Log abnormal behavior analysis method and system based on sorting learning and attention mechanism

Abstract

The invention discloses a log abnormal behavior analysis method and system based on sorting learning and an attention mechanism, and relates to the technical field of system operation and maintenance. The method comprises the following steps: performing structured analysis on original log data and constructing a log sequence; extracting a periodic component, a trend component and a residual component through periodic neural decomposition; generating a running phase label based on the service calling relation and labeling a log sequence; modeling an association structure between log events by using a multi-head attention mechanism of phase perception, and outputting an abnormal score in combination with a sorting learning strategy; fusing the periodic stability index and the abnormal score to construct a health measurement value, and executing abnormal judgment and alarm strategy control based on a joint result; a structure-limited confrontation sample mechanism and structure deviation detection are introduced in the training and reasoning process, and the robustness of the model to structure disturbance is enhanced. The method has the technical advantages of being high in periodic modeling adaptability, high in anomaly detection precision, excellent in structure defense capability and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of system operation and maintenance, and particularly relates to a method and system for analyzing abnormal log behaviors based on ranking learning and attention mechanism. Background Art

[0002] The current widespread deployment of distributed systems in cloud computing, microservices architecture, and containerized environments makes the real-time perception of the system operation status a key task for ensuring service reliability and stability. Logs, as the most important time-series structured operation records, are important bases for system behavior analysis and anomaly detection. However, during the system operation process, there are often complex periodic behaviors, such as scheduled tasks, scheduling strategies, user access peaks, etc. Traditional methods are difficult to effectively separate periodic patterns from aperiodic anomalies, resulting in a decrease in the accuracy of anomaly detection; most models do not fully utilize the system operation structure information when processing log sequences, ignoring the call relationships and context dependencies between microservices, and it is easy to cause the lack of structural semantic support for anomaly determination; existing anomaly detection methods mostly adopt a single supervised learning objective, which is difficult to reflect the relative anomaly of the overall sequence, especially in scenarios such as boundary events and weak signal attacks, there are obvious deficiencies; there is a lack of an active defense mechanism for complex log perturbation behaviors. Especially under adversarial sample attacks, existing models lack stable structural detection capabilities and redundant anomaly recognition paths.

[0003] Therefore, there is an urgent need for a log anomaly analysis method that is oriented to complex structure logs, integrates system operation status modeling and behavior anomaly ranking, and has robust defense capabilities to improve the system security controllability and intelligent operation and maintenance capabilities. Summary of the Invention

[0004] Aiming at the problems in the existing technology for log behavior analysis, such as poor periodic recognition ability, weak structure perception ability, unstable anomaly scoring, etc., the present invention proposes a method and system for analyzing abnormal log behaviors based on ranking learning and attention mechanism.

[0005] The present invention realizes the above object through the following technical solutions:

[0006] A method for analyzing abnormal log behaviors based on ranking learning and attention mechanism, the method comprising:

[0007] Structurally parse the original log data collected from the target system, extract the log timestamp, event type, and content parameters to generate a log sequence;

[0008] Perform periodic neural decomposition on the log sequence, complete signal decomposition through a spectrum-guided periodic basis function to obtain a periodic component, a trend component, and a residual component, wherein the parameters of the periodic basis function are dynamically adjusted according to the system deployment version;

[0009] Based on the call relationship between microservices in the target system, a service topology is established. The operation phase boundary is identified based on the dependency path and tracking identifier, and a phase label is assigned to each log data in the log sequence.

[0010] The residual component and the phase label are divided into multiple time windows in chronological order and input into a sequence learning model. The sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase label so that log events in the same phase receive high attention weights.

[0011] The sequence learning model is trained using a ranking learning strategy to minimize the ranking error of the log sequence pairs so that the abnormal log sequence obtains a higher abnormality score than the normal log sequence;

[0012] Performing morphological similarity analysis on the periodic components, calculating the similarity between the current and historical periods based on the dynamic time warping method, and generating a periodic stability index in combination with the trend component;

[0013] Performing weighted fusion on the periodic stability index and the anomaly score to obtain a health metric value reflecting the operating status of the target system;

[0014] Based on the combined result of the health metric and the anomaly score, an abnormal event detection result is determined, or a subsequent alarm strategy and a judgment threshold are dynamically adjusted.

