time, by means of the T5 model and the spiking neural network model, capture the correlation relationship between logs. Based on this, the anomaly detection of log sequences based on log correlation and time sensitivity can be realized. Therefore, the present invention improves the effectiveness and accuracy of log anomaly detection, and at the same time uses the neuron activation characteristics of the spiking neural network to reduce the energy consumption and required resources of the system. In this way, a feasible deployment solution can be provided for resource-constrained environments. Through the above design, the present invention provides a precise and low-energy-consuming method for log anomaly detection, which is very suitable for large-scale application and promotion.

[0072] In a possible design, the second aspect of this embodiment provides an example of the detection method based on the first aspect of the embodiment: Among them, the method for encoding the pulse characteristics of the large language model in this embodiment can efficiently encode log data into pulse characteristics, thereby realizing robust and low-power anomaly detection. Through a large number of experimental verifications, this embodiment significantly outperforms traditional methods such as HitAnomaly and LogBERT when dealing with high-dimensional and noisy log data, and its advantages mainly benefit from the time-series processing ability of the spiking neural network.

[0073] Furthermore, in this embodiment, various datasets including HDFS and BGL are used for anomaly detection and compared with traditional networks. The comparison schematic diagram can be seen in Figure 2 as shown.

[0074] As can be seen from Figure 2 , the present invention always shows strong effectiveness in various datasets including HDFS and BGL. Especially in a low-resource environment, it has achieved the best results in terms of precision, recall, and F1 score. In particular, even with only 1% of the training data, it can maintain near-perfect detection performance, highlighting its excellent generalization ability and sample efficiency. This effectiveness can be attributed to the combination of the semantic abstraction ability of the T5 encoder and the temporal modeling advantage of the spiking neural network. At the same time, compared with traditional machine learning methods, deep learning-based models, and parserless detection methods, this embodiment always performs excellently in terms of F1 score. Compared with the best-performing LAnoBERT, the F1 score of this embodiment has increased by 2 - 5%.

[0075] In addition, through experimental verification, when the F1 scores are comparable, the energy consumption of the model provided in this embodiment (i.e., Figure 2 T5+SNN in it) is 34.5 mJ, which is only 23% of the energy consumption of RoBERTa-Base and T5-Base. This energy consumption advantage is crucial for the actual deployment in edge environments or data centers because energy cost and sustainability are the main concerns in these environments and centers. Based on this, a feasible deployment solution can be provided for resource-constrained environments.

[0076] As Figure 3 shown, the third aspect of this embodiment provides a hardware device for implementing the system log detection method based on spiking neural network described in the first aspect of the embodiment, including: An acquisition unit, configured to acquire a system log sequence, where the system log sequence includes a plurality of system logs.

[0077] A word embedding unit, configured to input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes the semantic information of the system log corresponding to the any word embedding vector.

[0078] An encoding unit, configured to perform spiking feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal spiking sequence corresponding to each word embedding vector, and use the obtained spatio-temporal spiking sequences to form a log spiking sequence.

[0079] Anomaly detection unit, configured to input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, where the log anomaly detection model uses a trained spiking neural network model, and the log anomaly detection model is trained with the log pulse sequences of a number of sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

[0080] For the working process, working details and technical effects of the device provided in this embodiment, reference can be made to the first aspect of the embodiment, which will not be elaborated here.

[0081] As Figure 4 As shown in the figure, a another system log detection device based on a spiking neural network is provided in the fourth aspect of this embodiment. Taking the device as an electronic device as an example, it includes: a memory, a processor, and a transceiver that are communicatively connected in sequence, where the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the system log detection method based on a spiking neural network as described in the first aspect of the embodiment.

[0082] Specifically, the memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO), and / or first in last out (FILO), etc.; specifically, the processor may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). At the same time, the processor may also include a main processor and a coprocessor. The main processor is a processor used to process data in the wake state, also known as the CPU (Central Processing Unit); the coprocessor is a low-power processor used to process data in the standby state.

