Unsupervised log anomaly detection method and device based on multi-feature static weighted fusion, equipment and medium

Abstract

The invention relates to the technical field of log anomaly detection, and provides an unsupervised log anomaly detection method, device, equipment and medium based on multi-feature static weighted fusion, and the method comprises the steps: obtaining a basic feature set for feature learning through data preprocessing, and the basic feature set comprises sequence features, statistical features and semantic features; using the basic feature set for feature learning to train a three-channel LSTM-FC network model, and obtaining a log anomaly detection model after training is completed; and performing log anomaly detection by using the log anomaly detection model. According to the method, a three-channel LSTM-FC feature learning mode is adopted, feature learning is carried out on sequence features, statistical features and semantic features obtained after original log conversion, and then weighted fusion is carried out on feature learning results in combination with learnable normalized weight factors; the problems of low feature fusion efficiency and insufficient model interpretability of log anomaly detection can be solved, and the log anomaly detection performance is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of log anomaly detection, and in particular, to an unsupervised log anomaly detection method, device, equipment and medium based on multi-feature static weighted fusion. Background Art

[0002] With the rapid progress of information technology, the scale of systems such as cloud computing platforms, distributed systems, and Internet of Things devices continues to expand and the complexity continues to increase. The logs generated by these systems have become an indispensable key information source for recording their operating status, operation behaviors, and potential faults, providing a solid basis for the operation and maintenance team to evaluate the system health status and accurately locate anomalies.

[0003] Facing the huge and highly unstructured log data, the anomaly detection task poses more stringent requirements on the model's ability to capture multi-dimensional features. Given the actual situation of scarce anomaly samples and high annotation costs, traditional supervised learning methods are significantly restricted in such application scenarios. Therefore, exploring convenient and efficient unsupervised learning methods to optimize anomaly detection performance by deeply mining the internal laws and structures of data has become an important research direction at present.

[0004] Currently, log anomaly detection in an unsupervised manner mainly relies on sequence features, statistical features, semantic features, and time features, etc. The core differences in the process of different models performing log anomaly detection are reflected in the feature fusion method and the type and structure of the neural network used. Currently, the feature fusion method mainly focuses on feature concatenation, and some models will consider introducing an attention mechanism to enhance the model's attention to key features. However, the existing feature concatenation methods have two problems: First, simple concatenation operations are difficult to effectively distinguish the importance of features, resulting in secondary features possibly masking key signals; Second, high-dimensional concatenation is prone to cause the curse of dimensionality, thereby reducing the generalization ability of the model. Moreover, although the introduction of the attention mechanism can improve the model performance to a certain extent, it also increases the complexity and computational cost of the model. More importantly, in some cases, such as when the relationship between features is very complex and highly non-linear, the attention mechanism may not be able to accurately reflect the true relationship between features, thereby having a negative impact on the model performance. Summary of the Invention

[0005] The present invention aims to provide an unsupervised log anomaly detection method, device, equipment and medium based on multi-feature static weighted fusion to solve the problems of low-efficiency feature fusion and insufficient model interpretability faced by log anomaly detection, so as to improve the log anomaly detection performance.

[0006] In a first aspect, the present invention provides an unsupervised log anomaly detection method based on multi-feature static weighted fusion, including:

[0007] A basic feature set for feature learning is obtained through data preprocessing, including sequence features, statistical features, and semantic features;

[0008] Using the basic feature set for feature learning, a three-channel LSTM-FC network model is trained, and after training, a log anomaly detection model is obtained;

[0009] The log anomaly detection model is used to detect log anomalies.

[0010] In some embodiments, the data preprocessing includes:

[0011] Parsing the log template;

[0012] Constructing sequence features based on the log template parsing result;

[0013] Constructing statistical features based on the sequence features;

[0014] Constructing semantic features based on the log template parsing result and associating the sequence features.

[0015] In some embodiments, the training of the three-channel LSTM-FC network model includes:

[0016] Performing feature learning based on the LSTM layer;

[0017] Performing feature classification on the output sequence of the LSTM layer based on the fully connected layer;

[0018] Performing multi-feature static weighted fusion on the output result of the fully connected layer;

[0019] Calculating the error and adjusting the model parameters based on the multi-feature static weighted fusion result.