[0015] A further improvement of the present invention is that the method for implementing the execution cycle neural decomposition specifically includes:

[0016] The event intensity or embedding vector of each log data in the log sequence is constructed as a time-continuous signal, and the dominant frequency is extracted using fast Fourier transform to form a candidate set of periodic basis functions;

[0017] Frequency components are selected from the periodic basis function candidate set to construct a periodic basis function set, and each periodic basis function is defined as: g i (t) = a i ·cos(2πf i t+φ i );

[0018] The periodic component is formed by weighted superposition of multiple periodic basis functions, which can be expressed as:

[0019] Redundant basis functions are suppressed by introducing a sparse regularization loss term:

[0020] Where g i (t) is the output of the i-th periodic basis function at time t; a i 、f i 、φi The amplitude, frequency, and phase offset of the i-th periodic basis function, respectively; x(t) is the original input signal at time t, is the reconstruction result of the periodic part of the original input signal x(t); k represents the total number of periodic basis functions selected for reconstructing the periodic signal; is the total loss function in the optimization process; λ is the sparsity control coefficient;

[0021] Define the residual component as and extract the trend component by combining the moving average. The trend component, together with the periodic component, participates in subsequent periodic stability analysis and health metrics;

[0022] Dynamically adjust the initialization method of the trainable parameters and the candidate frequency range in the periodic basis function set according to the meta-information of the system deployment version, so as to enhance the adaptability of the periodic decomposition in the scenario of system version change.

[0023] A further improvement of the present invention is that the service topology graph is established based on the call relationship between microservices in the target system, and the running phase boundary is identified according to the dependency path and the tracing identifier. The method includes:

[0024] Real-time obtain the call requests and response data between microservices through the service mesh control plane call interface, and construct a directed graph composed of service nodes and call edges. The directed graph is dynamically updated to reflect the changes in service relationships;

[0025] Parse the tracing identifiers in the log sequence through distributed tracing technology, extract the corresponding service call chain paths, and map them as directed path sequences in the service topology graph;

[0026] Calculate the structural similarity between different call chain paths, and adaptively determine the division, merging, or splitting operations of the running phase based on the topological differences, so as to avoid phase fragmentation caused by topological micro-changes;

[0027] Combine the path transition points and the changes in call behavior patterns in the log sequence to identify the candidate running phase boundaries, and calculate the boundary confidence according to the path switching frequency and the log density change degree at the boundaries. Only when the boundary confidence exceeds the set threshold is it confirmed as the running phase boundary;

[0028] Divide the log sequence into multiple running phase segments according to the running phase boundaries, and attach the phase label to which each log data belongs.

[0029] A further improvement of the present invention is that the phase-aware multi-head attention mechanism includes:

[0030] Construct a mask matrix based on the phase label for each attention head, and only retain the attention connections between log events belonging to the same running phase;

[0031] Introduce a phase boundary suppression function in the mask matrix to perform attenuation processing on the attention connections between log events in different running phases;

[0032] Construct an attention scoring matrix within each time window Among them, for any two log events m, j that do not belong to the same running phase, set the attention scoring value to a very small negative value, and calculate A at the remaining positions according to the scaled dot-product attention formula m,j ;

[0033] Introduce a phase structure difference regularization term among multiple attention heads to control the distribution difference in the connections between the log events focused on by each attention head.

[0034] A further improvement of the present invention is that the sequence learning model is trained by adopting a ranking learning strategy, including:

[0035] Input the residual component and the phase label into the sequence learning model, and generate corresponding sequence representations after being processed by the phase-aware multi-head attention mechanism;

[0036] Input the sequence representation into a scoring function, and the scoring function is a trainable linear transformation or a multi-layer perceptron structure, which is used to output an anomaly score representing the degree of anomaly;

[0037] Construct a training sample pair composed of an abnormal log sequence and a normal log sequence, and adopt a margin ranking loss function for model training, defined as:

[0038] In the formula, s a 、s n are respectively the anomaly score values output by the model for the abnormal log sequence and the normal log sequence;

[0039] Optimize the model parameters by minimizing the margin ranking loss function, so that the sequence learning model can output an anomaly score for the input log sequence based on the scoring function during the inference stage.

