System log detection method, device and storage medium based on pulse neural network

Abstract

The present invention belongs to the technical field of distributed system management and maintenance, and discloses a system log detection method, device and storage medium based on a pulse neural network. The present invention uses a pre-trained T5 model to implement semantic embedding of each log in a log sequence, thereby obtaining a word embedding sequence with contextual semantic association; then, pulse feature encoding is performed on the pre-trained T5 model to capture the semantic information and time dynamics in the embedded words, thereby achieving effective encapsulation of log semantics and time information, and obtaining a spatiotemporal pulse sequence; finally, the pulse sequence is input into the trained pulse neural network model to obtain a log anomaly detection result; thus, the present invention can effectively encapsulate the time and semantic information of the log, and simultaneously use the T5 model and the pulse neural network model to capture the association relationship between logs, thereby achieving anomaly detection of logs based on log association and time sensitivity; thus, the effectiveness and accuracy of log anomaly detection are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of system management and maintenance in distributed systems, and in particular to a system log detection method, device and storage medium based on a pulse neural network. Background Art

[0002] Log anomaly detection has become a key task in system management and maintenance of large-scale distributed systems. Logs are the main data source for tracking system activities and events. Detecting anomalies in them is crucial for identifying failures, security vulnerabilities, and operational inefficiencies. In practical applications, a fundamental challenge in system log anomaly detection is how to effectively represent log data. Such representations must encapsulate both temporal and semantic information. Traditional models not only have difficulty coping with the high irregularity and sparsity of system logs, making it impossible to effectively represent log data, but also fail to capture the dependencies between logs. In safety-critical applications, subtle anomalies in log entries may be early signs of serious problems, but traditional methods often fail to detect such subtle and time-sensitive events, and therefore easily lead to false positives or missed detections. Therefore, based on the aforementioned shortcomings, how to provide a system log detection method based on spiking neural networks with high log detection accuracy has become an urgent problem to be solved. Summary of the Invention

[0003] The technical problem to be solved by the present invention is the problem of log anomaly detection in a distributed system. The purpose is to provide a system log detection method, device and storage medium based on a pulse neural network, which solves the problem that traditional technologies cannot effectively encapsulate the time and semantic information of logs, and cannot capture the dependencies between logs, which leads to false alarms or missed detections.

[0004] The present invention is achieved through the following technical solutions:

[0005] In a first aspect, a system log detection method based on a spiking neural network is provided, comprising:

[0006] Acquire a system log sequence, wherein the system log sequence includes a plurality of system logs;

[0007] Input the system log sequence into the pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector;

[0008] Performing pulse feature coding processing on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and using the obtained spatiotemporal pulse sequence to form a log pulse sequence;

[0009] The log pulse sequence is input into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model adopts a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as input and the anomaly detection results of each sample system log sequence as output.

[0010] Based on the above disclosure, after obtaining a system log sequence, the present invention first inputs it into a pre-trained T5 model to generate a set of continuous word embedding vectors using the T5 model. Each word embedding vector contains semantic information about the corresponding system log. Therefore, the word embedding sequence formed by several word embedding vectors can not only capture the semantics of the log but also the contextual relationships between the logs in the sequence, thereby achieving context-based semantic embedding. After obtaining the word embedding sequence corresponding to the system log sequence, it can be pulse-feature encoded to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector. In this way, by performing pulse feature encoding (i.e., time encoding) on ​​the word embedding sequence, the semantic information and temporal dynamics of the embedded words can be simultaneously captured, forming a spatiotemporal pulse sequence suitable for spiking neural network processing. Based on this, effective encapsulation of the semantics and temporal information of the system log can be achieved. Finally, the log pulse sequence obtained through pulse feature encoding is input into the trained spiking neural network model. The powerful temporal processing capabilities of the spiking neural network can be leveraged to achieve anomaly detection based on the time-sensitive log sequence, thereby obtaining accurate system log anomaly detection results.

[0011] Through the above design, the present invention first uses the pre-trained T5 model to realize the semantic embedding of each system log in the system log sequence, thereby obtaining a context-related word embedding sequence containing log semantic information; then, pulse feature encoding is performed on it to simultaneously capture the semantic information and time dynamics in the embedded word, so that the system log semantics and time information can be effectively encapsulated, and a spatiotemporal pulse sequence suitable for pulse neural network processing can be obtained; finally, the encoded pulse sequence is input into the trained pulse neural network model to obtain the anomaly detection result of the system log sequence; thus, compared with traditional technologies, the present invention can effectively encapsulate the time and semantic information of the log, and at the same time use the T5 model and the pulse neural network model to capture the association relationship between the logs, thereby realizing anomaly detection of log sequences based on log association and time sensitivity; thus, the present invention improves the effectiveness and accuracy of log anomaly detection, and is therefore very suitable for large-scale application and promotion.

[0012] In one possible design, any word embedding vector contains d word embeddings, where d is the word embedding dimension of the pre-trained T5 model;

[0013] Wherein, pulse feature coding is performed on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, including:

[0014] For each word embedding in any word embedding vector, the following formula (1) is used to perform pulse feature coding on each word embedding to obtain the pulse code corresponding to each word embedding, and the pulse code corresponding to each word embedding is used to form the spatiotemporal pulse sequence corresponding to the any word embedding vector;

[0015] (1)

[0016] In the above formula (1), represents the pulse code corresponding to the i-th word embedding in any word embedding vector, represents the scaling factor of the i-th dimension in the embedding vector of any word, represents the i-th word embedding, represents the encoding function of the i-th word embedding at the t-th time step;

[0017] in,

[0018] Where, represents the activation function, represents the frequency parameter of the control pulse oscillation, represents the phase shift in the i-th dimension.