[0020] In some embodiments, the multi-feature static weighted fusion includes:

[0021] Initializing a weight matrix;

[0022] Applying the Softmax function to normalize the initialized weight matrix to obtain a normalized weight matrix;

[0023] Decomposing the normalized weight matrix into three one-dimensional weight vectors;

[0024] Using the three one-dimensional weight vectors to perform weighted fusion on the output results of the three fully connected layers.

[0025] In some embodiments, the using the three one-dimensional weight vectors to perform weighted fusion on the output results of the three fully connected layers is expressed as:

[0026]

[0027] Among them, multi_out is the final output vector after weighted fusion, i represents the i-th channel, and W i represents the one-dimensional weight vector of the i-th channel, and FC i _out represents the output result of the fully connected layer of the i-th channel.

[0028] In some embodiments, the error calculation and model parameter adjustment include:

[0029] Taking the log template code following each sequence feature as the expected result;

[0030] According to the numerical values of each dimension of the final output vector after weighted fusion, predicting the log template code under the corresponding feature to obtain the prediction result;

[0031] Calculating the cross entropy between the prediction result and the expected result, and taking it as the loss value;

[0032] Using the error backpropagation mechanism, transmitting the loss value to the LSTM layer, the fully connected layer and the weight matrix, and adjusting the model parameters according to the gradient information of the loss value.

[0033] In some embodiments, the use of the log anomaly detection model for log anomaly detection includes:

[0034] The log to be detected undergoes data preprocessing to obtain a basic feature set for anomaly detection, including sequence features, statistical features and semantic features;

[0035] Inputting the basic feature set for anomaly detection into the log anomaly detection model to output the prediction result after weighted fusion;

[0036] Comparing and analyzing the output prediction result with the real log sequence to determine whether it is an abnormal log.

[0037] In a second aspect, the present invention provides an unsupervised log anomaly detection device based on multi-feature static weighted fusion, including:

[0038] A data preprocessing module for obtaining a basic feature set for feature learning through data preprocessing, including sequence features, statistical features and semantic features;

[0039] A model training module for training a three-channel LSTM-FC network model using the basic feature set for feature learning, and obtaining a log anomaly detection model after training;

[0040] An anomaly detection module for using the log anomaly detection model to perform log anomaly detection.

[0041] In a third aspect, the present invention provides an electronic device, including:

[0042] at least one processor; and a memory communicatively connected to the at least one processor;

[0043] wherein, the memory stores instructions executable by the at least one processor, and the at least one processor, by executing the instructions stored in the memory, causes the at least one processor to execute the above-mentioned method.

[0044] In a fourth aspect, the present invention provides a computer-readable storage medium for storing instructions, which, when executed, cause the above-mentioned method to be implemented.

[0045] In summary, due to the adoption of the above technical solutions, the beneficial effects of the present invention are as follows:

[0046] The present invention adopts a three-channel LSTM-FC feature learning mode to respectively perform feature learning on the sequence features, statistical features, and semantic features obtained after the conversion of the original logs, and then combines a learnable normalization weight factor to perform weighted fusion on the feature learning results, which can solve the problems of low efficiency of feature fusion and insufficient model interpretability faced by log anomaly detection, and improve the performance of log anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of an unsupervised log anomaly detection method based on multi-feature static weighted fusion provided by an embodiment of the present invention.

[0048] Figure 2 It is a schematic structural diagram of an unsupervised log anomaly detection device based on multi-feature static weighted fusion provided by an embodiment of the present invention.

[0049] Figure 3 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. Usually, the components of the embodiments of the present invention described and illustrated herein can be arranged and designed in various different configurations.

[0051] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0052] Aiming at the problems of low efficiency in feature fusion and insufficient model interpretability faced by log anomaly detection, in order to improve the performance of log anomaly detection, as Figure 1 shown, an unsupervised log anomaly detection method based on multi-feature static weighted fusion is proposed in an embodiment of the present invention. This method adopts a three-channel LSTM-FC feature learning mode to perform feature learning on the sequence features, statistical features, and semantic features obtained after the transformation of the original logs respectively, and then combines a learnable normalization weight factor to perform weighted fusion on the feature learning results. The specific steps are as follows:

[0053] Step S1: Obtain a basic feature set for feature learning through data preprocessing;

[0054] Step S2: Use the basic feature set for feature learning to train a three-channel LSTM-FC network model, and obtain a log anomaly detection model after training;

[0055] Step S3: Use the log anomaly detection model to perform log anomaly detection.