[0040] A further improvement of the present invention is that morphological similarity analysis is performed on the periodic component, specifically including:

[0041] Align the current periodic component with the historical standard period in segments, and use the dynamic time warping method to calculate the total distance of the alignment path between the current and historical periods as the period difference degree, and identify the local sections with a mutation rate higher than the preset threshold in the alignment path, and output the morphological mutation ratio;

[0042] Integrate the amplitude of the sliding mean change and the change slope of the trend component, and perform weighted integration on the cycle difference degree and the morphological variation ratio to construct a cycle stability index;

[0043] The cycle stability index is used to characterize the integrity of the cycle structure and the trend consistency of the target system, and is used as the input of the subsequent health metric value.

[0044] A further improvement of the present invention is to perform weighted fusion on the cycle stability index and the anomaly score to obtain a health metric value reflecting the operating state of the target system. The method includes:

[0045] Normalize the anomaly score and the cycle stability index respectively to construct an anomaly score confidence level and a cycle index confidence level. The anomaly score confidence level is calculated based on the score volatility, and the cycle index confidence level is calculated based on the morphological variation ratio;

[0046] Taking the anomaly score confidence level and the cycle index confidence level as inputs, dynamically generate weighted vectors β1 and β2 through a non-linear function structure, and calculate the health metric value H as: H = β1·S cycle +β2·S anomaly , where β1 and β2 satisfy β1 + β2 = 1.

[0047] A further improvement of the present invention is to determine the anomaly event detection result or dynamically adjust the subsequent alarm strategy and decision threshold based on the joint result of the health metric value and the anomaly score. The method includes;

[0048] Input the anomaly score and the health metric value into a joint decision function, and determine whether it is abnormal according to the set joint decision rule, and output an anomaly label. The joint decision rule includes: the anomaly score is higher than the anomaly threshold, the health metric value is lower than the health threshold, or the combination of the two satisfies a set logical expression;

[0049] Construct a joint feature vector from the anomaly score, the health metric value and the anomaly label, and input it into a predefined classifier to output an anomaly type label or an anomaly level label;

[0050] Control the subsequent alarm strategy according to the anomaly type label or the anomaly level label, including alarm level classification, alarm frequency setting or target module routing switching;

[0051] During the operation of the system, dynamically adjust the anomaly threshold and the health threshold based on the sliding window change trend of the anomaly score and the health metric value and the difference between the detection result and the alarm feedback.

[0052] A further improvement of the present invention is that during the training and inference process of the sequence learning model, it also includes:

[0053] During the training process, construct structure-constrained adversarial samples based on the original log data. The structure-constrained adversarial samples are generated by adding perturbation vectors that maintain structural consistency, and the perturbation process is controlled by the constraint of the log template syntax tree structure to ensure the parseability and field integrity of the structure-constrained adversarial samples in terms of syntax structure;

[0054] Constructing the log template syntax tree structure includes: performing template extraction on the original log data to generate a field-level and syntax pattern node graph. During the perturbation process, only perturbation is allowed to be added to variable parameter fields, and any modification to fixed template fields is prohibited;

[0055] Introduce the structure-constrained adversarial samples in model training, and jointly input normal log sequences into the sequence learning model to enhance the model's ability to recognize abnormal behaviors under structural consistency;

[0056] During the model inference process, perform syntax structure parsing on the input log sequence, and calculate the structure deviation metric between the log sequence and the log template. The structure deviation metric represents the degree of difference in field structure between the current input and the log template;

[0057] When the value of the structure deviation metric exceeds the set threshold, switch to an alternative detection structure that includes a rule-constrained path.