[0019] In a possible design, the log anomaly detection model is trained in the following manner:

[0020] Obtaining a training data set, wherein the training data set includes log pulse sequences corresponding to a plurality of sample system log sequences and a label of each sample system log sequence, and the label of any sample system log sequence is used to indicate whether each sample system log in the sample system log sequence is an abnormal log;

[0021] Performing data partitioning processing on the training data set to obtain training data corresponding to each training batch;

[0022] For the training data corresponding to the kth training batch in the training data set, the spiking neural network model is trained using the training data corresponding to the kth training batch as input and the anomaly detection results of each sample system log sequence in the training data corresponding to the kth training batch as output, and during the training process, a loss function is calculated based on the output of the spiking neural network model and the labels of each sample system log sequence;

[0023] Freezing all model parameters of the spiking neural network model except target parameters, and fine-tuning the target parameters using the loss function to obtain a spiking neural network model after the kth training after fine-tuning, wherein the target parameters include weights of each network layer in the spiking neural network model;

[0024] The pulse neural network model is updated to the pulse neural network model after the k-th training, and k is incremented by 1, and the training data corresponding to the k-th training batch is re-input, and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch are output to train the pulse neural network model until k is equal to K or the loss function converges, thereby obtaining the log anomaly detection model, wherein the initial value of k is 1, and K is the total number of training batches.

[0025] In one possible design, a loss function is calculated based on the output of the spiking neural network model and the labels of each sample system log sequence, including:

[0026] The loss function is calculated using the following formula (2);

[0027] (2)

[0028] In the above formula (2), represents the loss function, Represents the predicted value of the sample system log sequence corresponding to the nth time step in the training data corresponding to the kth training batch , the label of the sample system log sequence corresponding to the nth time step The error between represents the regularization coefficient, represents the L2 regularization of the target parameter, where Represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

[0029] In one possible design, the target parameters are fine-tuned using the loss function to obtain a k-th trained spiking neural network model after fine-tuning, including:

[0030] Based on the pulse activation function of any neuron in the spiking neural network model, calculating the generation gradient of any neuron at different time steps during the kth training, wherein, during the kth training, each training data in the kth training batch input corresponds to one time step, and the generation gradient of any neuron at different time steps is used to characterize the generation gradient of any neuron relative to each training data after each training data in the kth training batch is input into the spiking neural network model;

[0031] Calculate the gradient of the loss function relative to the target parameter based on the generation gradient of any neuron at different time steps and the loss function;

[0032] The target parameters are updated using the gradient of the loss function relative to the target parameters, so as to obtain the pulse neural network model after the k-th training after updating the target parameters.

[0033] In one possible design, based on the pulse activation function of any neuron in the spiking neural network model, calculating the generation gradient of any neuron at different time steps during the k-th training includes:

[0034] For the nth time step, the membrane potential of any neuron at the nth time step during the kth training is obtained;

[0035] Using the membrane potential of any neuron at the nth time step and the pulse activation function of any neuron, and using the following formula (3), calculate the generation gradient of any neuron at the nth time step;

[0036] (3)

[0037] In the above formula (3), represents the generation gradient of any neuron at the nth time step, represents the partial derivative of the impulse activation function of any neuron with respect to the membrane potential of any neuron at the nth time step, represents the pulse activation function of any neuron, represents the membrane potential of any neuron at the nth time step;

[0038] in, , where represents the attenuation factor, represents the membrane potential of any neuron at the n-1th time step, represents the pulse input of any neuron at the nth time step.

[0039] In one possible design, calculating the gradient of the loss function relative to the target parameter based on the generation gradient of any neuron at different time steps and the loss function includes:

[0040] According to the following formula (4), the gradient of the loss function with respect to the target parameter is calculated;

[0041] (4)

[0042] In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the generation gradient of any neuron at the nth time step, represents the initial gradient of the loss function with respect to the target parameter, where Represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

[0043] In a second aspect, a system log detection device based on a pulse neural network is provided, comprising:

[0044] An acquiring unit, configured to acquire a system log sequence, wherein the system log sequence includes a plurality of system logs;

[0045] A word embedding unit, configured to input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector;

[0046] an encoding unit, configured to perform pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and to form a log pulse sequence using the obtained spatiotemporal pulse sequence;

[0047] An anomaly detection unit is used to input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model adopts a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as input and the anomaly detection results of each sample system log sequence as output.

[0048] In the third aspect, another system log detection device based on a pulse neural network is provided. Taking the device as an electronic device as an example, it includes a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the system log detection method based on the pulse neural network as described in the first aspect or any possible design of the first aspect.

[0049] In a fourth aspect, a storage medium is provided, on which instructions are stored. When the instructions are run on a computer, the system log detection method based on the pulse neural network as described in the first aspect or any possible design of the first aspect is executed.

[0050] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, causes the computer to execute the system log detection method based on a pulse neural network as described in the first aspect or any possible design of the first aspect.

[0051] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0052] (1) The present invention first uses the pre-trained T5 model to realize the semantic embedding of each system log in the system log sequence, thereby obtaining a context-related word embedding sequence containing log semantic information; then, pulse feature encoding is performed on it to simultaneously capture the semantic information and time dynamics of the embedded words, so that the system log semantics and time information can be effectively encapsulated, and a spatiotemporal pulse sequence suitable for pulse neural network processing can be obtained; finally, the encoded pulse sequence is input into the trained pulse neural network model to obtain the anomaly detection result of the system log sequence; thus, compared with traditional technologies, the present invention can effectively encapsulate the time and semantic information of the log, and at the same time use the T5 model and the pulse neural network model to capture the association relationship between logs, thereby realizing anomaly detection of log sequences based on log association and time sensitivity; thus, the present invention improves the effectiveness and accuracy of log anomaly detection, and is very suitable for large-scale application and promotion.