[0056] In step S1, data preprocessing is one of the keys to the realization of log anomaly detection. Its core goal is to convert the original, unstructured log data into structured data features that can be understood and utilized by machine learning models. This process can improve the usability of data and enhance the training efficiency and prediction accuracy of the model. In some embodiments, the data preprocessing includes the following sub-steps:

[0057] Step S11: Parse the log template;

[0058] Relying on existing log template parsing algorithms, such as Drain, FT-Tree, and Spell, parse the original logs; after parsing, each log will be assigned a unique log template code.

[0059] Step S12: Construct sequence features based on the log template parsing results.

[0060] Sort the original log entries according to their generation time sequence, and then associate the log template parsing results to form an ordered log sequence;

[0061] The sliding window technology is used to traverse the ordered log sequence with a set window size, and the event sequences in different time periods are captured as sequence features.

[0062] Step S13: constructing statistical features based on the sequence features.

[0063] The statistical feature is a statistical result of the occurrence frequency of different types of events in the sequence feature, which is expressed in the form of a vector, and each element in the vector corresponds to the number of occurrences of a log template code.

[0064] Step S14: constructing semantic features based on the log template parsing results and associating them with the sequence features.

[0065] Use pre-trained word vector models, such as Word2Vec and BERT, to map log templates into a high-dimensional semantic space, thereby accurately capturing the deep semantics of the logs and obtaining semantic features.

[0066] A one-to-one association relationship is established between the semantic features and the sequence features, thereby generating a corresponding semantic feature sequence.

[0067] By combining the above steps S11 to S14, the original log data can be converted into a rich and structured feature set, and the operating status and potential problems of the system can be analyzed based on these features.

[0068] In step S2, during the model training phase, only completely normal logs are used as training data to accurately capture the underlying patterns of normal logs. However, for the logs to be detected, they are unknown and may contain normal or abnormal logs. Whether they are training logs or logs to be detected, they all need to go through the above-mentioned data preprocessing process to obtain the basic feature set for feature learning or anomaly detection, namely: sequence features, statistical features, and semantic features. Subsequently, a three-channel LSTM-FC network model is used to conduct in-depth analysis of sequence features, statistical features, and semantic features, respectively, in order to explore the deep information in each type of feature. Afterwards, the feature static weighted fusion method is used to achieve comprehensive learning and accurate discrimination of multivariate features. In some embodiments, step S2 includes the following sub-steps:

[0069] Step S21: Perform feature learning based on the LSTM layer.

[0070] The basic feature set of the present invention includes sequence features, statistical features and semantic features, and three LSTM layers (such as Figure 1 The LSTM-0, LSTM-1, and LSTM-2 shown in the figure process their respective input features in parallel to extract deep feature information.

[0071] Step S22: Classify the output sequence of the LSTM layer based on the fully connected layer.

[0072] Corresponding to the aforementioned 3 LSTM layers, the present invention constructs 3 fully connected layers (such as Figure 1 FC-0, FC-1, FC-2 shown) to process the output sequences of LSTM-0, LSTM-1, and LSTM-2 respectively. Thus, the input dimension of the fully connected layer is the output dimension of each LSTM layer, and the output dimension is the total number of log template types. After being processed by the fully connected layer, three output vectors are obtained, denoted as FC0_out, FC1_out, and FC2_out, and these vectors respectively correspond to the classification results of different feature channels.

[0073] Step S23: Perform multi-feature static weighted fusion on the output results of the fully connected layer.

[0074] First, initialize the weights. Initialize a weight matrix with its size being "3 × total number of log templates", and this weight matrix provides an initial weight assignment for subsequent feature fusion.

[0075] Second, normalize the weights. Apply the Softmax function to normalize the initialized weight matrix to obtain a normalized weight matrix. This step ensures the non-negativity and the property of summing to 1 of the weights, providing a reasonable weight assignment for subsequent weighted summation.

[0076] Then, decompose the weights. Decompose the normalized weight matrix into three one-dimensional weight vectors, denoted as W0, W1, and W2, and each one-dimensional weight vector respectively corresponds to the weights of the three feature channels. These weight vectors reflect the importance of different features in the final output, providing a scientific basis for feature fusion.

[0077] Finally, perform weighted summation. Use the three one-dimensional weight vectors to perform weighted fusion on the output results of the three fully connected layers to obtain the final output vector multi_out. This process can be expressed by the following formula:

[0078]

[0079] where i represents the i-th channel.