[0058] A log abnormal behavior analysis system based on ranking learning and attention mechanism is applied to the log abnormal behavior analysis method based on ranking learning and attention mechanism as described above. The system includes:

[0059] A log collection and parsing module for collecting the original log data generated during the operation of the target system, and extracting log timestamps, event types, and content parameters to generate a structured log sequence;

[0060] A periodic neural decomposition module for performing periodic neural decomposition on the log sequence to construct periodic components, trend components, and residual components represented by trainable periodic basis functions;

[0061] A topological phase annotation module for constructing a service topology graph based on microservice call relationships, parsing the service call chain path in combination with log trace identifiers, calibrating the operation phase boundary, and adding operation phase labels to each log data in the log sequence;

[0062] A sequence learning module that includes a phase-aware multi-head attention mechanism and a ranking learning training strategy for modeling the relationships between log events based on the input residual components and phase labels, and outputting an anomaly score;

[0063] A periodic stability analysis module, configured to calculate a periodic stability index based on periodic components and trend components by using a dynamic time warping method and a sliding trend analysis;

[0064] A health metric generation module, configured to perform weighted fusion on an anomaly score and the periodic stability index, and output a health metric value reflecting the operating state of the target system;

[0065] A joint determination and alarm module, configured to determine an abnormal event based on a joint result of the anomaly score and the health metric value, output an anomaly label, an anomaly type label or an anomaly level label according to the determination result, and dynamically adjust an alarm policy, an anomaly threshold and a health threshold;

[0066] An adversarial robustness enhancement module, configured to generate structurally constrained adversarial samples during a training process, parse a syntax structure of an input log sequence during an inference phase, calculate a structure deviation degree index, and switch to an alternative detection structure including a rule constraint path when the structure deviation degree index value exceeds a set threshold.

[0067] The beneficial effects of the present invention are as follows: a periodic neural decomposition mechanism is introduced, a trainable periodic basis function is constructed based on spectrum guidance, periodic components, trend components and residual components are jointly extracted, and dynamic adaptation to the system deployment version is realized, significantly enhancing the generalization ability and evolution adaptability of periodic modeling; by combining a microservice topology structure and call chain tracing information, a service dependency graph is established and a running phase label is generated, enabling log sequence partitioning and context modeling to synchronize with system structure evolution; the residual component and the phase label are jointly input into a sequence learning model, and through a phase-aware multi-head attention mechanism, the model focuses on key behavior events within the same running phase, reducing attention diffusion caused by cross-structure interference; a ranking learning strategy is adopted to train the model, with the goal of minimizing the ranking error that the anomaly sequence score is higher than the normal sequence score, avoiding the problem of insufficient learning of boundary samples by traditional classification models, and realizing relative ranking modeling of abnormal behaviors; by comprehensively considering periodic stability and anomaly scores, a health metric value is constructed, enhancing the stability and dynamic sensitivity of the overall system state judgment while maintaining real-time performance, providing quantitative support for subsequent anomaly responses; by combining a structure deviation index and an alternative detection path during the inference phase, the ability to detect adversarial perturbations under syntax structure consistency is realized, improving the robustness of the model in an open deployment environment. Description of the Drawings

[0068] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can also obtain other drawings without creative efforts.

[0069] Wherein:

[0070] Figure 1 is the method flow chart in the embodiment of the present invention;

[0071] Figure 2 is the system structure block diagram in the embodiment of the present invention. Specific implementation manners

[0072] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the described embodiments of the present invention fall within the scope of protection of the present invention.

[0073] As Figure 1 shown, it is an embodiment of the present invention, and this embodiment provides a method for analyzing log abnormal behaviors based on ranking learning and attention mechanism, including the following steps:

[0074] S1: Structurally parse the original log data collected in the target system, extract log timestamps, event types, content parameters, etc., and generate a structured log sequence.

[0075] S2: Perform periodic neural decomposition on the log sequence, complete signal decomposition through a spectrum-guided periodic basis function, and obtain a periodic component, a trend component, and a residual component, where the parameters of the periodic basis function are dynamically adjusted according to the system deployment version.

[0076] The periodic neural decomposition process is used to extract the signal components reflecting the periodicity of the system operation from the log sequence, and distinguish the periodic component, the trend component, and the residual component in a structured manner, providing stable feature inputs for subsequent phase annotation and anomaly detection.