[0053] (2) The present invention uses a spiking neural network to detect log anomalies. Its internal neurons generate spikes only when the membrane potential reaches a threshold, while traditional neural networks output continuous values ​​at each time step. Therefore, the amount of model data is greatly reduced, thereby reducing memory usage. Based on this, it can be deployed in resource-constrained environments (such as edge computing devices), thereby providing a feasible deployment solution for resource-constrained environments.

[0054] (3) During training, the present invention adopts fine-tuning technology to adjust the model parameters, that is, freezing the model parameters except the weight parameters in the pulse neural network, and then using the generation gradient of the neuron at different time steps, and then combining the initial gradient of the loss function with respect to the weight to derive the final gradient of the loss function with respect to the weight, and use this to perform reverse update of the weight; in this way, the fine-tuning technology can reduce the computational complexity and reduce the required amount of resources and memory space; at the same time, fine-tuning the weights can also make the model more suitable for log anomaly detection tasks, thereby improving the performance of the model in system log anomaly detection tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the examples. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be considered as limiting the scope. A person of ordinary skill in the art can also derive other relevant drawings based on these drawings without inventive effort. In the drawings:

[0056] Figure 1 A schematic diagram of the steps of a system log detection method based on a spiking neural network provided by an embodiment of the present invention;

[0057] Figure 2 A schematic diagram showing a comparison of detections of different models provided in an embodiment of the present invention;

[0058] Figure 3 A schematic diagram of the structure of a system log detection device based on a spiking neural network provided by an embodiment of the present invention;

[0059] Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0060] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the following examples and accompanying drawings. The exemplary embodiments of the present invention and their descriptions are intended only to explain the present invention and are not intended to limit the present invention. It should be understood that although the terms "first," "second," and so on may be used herein to describe various elements, these elements should not be limited by these terms. These terms are merely used to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element without departing from the scope of the exemplary embodiments of the present invention.

[0061] Example:

[0062] See also Figure 1 As shown, the system log detection method based on the pulse neural network provided by this embodiment uses the pre-trained T5 model to realize the semantic embedding of the system log sequence, thereby generating a word embedding sequence that is connected to the context semantics; then, the word embedding sequence is pulse-feature encoded to simultaneously capture the semantic information and time dynamics of the embedded words, so that the system log semantics and time information can be effectively encapsulated, thereby obtaining a spatiotemporal pulse sequence suitable for processing by the pulse neural network model; then, the spatiotemporal pulse sequence is input into the trained pulse neural network model to obtain the anomaly detection result of the system log sequence; thus, this method can effectively encapsulate the time of the log. Time and semantic information, and at the same time with the help of T5 model and pulse neural network model, to capture the correlation between logs, based on this, it is possible to achieve anomaly detection based on log association and time-sensitive log sequences; therefore, this method improves the effectiveness and accuracy of log anomaly detection, and is therefore very suitable for large-scale application and promotion; for example, this method can be but is not limited to running on the system monitoring end side, optionally, the system monitoring end can be but is not limited to using a server or edge device, it can be understood that the aforementioned execution subject does not constitute a limitation on the embodiments of the present application, and accordingly, the operation steps of this method can be but are not limited to the following steps S1 to S4.

[0063] S1. Obtain a system log sequence, wherein the system log sequence includes multiple system logs. In a specific application, the system log sequence can be formed by continuously reading system logs generated during the operation of a distributed system, but is not limited to the system logs generated during the operation of the distributed system. After obtaining the system log sequence consisting of multiple system logs during the operation of the distributed system, anomaly detection can be performed on the system logs to manage and maintain the distributed system based on the anomaly detection results.

[0064] In this embodiment, an improved anomaly detection method is provided that combines a pre-trained T5 model with a spiking neural network (SNN). This method can effectively encapsulate the temporal and semantic information of logs, and can simultaneously use the T5 model and the spiking neural network to capture the associations between logs, thereby realizing anomaly detection based on log associations and time-sensitive log sequences. The log anomaly detection process is mainly divided into three parts: semantic embedding, spiking feature encoding, and model detection. The process can be, but is not limited to, as shown in the following steps S2 to S4.

[0065] S2. Input the system log sequence into the pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a number of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes the semantic information of the system log corresponding to the any word embedding vector; in specific applications, the T5 model is a neural network model for natural language processing, which can process the input data sequence and generate a set of continuous embeddings, wherein each embedding encodes the semantic information of each data in the data sequence at the current time step, and these embeddings can capture not only the meaning of the data, but also the contextual relationship between the data in the sequence, and therefore are very suitable for anomaly detection tasks; based on this, this embodiment implements the semantic embedding of the system log sequence based on the pre-trained T5 model, thereby generating a word embedding sequence with contextual semantic association.

[0066] Optionally, the system log sequence is represented as follows: ,in, The first System logs (b=1,2,...,B), Represents the total length of the system log sequence. Therefore, after inputting it into the pre-trained T5 model, a set of continuous embeddings (i.e., the aforementioned word embedding sequence) can be obtained, which can be expressed as: , where Indicates the The corresponding embedded system log, that is, The corresponding word embedding vector.