[0083] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit). The GPU is responsible for rendering and drawing the content to be displayed on the display screen. For example, the processor may not be limited to using a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 architecture processor, or a processor integrated with an embedded neural-network processing unit (NPU); the transceiver may be, but is not limited to, a Wi-Fi wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee (low-power local area network protocol based on the IEEE 802.15.4 standard) wireless transceiver, a 3G transceiver, a 4G transceiver, and / or a 5G transceiver, etc. In addition, the device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0084] For the working process, working details, and technical effects of the electronic device provided in this embodiment, reference may be made to the first aspect of the embodiment, which will not be elaborated herein.

[0085] In the fifth aspect of this embodiment, a storage medium storing instructions for the system log detection method based on a spiking neural network described in the first aspect of the embodiment is provided. That is, instructions are stored on the storage medium, and when the instructions are run on a computer, the system log detection method based on a spiking neural network described in the first aspect of the embodiment is executed.

[0086] Among them, the storage medium refers to a carrier for storing data, and may include, but is not limited to, a floppy disk, an optical disc, a hard disk, a flash memory, a USB flash drive, and / or a Memory Stick, etc. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0087] For the working process, working details, and technical effects of the storage medium provided in this embodiment, reference may be made to the first aspect of the embodiment, which will not be elaborated herein.

[0088] In the sixth aspect of this embodiment, a computer program product containing instructions is provided. When the instructions are run on a computer, the computer is made to execute the system log detection method based on a spiking neural network described in the first aspect of the embodiment. Among them, the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The specific embodiments described above further elaborate on the object, technical solution and beneficial effects of the present invention. It should be understood that the above description is only the specific embodiments of the present invention and is not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A system log detection method based on a spiking neural network, characterized in that Including: Obtain a system log sequence, where the system log sequence includes a number of system logs; Input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence includes a number of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes the semantic information of the system log corresponding to the any word embedding vector; Perform pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal pulse sequence corresponding to each word embedding vector, and use the obtained spatio-temporal pulse sequences to form a log pulse sequence; Input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, where the log anomaly detection model uses a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of a number of sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

2. The method according to claim 1, characterized in that, Any word embedding vector includes d word embeddings, and d is the word embedding dimension of the pre-trained T5 model; Among them, performing pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal pulse sequence corresponding to each word embedding vector includes: For each word embedding in any word embedding vector, use the following formula (1) to perform pulse feature encoding processing on each word embedding to obtain a pulse code corresponding to each word embedding, and use the pulse codes corresponding to each word embedding to form the spatio-temporal pulse sequence corresponding to the any word embedding vector; （1） In the above formula (1), represents the pulse code corresponding to the i-th word embedding in any of the word embedding vectors, represents the scaling factor of the i-th dimension in any of the word embedding vectors, represents the i-th word embedding, represents the encoding function of the i-th word embedding at the t-th time step; Among them, In the formula, represents the activation function, represents the frequency parameter that controls the pulse oscillation, represents the phase shift of the i-th dimension.

3. The method according to claim 1, wherein The log anomaly detection model is trained in the following manner; Obtain a training data set, where the training data set includes the log pulse sequences corresponding to a number of sample system log sequences and the label of each sample system log sequence, and the label of any sample system log sequence is used to represent whether each sample system log in the any sample system log sequence is an abnormal log; Perform data partitioning processing on the training data set to obtain the training data corresponding to each training batch; For the training data corresponding to the kth training batch in the training data set, use the training data corresponding to the kth training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the kth training batch as the output to train the pulse neural network model, and during the training process, calculate the loss function based on the output of the pulse neural network model and the labels of each sample system log sequence; Freeze all model parameters except the target parameters in the pulse neural network model, and use the loss function to perform fine-tuning processing on the target parameters to obtain the pulse neural network model after the kth training after the fine-tuning processing, where the target parameters include the weights of each network layer in the pulse neural network model. Update the spiking neural network model to the spiking neural network model after the k-th training, increment k by 1, and retrain the spiking neural network model with the training data corresponding to the k-th training batch as the input and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch as the output, until k equals K or the loss function converges, to obtain the log anomaly detection model, where the initial value of k is 1 and K is the total number of training batches.