[0077] In one of the embodiments, the implementation method of step S2 includes:

[0078] S21: Arrange the original log data collected in the target system in chronological order, and extract the event intensity value of each log, or generate a corresponding embedding vector through a preset log embedding coding network to form an input signal sequence;

[0079] S22: Use the fast Fourier transform (FFT) to perform spectrum analysis on the input signal sequence, extract several dominant frequencies to form a frequency set {f1, f2,..., f m}, and this frequency set is used as the candidate frequency set of the periodic basis function, where each frequency analysis corresponds to a candidate basis function structure;

[0080] S23: During the actual modeling process, k frequency components are selected from the candidate set to construct a set of periodic basis functions. Each periodic basis function is defined as: g i (t) = a i ·cos(2πf i t + φ i ); where g i (t) is the output of the i-th periodic basis function at time t; a i , f i , φ i are the amplitude, frequency, and phase shift of the i-th periodic basis function respectively, which can be optimized through backpropagation during the training process;

[0081] S24: The sum of all periodic basis functions forms an approximate reconstruction term of the periodic signal, that is, the periodic component, expressed as:

[0082] S25: To prevent the model from learning redundant periodicity during training and improve the interpretability and generalization ability of periodic modeling, a sparse regularization loss term is introduced during the training process. The overall optimization objective is:

[0083] In the formula, x(t) is the original input signal at time t, is the reconstruction result of the periodic part of the original input signal x(t); k represents the total number of periodic basis functions selected for reconstructing the periodic signal; is the total loss function during the optimization process; λ is the sparsity control coefficient, which can adjust the retention degree of the periodic component;

[0084] S26: After extracting the periodic component, the residual component is defined as To further extract the long-term trend change of the system, the multi-scale moving average method is used to calculate the trend values in different time windows respectively, and finally the multi-scale trends are weighted and combined to form the trend component T(t). The trend component and the periodic component participate in the subsequent periodic stability analysis and health measurement together;

[0085] S27: To enhance the adaptability of the model to changes in the system deployment structure, an embedding vector of the deployment version is introduced during the construction stage of the periodic basis function, as meta-information to control the initial frequency range and parameter initialization method of the periodic basis function, and realize the dynamic adjustment of the periodic modeling strategy under different version log environments.

[0086] Through the periodic neural decomposition process in step S2, the log sequence can be effectively decomposed into periodic components, trend drifts, and unstructured residuals, providing a highly interpretable and highly adaptable feature basis to support subsequent phase modeling, anomaly scoring, and health measurement.

[0087] S3: Establish a service topology based on the call relationship between microservices in the target system, identify the operation phase boundary based on the dependency path and tracking identifier, and assign a phase label to each log data in the log sequence.

[0088] In one embodiment, the implementation method of step S3 includes:

[0089] S31: Connect to the service mesh control plane components deployed in the target system, such as Istio or Linkerd, and use their call monitoring interface to obtain real-time call request and response data between microservices. Based on this call information, a directed graph consisting of service nodes and call edges is constructed. Each service node represents a specific microservice entity, and a call edge indicates the actual call relationship between two services. The call edge weight can be accompanied by attribute indicators such as call frequency or average response latency. The directed graph is dynamically updated in units of sliding time windows to adapt to changes in the microservice architecture.

[0090] S32: Parse the tracing identifier contained in each log data entry and use a distributed tracing system (such as OpenTelemetry or Jaeger) to extract the complete service call chain path. The call chain consists of a directed path sequence consisting of multiple service nodes. This path can be mapped in the established service topology graph. Each call chain path forms a one-to-one correspondence with the corresponding log sequence fragment, facilitating subsequent phase division.

[0091] S33: Calculate graph similarity metrics between the call chain paths extracted from the log sequence, such as path edit distance or Jaccard path overlap rate. Based on the significance of the topological structure change, decide whether to divide, merge, or split the existing running phases to reduce phase fragmentation caused by system structure fine-tuning.