[0067] Furthermore, any word embedding vector contains d word embeddings, i.e. , where It represents the d-th word embedding at the current time step t, and d represents the word embedding dimension of the pre-trained T5 model. Therefore, the pre-trained T5 model encodes each system log in the system log sequence into a word embedding vector with a dimension of d. At the same time, after the system log sequence is input into the pre-trained T5 model, it is processed by the multi-head attention and multi-layer perceptron inside it to finally generate a word embedding sequence (that is, the embedding matrix and position encoding matrix of the multi-head attention and multi-layer perceptron are weighted and calculated). Of course, the pre-trained T5 model is an existing model for generating word embeddings, and its internal operation principle will not be repeated here.

[0068] After completing the semantic embedding of the system log sequence, time encoding (pulse feature encoding) can be performed to simultaneously capture the semantic information in the embedded words and their temporal dynamics, thereby generating a spatiotemporal pulse sequence suitable for pulse neural network processing. The pulse feature encoding process can be, but is not limited to, as shown in the following step S3.

[0069] S3. Perform pulse feature coding on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and use the obtained spatiotemporal pulse sequence to form a log pulse sequence. In this embodiment, pulse feature coding is essentially time coding, which is used to capture the semantic information and temporal dynamics of the embedded words (i.e., the aforementioned word embeddings) and simultaneously effectively represent high-dimensional continuous data as pulse signals for subsequent processing by a pulse neural network, thereby detecting anomalies in the system log.

[0070] Optionally, pulse feature coding maps the embedding values ​​(i.e., word embeddings) in each word embedding vector into a time-based pulse code. In this way, combined with the aforementioned embedding dimension, each word embedding vector can be converted into a spatiotemporal pulse sequence based on the current time step t (i.e., combining the time dimension and the embedding dimension to obtain a spatiotemporal pulse sequence). The following takes any word embedding vector as an example to specifically explain the encoding process:

[0071] For each word embedding in any word embedding vector, pulse feature coding is performed on each word embedding to obtain a pulse code corresponding to each word embedding, and the pulse code corresponding to each word embedding is used to form a spatiotemporal pulse sequence corresponding to the any word embedding vector.

[0072] For example, but not limited to, the following formula (1) can be used to encode the pulse features of each word embedding.

[0073] (1)

[0074] In the above formula (1), represents the pulse code corresponding to the i-th word embedding in any word embedding vector, represents the scaling factor of the i-th dimension in the embedding vector of any word (which is a preset value), represents the i-th word embedding, represents the encoding function of the i-th word embedded in the t-th time step; in this embodiment, the t-th time step is the current time step, that is, the generation time of the system log sequence.

[0075] Further,

[0076] Where, represents the activation function, represents the frequency parameter of the control pulse oscillation, Indicates the phase shift of the i-th dimension; in specific applications, the activation function can be, but is not limited to, the sigmoid activation function, which is used to ensure that the pulse value remains within a bounded range. The cosine function introduces the necessary time oscillations to ensure that the pulses vary over time. At the same time, the frequency parameter and phase shift can control the time interval of the pulses, so that the model can capture the temporal dynamics of the system log. These temporal features are crucial for accurate anomaly detection because abnormal patterns usually appear as unusual temporal sequences. Based on this, the purpose of feature encoding is to retain the temporal characteristics of the log data while encoding the word embedding vector into a pulse sequence. In addition, the phase shift of the aforementioned i-th dimension is a constant and can be set in advance.

[0077] Thus, through the above formula (1), the pulse coding of each word embedded in any word embedding vector can be realized. In this way, each pulse coding can be used to form the spatiotemporal pulse sequence corresponding to the any word embedding vector. ,Right now Of course, the pulse feature encoding process of the remaining word embedding vectors is the same as the encoding process of any of the aforementioned word embedding vectors, and will not be repeated here.

[0078] Through the above design, pulse feature coding can incorporate temporal dynamics into the encoding process, thereby achieving effective encapsulation of log sequence semantics and temporal information; based on this, by converting each semantically embedded code into a spatiotemporal pulse sequence, and then utilizing the temporal characteristics of the log data, and with the help of a pulse neural network model, accurate anomaly detection of system logs can be achieved.

[0079] The log anomaly detection process may be, but is not limited to, the following step S4.

[0080] S4. Input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model uses a trained spiking neural network model, and the log anomaly detection model is trained using the log pulse sequences of several sample system log sequences as input and the anomaly detection results of each sample system log sequence as output.

[0081] In this embodiment, a trained spiking neural network model is used as an example to perform anomaly detection in system logs, that is, after generating a spatiotemporal pulse sequence corresponding to each word embedding vector and forming a log pulse sequence corresponding to the entire system log sequence, it can be transmitted to the trained spiking neural network model for processing; specifically, in the spiking neural network model, each neuron maintains a membrane potential and is updated according to the input pulse at each time step. Therefore, it provides a biologically inspired mechanism that can activate neurons according to the incoming pulse sequence, thereby allowing the spiking neural network to effectively process the encoded time information and detect anomalies in the system log sequence data.

[0082] The following discloses one training process of the aforementioned log anomaly detection model, as shown in the following steps S41 to S45.

[0083] S41. Obtain a training data set, wherein the training data set includes log pulse sequences corresponding to several sample system log sequences and a label for each sample system log sequence, and the label of any sample system log sequence is used to characterize whether each sample system log in the any sample system log sequence is an abnormal log. In this embodiment, the generation process of the log pulse sequence corresponding to each sample system log sequence can be referred to the aforementioned steps S1 to S3 and will not be repeated here. At the same time, for example, the label of any sample system log sequence is a vector, and the vector includes the label value of each sample system log in the any sample system log sequence, and the label value of any sample system log is 1 or 0, 1 indicates that the any sample system log is an abnormal log, and 0 indicates that the any sample system log is a normal log.