4. The method according to claim 3, wherein Calculate the loss function based on the output of the spiking neural network model and the labels of each sample system log sequence, including: Calculate the loss function using the following formula (2); （2） In the above formula (2), represents the loss function, represents the predicted value of the sample system log sequence corresponding to the nth time step in the training data corresponding to the kth training batch , and the label of the sample system log sequence corresponding to the nth time step the error between them, represents the regularization coefficient, represents the L2 regularization of the target parameter, where represents the total number of time steps, and one time step corresponds to a sample system log sequence in the kth training batch.

5. The method according to claim 3, characterized in that, Fine-tune the target parameters using the loss function to obtain the spiking neural network model after the k-th training after the fine-tuning, including: Based on the pulse activation function of any neuron in the spiking neural network model, calculate the generation gradient of the any neuron at different time steps during the k-th training, where during the k-th training, each training data in the k-th training batch input corresponds to a time step, and the generation gradient of the any neuron at different time steps is used to represent the generation gradient of the any neuron with respect to each training data after inputting each training data in the k-th training batch into the spiking neural network model; Calculate the gradient of the loss function with respect to the target parameter according to the generation gradient of the any neuron at different time steps and the loss function; Update the target parameter using the gradient of the loss function with respect to the target parameter to obtain the spiking neural network model after the k-th training after updating the target parameter.

6. The method according to claim 5, wherein Based on the pulse activation function of any neuron in the spiking neural network model, calculate the generation gradient of the any neuron at different time steps during the k-th training, including: For the n-th time step, obtain the membrane potential of the any neuron at the n-th time step during the k-th training; Use the membrane potential of the any neuron at the n-th time step and the pulse activation function of the any neuron, and calculate the generation gradient of the any neuron at the n-th time step using the following formula (3); （3） In the above formula (3), represents the generation gradient of any one of the neurons at the nth time step, represents the partial derivative of the pulse activation function of any one of the neurons with respect to the membrane potential of any one of the neurons at the nth time step, represents the pulse activation function of any one of the neurons, represents the membrane potential of any one of the neurons at the nth time step; Among them, , in the formula, represents the attenuation factor, represents the membrane potential of any one of the neurons at the (n - 1)-th time step, represents the spike input of any one of the neurons at the n-th time step.

7. The method according to claim 5, characterized in that, Calculate the gradient of the loss function with respect to the target parameter according to the generation gradient of the any neuron at different time steps and the loss function, including: Calculate the gradient of the loss function with respect to the target parameter according to the following formula (4); （4） In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the generation gradient of any one of the neurons at the nth time step, represents the initial gradient of the loss function with respect to the target parameter, where represents the total number of time steps, and one time step corresponds to a sample system log sequence in the kth training batch.

8. A system log detection device based on a spiking neural network, characterized in that, Including: An acquisition unit for acquiring a system log sequence, where the system log sequence includes a plurality of system logs; A word embedding unit for inputting the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, where the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes the semantic information of the system log corresponding to the any word embedding vector; An encoding unit for performing pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatio-temporal pulse sequence corresponding to each word embedding vector, and using the obtained spatio-temporal pulse sequences to form a log pulse sequence; An anomaly detection unit for inputting the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model uses a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of a number of sample system log sequences as inputs and the anomaly detection results of each sample system log sequence as outputs.

9. A system log detection device based on a spiking neural network, characterized in that, Comprising: A memory, a processor, and a transceiver that are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the system log detection method based on a pulse neural network according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Instructions are stored on the storage medium, and when the instructions are run on a computer, the system log detection method based on a pulse neural network according to any one of claims 1 to 7 is executed.

Images