[0080] Step S24: Calculate the error and adjust the model parameters based on the multi-feature static weighted fusion result.

[0081] First, set the expected result. In the execution of the log anomaly detection task, use the log template code following each sequence feature as the expected result.

[0082] Secondly, calculate the prediction results. Based on the values of each dimension of the final output vector multi_out, predict the log template codes under the corresponding features to obtain the prediction results.

[0083] Then, evaluate the prediction error. Calculate the cross-entropy between the prediction results and the expected results, and use it as the loss value to reflect the difference between the model's predicted distribution and the true distribution.

[0084] Finally, adjust the model parameters. Use the error backpropagation mechanism to transmit the loss value to the LSTM layer, fully connected layer, and weight matrix, and adjust the model parameters according to the gradient information of the loss value to reduce the prediction error and improve the prediction accuracy.

[0085] As the training progresses, the model will gradually master the internal laws and patterns of normal log data, accumulate the necessary knowledge for log anomaly detection, and support subsequent log anomaly detection tasks.

[0086] In some embodiments, in step S3, the logs to be detected go through the same data preprocessing process to obtain a basic feature set for anomaly detection, including sequence features, statistical features, and semantic features. These features are then input into a trained log anomaly detection model. The log anomaly detection model analyzes these features and finally outputs the prediction results after static weighted fusion. By comparing and analyzing the prediction results with the true log sequence, it is determined whether it is an abnormal log. If the actual log sequence is inconsistent with the prediction results, it is an abnormal log; otherwise, it is not an abnormal log.

[0087] The following analyzes the performance of the present invention through experiments:

[0088] The experimental conditions are set as follows:

[0089] (1) The experimental hardware is: 11th Gen Intel(R) Core(TM) i9-11900, 2.50GHz CPU, 64.0GB RAM; the software environment is: Windows 10 operating system, torch 2.1.0 deep learning framework, Python 3.10.9.

[0090] (2) Use the HDFS dataset for experimental verification. This dataset is collected from the Hadoop distributed file system on the Amazon EC2 platform, with a total of 11,175,629 log messages, of which 16,838 log blocks are labeled as abnormal. These logs are parsed into 28 log templates through the FT-Tree method, and then the Word2vec method is used for word embedding. The experimental dataset is divided as shown in Table 1.

[0091] Table 1, Experimental dataset:

[0092] HDFS dataset Normal log block Abnormal log block Training set 4855 0 Test set 16838 553366

[0093] (3) The evaluation metrics are Precision, Recall, and F1 score.

[0094] (4) The remaining parameter settings in the experiment are shown in Table 2.

[0095] Table 2, Experimental parameters:

[0096] Name Value Batch size 1024 Number of LSTM layers 2 Number of LSTM hidden units 64 Learning rate 0.001 Sliding window size 10 Sliding step size 1 Number of training epochs 400 Optimizer Adam()

[0097] (5) To verify the contribution of sequence features, statistical features, and semantic features to the performance of model log anomaly detection after weighted fusion, a series of ablation experiments were designed and executed. These experiments aimed to analyze the impact of each feature on the model performance by comparing different feature fusion strategies. Specifically, Experiment I: direct summation of sequence features and statistical features; Experiment II: direct summation of the three types of features; Experiment III: weighted summation of the three types of features (weights not normalized); Experiment IV: weighted summation of the three types of features (weights normalized). In all experiments, the same training set and test set were used for training and evaluation, and other parameters and configurations of the model were the same. On the basis of ensuring the fairness and comparability of the experimental results, the effects of different feature fusion methods were verified.

[0098] The experimental results are shown in Table 3, and the results indicate that:

[0099] 1. After adding semantic features (Experiment II), the log anomaly detection performance of the model is improved compared to using only sequence features and statistical features (Experiment I). This verifies that the incorporation of semantic features can enrich the expressive ability of features, thereby improving the performance of the model;

[0100] 2. Using the weighted summation method (Experiment III) is optimized in performance compared to direct summation (Experiment II). This shows that weighted summation allows the model to flexibly adjust the influence of different features on the final decision according to the characteristics of the input data and task requirements, which helps the model better capture and utilize information when dealing with complex tasks;

[0101] 3. Normalizing the weights (Experiment IV) further improves the performance compared to non-normalization (Experiment III). This proves the importance of weight normalization, which helps the model maintain stable performance when fusing different features and avoid performance degradation caused by improper weight allocation.