[0084] In this way, after the training data set is obtained, the total training batch can be determined, and the training data set can be divided based on the total training batch. The process is shown in the following step S42.

[0085] S42. The training dataset is partitioned to obtain training data corresponding to each training batch. In a specific implementation, the total number of training batches can be set based on actual use and is not specifically limited herein. Therefore, after obtaining the training data corresponding to each training batch based on the total number of training batches, the spiking neural network model can be trained in multiple batches.

[0086] Among them, in specific applications, this embodiment provides a model fine-tuning technology to enhance the learning ability of the pulse neural network, so as to more effectively learn signals and optimize the performance of the model in the system log anomaly detection task; at the same time, the use of fine-tuning technology for model training can also reduce the amount of resources and memory space required for model training, thereby reducing hardware requirements.

[0087] Optionally, the model fine-tuning process may be, but is not limited to, steps S43 to S45 as shown below.

[0088] S43. For the training data corresponding to the kth training batch in the training data set, a spiking neural network model is trained using the training data corresponding to the kth training batch as input and the anomaly detection results of each sample system log sequence in the training data corresponding to the kth training batch as output. During the training process, a loss function is calculated based on the output of the spiking neural network model and the labels of each sample system log sequence.

[0089] In this embodiment, assuming that the training data of a training batch is 10, then a training batch contains log pulse sequences corresponding to 10 sample system log sequences. Based on this, the log pulse sequences corresponding to the 10 sample system log sequences are input into the pulse neural network model in sequence to complete the model training of this training batch.

[0090] Furthermore, in each training batch, this embodiment uses the model output and labels corresponding to the training data of each training batch to calculate the loss function, and based on this, fine-tune the parameters of the pulse neural network model; wherein, this embodiment mainly fine-tunes the weight parameters of each network layer in the pulse neural network model to improve the ability of anomaly detection; optionally, in specific applications, each sample system log sequence in each training batch corresponds to a time step respectively. Therefore, in the kth training batch, it is equivalent to using the model output and labels corresponding to all time steps in the kth training batch (that is, all training data in the batch) to calculate the loss function for the kth training.

[0091] The following is the calculation process of the loss function of the spiking neural network model for the kth training batch:

[0092] In this embodiment, the loss function may be calculated by, but not limited to, the following formula (2).

[0093]

[0094] In the above formula (2), represents the loss function, Represents the predicted value of the sample system log sequence corresponding to the nth time step in the training data corresponding to the kth training batch (In this embodiment, the pulse neural network model outputs the binary classification value of each sample system log in the sample system log sequence, that is, 1 or 0. Therefore, is also a vector containing 1 or 0), the label of the sample system log sequence corresponding to the nth time step The error between represents the regularization coefficient, represents the L2 regularization of the target parameter, where Represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

[0095] In this way, the loss function of the pulse neural network model in the kth training batch can be calculated through the above formula (2); then, the weights can be fine-tuned based on the loss function, and the process is shown in the following step S44.

[0096] S44. Freeze all model parameters except the target parameters in the spiking neural network model, and use the loss function to fine-tune the target parameters to obtain the spiking neural network model after the kth training after fine-tuning, wherein the target parameters include the weights of each network layer in the spiking neural network model; in this embodiment, unlike traditional networks, spiking neural networks (SNNs) are event-driven and involve spiking events rather than continuous activations. Therefore, back propagation through errors must take these discrete spiking events into account; based on this, this embodiment provides a back propagation method that combines a loss function and a gradient of the neuron relative to the membrane potential (i.e., the new gradient of the loss function below relative to the target parameter) to update the model parameters, so as to utilize the continuous dynamics of the approximate membrane potential to improve the model's ability to distinguish spiking events.

[0097] Optionally, for example, the following steps S44a to S44c may be used to implement the k-th fine-tuning of the pulse neural network model.

[0098] S44a. Based on the pulse activation function of any neuron in the pulse neural network model, the generation gradient of any neuron at different time steps during the k-th training is calculated, wherein, during the k-th training, each training data in the k-th training batch input corresponds to a time step, and the generation gradient of any neuron at different time steps is used to characterize the generation gradient of any neuron relative to each training data after each training data in the k-th training batch is input into the pulse neural network model; in this embodiment, it has been explained above that one training data in the k-th training batch corresponds to one time step, therefore, the neurons in the model have a membrane potential at each time step (i.e., each time a training data is input); therefore, in order to calculate the gradient in the back propagation process, this embodiment first calculates the generation gradient of the neuron at different time steps, and then, combined with the initial gradient of the loss function relative to the target parameter, derives the gradient of the loss function relative to the target parameter, that is, the gradient relative to the weight parameter.

[0099] Furthermore, taking the nth time step in the kth training process as an example, the process is as follows: first, the membrane potential of any neuron at the nth time step during the kth training is obtained; then, the membrane potential of any neuron at the nth time step and the pulse activation function of any neuron are used to calculate the generation gradient of any neuron at the nth time step.

[0100] Furthermore, for any neuron, its membrane potential is updated according to the following formula:

[0101] , where represents the attenuation factor, represents the membrane potential of any neuron at the n-1th time step, represents the pulse input of any neuron at the nth time step; in this embodiment, It is the membrane potential of any neuron when the previous training data is input into the spiking neural network model; if the kth training batch has a total of 10 training data, when n is 2, is the membrane potential of any neuron when the first training data in the kth training batch is input into the pulse neural network model; at the same time, When the second training data in the kth training batch is input into the pulse neural network model, the pulse input of any neuron is output by the previous pulse neuron.

[0102] At the same time, when When the threshold is exceeded, a pulse event is triggered, that is, a pulse is generated and output to the next neuron connected to it; otherwise, no pulse event is triggered.

[0103] In this way, after determining the membrane potential of any neuron at the nth time step, the generation gradient of any neuron at the nth time step can be calculated; for example, but not limited to, the following formula (3) can be used to calculate it.

[0104] (3)

[0105] In the above formula (3), represents the generation gradient of any neuron at the nth time step, represents the partial derivative of the impulse activation function of any neuron with respect to the membrane potential of any neuron at the nth time step, represents the pulse activation function of any neuron, represents the membrane potential of any neuron at the nth time step; wherein, for example, the pulse activation function can be but is not limited to a threshold activation function or a leaky integrate-and-release function.

[0106] In this way, after obtaining the generation gradient of any neuron at the nth time step through the above formula (3), the above loss function can be combined to calculate the gradient of the loss function relative to the weight parameter. The process is shown in the following step S44b.

[0107] S44b. Calculate the gradient of the loss function relative to the target parameter based on the generation gradient of any neuron at different time steps and the loss function. In specific implementation, the gradient of the loss function relative to the target parameter can be calculated by, but is not limited to, the following formula (4), that is, a new gradient of the loss function relative to the target parameter is obtained (in order to distinguish it from the gradient of the traditional loss function relative to the target parameter, this embodiment introduces the aforementioned generation gradient when calculating the gradient of the loss function relative to the target parameter).

[0108] (4)

[0109] In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the generation gradient of any neuron at the nth time step, represents the initial gradient of the loss function with respect to the target parameter, where represents the total number of time steps, and one time step corresponds to a sample system log sequence in the kth training batch; in this embodiment, the initial gradient is the gradient of the loss function relative to the target parameter calculated using the traditional method, and then, combined with the generation gradient of any neuron at each time step, the new gradient can be obtained, that is, .

[0110] In this way, by calculating the gradient of any of the aforementioned neurons at different time steps and the initial gradient of the loss function relative to the target parameter, the gradient of the loss function relative to the weight parameter during the k-th training is obtained, and the weight parameter can be updated based on this. The process is shown in the following step S44c.

[0111] S44c. Utilizing the gradient of the loss function with respect to the target parameter, the target parameter is updated, so as to obtain the pulse neural network model after the k-th training after updating the target parameter. In this embodiment, the weight parameter is updated by utilizing the gradient of the loss function with respect to the weight parameter in combination with the learning rate, thereby obtaining the pulse neural network after the k-th training. Of course, utilizing the gradient of the loss function to perform weight update is a common technique for updating neural network model parameters, and its specific update formula is not repeated here.

[0112] Therefore, through the aforementioned steps S44a to S44c, the training data of the kth training batch can be used to complete one training of the pulse neural network, that is, one fine-tuning; then, the pulse neural network model after the kth training can be used as the initial model to carry out the next batch of training until the training of all batches is completed or the loss function converges, then the model training process can be ended to obtain the log anomaly detection model; wherein, the multi-batch training process is shown in the following step S45.

[0113] S45. Update the spiking neural network model to the spiking neural network model after the k-th training, increment k by 1, and re-train the spiking neural network model using the training data corresponding to the k-th training batch as input and the anomaly detection results of the log sequences of each sample in the training data corresponding to the k-th training batch as output, until k equals K or the loss function converges, thereby obtaining the log anomaly detection model, wherein the initial value of k is 1, and K is the total number of training batches; in this embodiment, for example, it can be, but is not limited to, determining that the loss function has converged when the loss change is less than a threshold for five consecutive iterations; of course, the specific convergence condition can be set according to actual use, and the above example is not limited here.

[0114] Therefore, through the aforementioned steps S41 to S45, the training of the pulse neural network model can be completed, thereby obtaining a log anomaly detection model; wherein, the use of fine-tuning technology for model training can reduce computational complexity and reduce the required amount of resources and memory space; at the same time, fine-tuning of the weights can also make the model more suitable for log anomaly detection tasks, thereby improving the performance of the model in system log anomaly detection tasks; in addition, the pulse neural network is used for log anomaly detection, and its internal neurons only generate pulses when the membrane potential reaches a threshold, while the traditional neural network outputs a continuous value at each time step. Therefore, this embodiment can also significantly reduce the amount of model data, thereby reducing memory usage. Based on this, it can be deployed in resource-constrained environments (such as edge computing devices), thereby providing a feasible deployment solution for resource-constrained environments.

[0115] In this way, after completing the training of the pulse neural network model and obtaining the log anomaly detection model, the log pulse sequence corresponding to the system log sequence obtained in the aforementioned step S3 can be input into the log anomaly detection model to obtain the binary classification value of each system log in the system log sequence. Based on this, the anomaly detection result of the system log sequence can be obtained based on the binary classification value of each system log, that is, which logs in the sequence are abnormal logs; in this way, system maintenance can be performed based on the abnormal logs.