[0102] Table 3, Anomaly detection performance under different experimental conditions:

[0103] Experiment Precision / % Recall / % F1 / ％ Experiment I 95.4 93.6 94.5 Experiment II 96.8 93.0 94.9 Experiment III 96.5 98.6 97.5 Experiment IV 96.2 99.5 97.8

[0104] In summary, the results of the ablation experiments fully verify the positive effect of the static weighted fusion strategy of sequence features, statistical features, and semantic features in improving the performance of log anomaly detection. Using weighted summation is better than direct summation, and weight normalization further improves the performance of the model. This indicates that when constructing a log anomaly detection model, reasonable selection and fusion of features, as well as the adoption of an appropriate weight allocation strategy, are the keys to improving the model's performance.

[0105] Based on the same inventive concept, this embodiment also provides an unsupervised log anomaly detection device based on multi-feature static weighted fusion, as Figure 2 shown, including:

[0106] A data preprocessing module for obtaining a basic feature set for feature learning through data preprocessing, including sequence features, statistical features, and semantic features;

[0107] A model training module for training a three-channel LSTM-FC network model using the basic feature set for feature learning, and obtaining a log anomaly detection model after training;

[0108] An anomaly detection module for performing log anomaly detection using the log anomaly detection model.

[0109] As for the specific processing methods of each functional module in the above device, reference can be made to the specific description of the above method, which will not be elaborated here.

[0110] Based on the same technical concept, this embodiment of the present invention also provides an electronic device, which can implement the process of the unsupervised log anomaly detection method based on multi-feature static weighted fusion provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. As Figure 3 shown, the electronic device may include:

[0111] At least one processor, and a memory connected to at least one processor. In the embodiments of the present invention, the specific connection medium between the processor and the memory is not limited. Figure 3 Here, it is taken as an example that the processor and the memory are connected through a bus. The bus is represented by a thick line in Figure 3 Here. The connection methods between other components are only for illustrative purposes and are not to be construed as limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 3 Here, only one thick line is used to represent it, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor can also be called a controller, and the name is not limited.

[0112] In an embodiment of the present invention, the memory stores instructions executable by at least one processor. By executing the instructions stored in the memory, the at least one processor can execute an unsupervised log anomaly detection method based on multi-feature static weighted fusion discussed above. The processor can implement Figure 3 the functions of each module in the device shown.

[0113] Among them, the processor is the control center of the device. It can connect various parts of the entire control device through various interfaces and lines. By running or executing the instructions stored in the memory and calling the data stored in the memory, various functions of the device and process data, so as to monitor the device as a whole.

[0114] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor. Among them, the application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor may not be integrated into the processor. In some embodiments, the processor and the memory may be implemented on the same chip. In some embodiments, they may also be implemented separately on independent chips.

[0115] The processor may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of an unsupervised log anomaly detection method based on multi-feature static weighted fusion disclosed in combination with the embodiments of the present invention can be directly embodied as being completed by a hardware processor, or completed by a combination of hardware and software modules in the processor.

[0116] A memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory can include at least one type of storage medium, for example, it can include flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disc, and so on. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiments of the present invention can also be a circuit or any other device capable of implementing a storage function, for storing program instructions and / or data.

[0117] By designing and programming the processor, the code corresponding to an unsupervised log anomaly detection method based on multi-feature static weighted fusion introduced in the foregoing embodiments can be solidified into the chip, so that the chip can execute the steps of the method in the above embodiments when running. How to design and program the processor is a well-known technology to those skilled in the art and will not be elaborated here.

[0118] Based on the same inventive concept, an embodiment of the present invention also provides a storage medium storing computer instructions, which when run on a computer, cause the computer to execute an unsupervised log anomaly detection method based on multi-feature static weighted fusion discussed above.

[0119] In some alternative embodiments, the present invention also provides that various aspects of an unsupervised log anomaly detection method based on multi-feature static weighted fusion can also be implemented in the form of a program product, which includes program code that, when the program product runs on a device, causes the control device to execute the steps in an unsupervised log anomaly detection method according to various exemplary embodiments of the present invention described above in this specification.