[0116] Therefore, through the system log detection method based on the pulse neural network described in detail in the aforementioned steps S1 to S4, the present invention can effectively encapsulate the time and semantic information of the log, and at the same time use the T5 model and the pulse neural network model to capture the correlation between the logs. Based on this, anomaly detection based on log association and time-sensitive log sequences can be achieved; therefore, the present invention improves the effectiveness and accuracy of log anomaly detection, and at the same time utilizes the neuron activation characteristics of the pulse neural network to reduce the energy consumption and required resources of the system, thus providing a feasible deployment solution for resource-constrained environments; through the above design, the present invention provides an accurate and low-energy log anomaly detection method, which is very suitable for large-scale application and promotion.

[0117] In one possible design, the second aspect of this embodiment provides an example of a detection method based on the first aspect of the embodiment:

[0118] Among them, this embodiment is based on the pulse feature encoding method of a large language model, which can efficiently encode log data into pulse features, thereby realizing robust and low-cost anomaly detection; through a large number of experimental verifications, this embodiment has significantly better performance than traditional methods such as HitAnomaly and LogBERT when processing high-dimensional and noisy log data. Its advantages are mainly due to the time series processing capabilities of the pulse neural network.

[0119] Furthermore, this embodiment uses various data sets including HDFS and BGL to perform anomaly detection and compares them with traditional networks. The comparison diagram can be seen in Figure 2 shown.

[0120] from Figure 2 It can be seen that the present invention consistently demonstrates strong effectiveness in various datasets including HDFS and BGL, especially in low-resource environments, achieving the best results in terms of precision, recall, and F1 score. In particular, even with only 1% of training data, it can maintain near-perfect detection performance, highlighting its excellent generalization ability and sample efficiency. This effectiveness can be attributed to the combination of the semantic abstraction ability of the T5 encoder and the temporal modeling advantages of the spiking neural network. At the same time, compared with traditional machine learning methods, deep learning-based models, and parser-free detection methods, this embodiment consistently performs well in terms of F1 score. Compared with the best-performing LAnoBERT, the F1 score of this embodiment is improved by 2-5%.

[0121] In addition, through experimental verification, when the F1 score is equivalent, the model provided in this embodiment (i.e. Figure 2 The energy consumption of T5+SNN in the

[15] is 34.5 mJ, which is only 23% of the energy consumption of RoBERTa-Base and T5-Base. This energy consumption advantage is crucial for actual deployment in edge environments or data centers, because energy costs and sustainability are the main concerns of these environments and centers. Based on this, it can provide a feasible deployment solution for resource-constrained environments.

[0122] like Figure 3 As shown, the third aspect of this embodiment provides a hardware device for implementing the system log detection method based on a pulse neural network described in the first aspect of the embodiment, including:

[0123] The acquiring unit is configured to acquire a system log sequence, wherein the system log sequence includes a plurality of system logs.

[0124] A word embedding unit is used to input the system log sequence into the pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector.

[0125] The encoding unit is used to perform pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and use the obtained spatiotemporal pulse sequence to form a log pulse sequence.

[0126] An anomaly detection unit is used to input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model adopts a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as input and the anomaly detection results of each sample system log sequence as output.

[0127] The working process, working details and technical effects of the device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0128] like Figure 4 As shown, the fourth aspect of this embodiment provides another system log detection device based on a pulse neural network. Taking the device as an electronic device as an example, it includes: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the system log detection method based on a pulse neural network as described in the first aspect of the embodiment.

[0129] For example, the memory may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, first-in first-out memory (FIFO), and / or first-in last-out memory (FILO). Specifically, the processor may include one or more processing cores, such as a quad-core processor or an octal-core processor. The processor may be implemented in at least one of the following hardware forms: a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). Furthermore, the processor may include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state.

[0130] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the display screen. For example, the processor may be, but is not limited to, a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 architecture processor, or a processor with an integrated embedded neural network processing unit (NPU). The transceiver may be, but is not limited to, a Wireless Fidelity (WIFI) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power local area network protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver, and / or a 5G transceiver. In addition, the device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0131] The working process, working details and technical effects of the electronic device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0132] The fifth aspect of this embodiment provides a storage medium that stores instructions for the system log detection method based on the pulse neural network as described in the first aspect of the embodiment, that is, the storage medium stores instructions, and when the instructions are run on a computer, the system log detection method based on the pulse neural network as described in the first aspect of the embodiment is executed.

[0133] The storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive and / or a memory stick, and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0134] The working process, working details and technical effects of the storage medium provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0135] A sixth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the system log detection method based on a pulse neural network as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0136] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A system log detection method based on pulse neural network, characterized in that: include: Acquire a system log sequence, wherein the system log sequence includes a plurality of system logs; Input the system log sequence into the pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector; Performing pulse feature coding processing on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and using the obtained spatiotemporal pulse sequence to form a log pulse sequence; Inputting the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model adopts a trained spiking neural network model, and the log anomaly detection model is trained by taking the log pulse sequences of several sample system log sequences as input and outputting the anomaly detection results of each sample system log sequence; Any word embedding vector contains d word embeddings, where d is the word embedding dimension of the pre-trained T5 model; Wherein, pulse feature coding is performed on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, including: For each word embedding in any word embedding vector, the following formula (1) is used to perform pulse feature coding on each word embedding to obtain the pulse code corresponding to each word embedding, and the pulse code corresponding to each word embedding is used to form the spatiotemporal pulse sequence corresponding to the any word embedding vector; （1） In the above formula (1), represents the pulse code corresponding to the i-th word embedding in any word embedding vector, represents the scaling factor of the i-th dimension in the embedding vector of any word, represents the i-th word embedding, represents the encoding function of the i-th word embedding at the t-th time step; in, Where, represents the activation function, represents the frequency parameter of the control pulse oscillation, represents the phase shift in the i-th dimension.

2. The method according to claim 1, characterized in that The log anomaly detection model is trained in the following way: Obtaining a training data set, wherein the training data set includes log pulse sequences corresponding to a plurality of sample system log sequences and a label of each sample system log sequence, and the label of any sample system log sequence is used to indicate whether each sample system log in the sample system log sequence is an abnormal log; Performing data partitioning processing on the training data set to obtain training data corresponding to each training batch; For the training data corresponding to the kth training batch in the training data set, the spiking neural network model is trained using the training data corresponding to the kth training batch as input and the anomaly detection results of each sample system log sequence in the training data corresponding to the kth training batch as output, and during the training process, a loss function is calculated based on the output of the spiking neural network model and the labels of each sample system log sequence; Freezing all model parameters of the spiking neural network model except target parameters, and fine-tuning the target parameters using the loss function to obtain a spiking neural network model after the kth training after fine-tuning, wherein the target parameters include weights of each network layer in the spiking neural network model; The pulse neural network model is updated to the pulse neural network model after the k-th training, and k is incremented by 1, and the training data corresponding to the k-th training batch is re-input, and the anomaly detection results of each sample system log sequence in the training data corresponding to the k-th training batch are output to train the pulse neural network model until k is equal to K or the loss function converges, thereby obtaining the log anomaly detection model, wherein the initial value of k is 1, and K is the total number of training batches.

3. The method according to claim 2, characterized in that Based on the output of the spiking neural network model and the labels of each sample system log sequence, a loss function is calculated, including: The loss function is calculated using the following formula (2); （2） In the above formula (2), represents the loss function, Represents the predicted value of the sample system log sequence corresponding to the nth time step in the training data corresponding to the kth training batch , the label of the sample system log sequence corresponding to the nth time step The error between represents the regularization coefficient, represents the L2 regularization of the target parameter, where Represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

4. The method according to claim 2, characterized in that The target parameters are fine-tuned using the loss function to obtain a k-th trained spiking neural network model after fine-tuning, including: Based on the pulse activation function of any neuron in the spiking neural network model, calculating the generation gradient of any neuron at different time steps during the kth training, wherein, during the kth training, each training data in the kth training batch input corresponds to one time step, and the generation gradient of any neuron at different time steps is used to characterize the generation gradient of any neuron relative to each training data after each training data in the kth training batch is input into the spiking neural network model; Calculate the gradient of the loss function relative to the target parameter based on the generation gradient of any neuron at different time steps and the loss function; The target parameters are updated using the gradient of the loss function relative to the target parameters, so as to obtain the pulse neural network model after the k-th training after updating the target parameters.

5. The method according to claim 4, characterized in that Based on the pulse activation function of any neuron in the spiking neural network model, the generation gradient of any neuron at different time steps during the k-th training is calculated, including: For the nth time step, the membrane potential of any neuron at the nth time step during the kth training is obtained; Using the membrane potential of any neuron at the nth time step and the pulse activation function of any neuron, and using the following formula (3), calculate the generation gradient of any neuron at the nth time step; （3） In the above formula (3), represents the generation gradient of any neuron at the nth time step, represents the partial derivative of the impulse activation function of any neuron with respect to the membrane potential of any neuron at the nth time step, represents the pulse activation function of any neuron, represents the membrane potential of any neuron at the nth time step; in, , where represents the attenuation factor, represents the membrane potential of any neuron at the n-1th time step, represents the pulse input of any neuron at the nth time step.

6. The method according to claim 4, characterized in that Calculating the gradient of the loss function relative to the target parameter based on the generation gradient of any neuron at different time steps and the loss function, including: According to the following formula (4), the gradient of the loss function with respect to the target parameter is calculated; （4） In the above formula (4), represents the gradient of the loss function with respect to the target parameter, represents the generation gradient of any neuron at the nth time step, represents the initial gradient of the loss function with respect to the target parameter, where Represents the total number of time steps, and one time step corresponds to a sample system log sequence in the k-th training batch.

7. A system log detection device based on a spiking neural network, used to execute the system log detection method based on a spiking neural network according to any one of claims 1 to 6, characterized in that: The device includes: An acquiring unit, configured to acquire a system log sequence, wherein the system log sequence includes a plurality of system logs; A word embedding unit, configured to input the system log sequence into a pre-trained T5 model to obtain a word embedding sequence corresponding to the system log sequence, wherein the word embedding sequence includes a plurality of word embedding vectors, each word embedding vector corresponds to a system log in the system log sequence, and any word embedding vector includes semantic information of the system log corresponding to the any word embedding vector; an encoding unit, configured to perform pulse feature encoding processing on each word embedding vector in the word embedding sequence to obtain a spatiotemporal pulse sequence corresponding to each word embedding vector, and to form a log pulse sequence using the obtained spatiotemporal pulse sequence; An anomaly detection unit is used to input the log pulse sequence into a log anomaly detection model to obtain an anomaly detection result corresponding to the system log sequence, wherein the log anomaly detection model adopts a trained pulse neural network model, and the log anomaly detection model is trained with the log pulse sequences of several sample system log sequences as input and the anomaly detection results of each sample system log sequence as output.

8. A system log detection device based on pulse neural network, characterized in that: include: A memory, a processor, and a transceiver that are sequentially communicatively connected, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program, and execute the system log detection method based on a pulse neural network according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium stores instructions, and when the instructions are executed on a computer, the system log detection method based on a pulse neural network according to any one of claims 1 to 6 is executed.

Images