[0120] It should be noted that although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present invention, the features and functions of two or more of the above-described units may be embodied in one unit. Conversely, the features and functions of one unit described above may be further divided and embodied by multiple units. Additionally, although the operations of the method of the present invention are described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the illustrated operations must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution.

[0121] Those skilled in the art should understand that the embodiments of the present invention may be provided as a method, system, or computer program product. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0122] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combinations of flows and / or blocks in the flowchart and / or block diagram, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, such that the instructions executed by the processor of the computer or other programmable data processing device generate means for realizing the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0123] Program code for performing the operations of the present invention may be written using any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and also including conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, executed as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0124] In the case of a remote computing device, the remote computing device can be connected to the user computing device via any kind of network including a local area network (LAN) or a wide area network (WAN), or, it can be connected to an external computing device (e.g., by using an Internet service provider to connect via the Internet).

[0125] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device that implements the functions specified in one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 specified in the block or blocks.

[0126] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes and / or blocks Figure 1 one or more processes and / or blocks Figure 1 specified in the block or blocks.

[0127] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. An unsupervised log anomaly detection method based on multi-feature static weighted fusion, characterized in that Including: Obtaining a basic feature set for feature learning through data preprocessing, including sequence features, statistical features, and semantic features; Using the basic feature set for feature learning to train a three-channel LSTM-FC network model, and obtaining a log anomaly detection model after training; Using the log anomaly detection model to perform log anomaly detection.

2. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 1, wherein The data preprocessing includes: Parsing the log template; Constructing sequence features based on the parsing result of the log template; Constructing statistical features based on the sequence features; Constructing semantic features based on the parsing result of the log template and associating the sequence features.

3. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 2, wherein, The training of the three-channel LSTM-FC network model includes: Performing feature learning based on the LSTM layer; Performing feature classification on the output sequence of the LSTM layer based on the fully connected layer; Performing multi-feature static weighted fusion on the output result of the fully connected layer; Performing error calculation and model parameter adjustment based on the multi-feature static weighted fusion result.

4. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 3, wherein The multi-feature static weighted fusion includes: Initializing a weight matrix; Applying the Softmax function to normalize the initialized weight matrix to obtain a normalized weight matrix; Decomposing the normalized weight matrix into three one-dimensional weight vectors; Using the three one-dimensional weight vectors to perform weighted fusion on the output results of the three fully connected layers.

5. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 4, wherein The using the three one-dimensional weight vectors to perform weighted fusion on the output results of the three fully connected layers is expressed as: Among them, multi_out is the final output vector after weighted fusion, i represents the i-th channel, and W i represents the one-dimensional weight vector of the i-th channel, and FC i _out represents the output result of the fully connected layer of the i-th channel.

6. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 5, wherein The error calculation and model parameter adjustment include: Taking the log template code number following each sequence feature as the expected result; Predicting the log template code number under the corresponding feature according to the numerical values of each dimension of the final output vector after weighted fusion to obtain a prediction result; Calculating the cross entropy between the prediction result and the expected result and taking it as the loss value; Using the error backpropagation mechanism to transmit the loss value to the LSTM layer, the fully connected layer, and the weight matrix, and adjusting the model parameters according to the gradient information of the loss value.

7. The unsupervised log anomaly detection method based on multi-feature static weighted fusion according to claim 1, characterized in that, The using the log anomaly detection model to perform log anomaly detection includes: The log to be detected undergoes data preprocessing to obtain a basic feature set for anomaly detection, including sequence features, statistical features, and semantic features; Inputting the basic feature set for anomaly detection into the log anomaly detection model to output a prediction result after weighted fusion; Comparing and analyzing the output prediction result with the real log sequence to determine whether it is an abnormal log.

8. An unsupervised log anomaly detection device based on multi-feature static weighted fusion, characterized in that, Including: A data preprocessing module for obtaining a basic feature set for feature learning through data preprocessing, including sequence features, statistical features, and semantic features; A model training module for using the basic feature set for feature learning to train a three-channel LSTM-FC network model, and obtaining a log anomaly detection model after training; An anomaly detection module for using the log anomaly detection model to perform log anomaly detection.

9. An electronic device, characterized in that, Including: At least one processor; And a memory communicatively connected to the at least one processor; Wherein, the memory stores instructions executable by the at least one processor, and by executing the instructions stored in the memory, the at least one processor causes the at least one processor to execute the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions, which, when executed, cause the method according to any one of claims 1-7 to be implemented.

Images