[0092] S34: Combine the path transition points and significant changes in service call behavior (such as sudden changes in call hop counts, entry service switching, etc.) that appear in the log sequence to identify possible candidate boundaries for the operational phase. For each candidate boundary, calculate the path switching frequency and the magnitude of the change in log density, construct a boundary confidence index, and only confirm that the boundary is an actual operational phase boundary when the boundary confidence exceeds the set threshold.

[0093] S35: Segment the log sequence based on the identified phase boundaries and assign each log entry a unique label corresponding to the phase to which it belongs. The phase label is used as an attention window control condition in the subsequent attention mechanism to dynamically constrain the attention calculation range between events within the same phase.

[0094] Through the content of step S3, this embodiment can not only stably identify the running phase boundary in the microservice dynamic environment, but also improve the subsequent anomaly detection model's understanding ability of structural semantics, and enhance the accuracy and interpretability of overall anomaly determination.

[0095] S4: Divide the residual components and phase labels into multiple time window input sequences according to the time order and input them into the sequence learning model. This sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase labels, so that the log events within the same phase obtain high attention weights.

[0096] The phase-aware multi-head attention mechanism is used to model the context relationship between events in different running phases in the log sequence and enhance the model's recognition ability of structural behavior differences. In the specific implementation process, first, a running phase label matrix is constructed for the log sequence within each time window to determine whether any two log events belong to the same running phase. Based on this label, a mask matrix M∈{0,1} T×T is constructed, where M m,j =1 indicates that the m-th log event and the j-th log event belong to the same running phase, and their attention connection is retained; otherwise, it is set to zero. This mask matrix is used to limit the perception range of attention calculation and avoid irrelevant interference between different phases.

[0097] Within each time window, an attention scoring matrix (that is, the attention scoring matrix A is a two-dimensional matrix of T×T in the real number field), where T represents the number of log events (sequence length) within the current time window. For any two log events m and j that do not belong to the same running phase, the attention scoring value is set to a very small negative value, that is, when M m,j =0, A m,j =-∞. After the softmax operation, the weight at this position approaches 0, realizing the shielding of cross-phase attention connections.

[0098] If M m,j =1, then calculate A according to the scaled dot-product attention formula m,j ; where Q m is the query vector of the m-th log event; K j is the key vector of the j-th log event, represents the transpose, and d k is the dimension of the key vector for scaling.

[0099] To enhance the complementarity of different attention heads in structural modeling, a phase structure difference regularization term is introduced among multiple attention heads. For example, the distance between the attention distributions output by each attention head is calculated as the regularization objective, and during optimization, each attention head is encouraged to focus on different running substructures.

[0100] S5: Train the sequence learning model using a ranking learning strategy to minimize the ranking error of log sequence pairs, so that the abnormal log sequence obtains an abnormal score higher than that of the normal log sequence.

[0101] In one alternative implementation, step S5 includes the following:

[0102] First, the residual component obtained after periodic neural decomposition and the corresponding phase label are combined to form an input sequence, which is fed into the constructed sequence learning model. This model contains a phase-aware multi-head attention mechanism that can model the context relationship between log events within each running phase;

[0103] During the forward propagation of the model, the attention layer weights and encodes the log events within the same running phase to generate a sequence context representation. Next, a temporal pooling operation is performed on the output results of each time window. For example, the mean pooling method is used to aggregate all attention output vectors to form a sequence representation with a fixed dimension;

[0104] The sequence representation is input into a scoring function, which is a one-layer trainable linear transformation structure used to output an abnormal score representing the degree of abnormality, that is: where h represents the pooled sequence representation, w and b are the trainable parameters of the scoring function, and the output scalar s represents the abnormal score of the corresponding sequence;

[0105] To optimize the discriminative ability of the model, a set of sample pairs (x a , x n ) are constructed during the training phase, where x a represents a sequence containing abnormal log events, and x n represents a normal log event sequence. The two are respectively input into the model to obtain the corresponding score values s a , s n ;

[0106] During training, the margin ranking loss function is used for model training, defined as:

[0107]

[0108] This loss function encourages the model to output a sorting relationship where "the score of the abnormal sequence is higher than that of the normal sequence". By continuously updating the parameters of the attention layer and the scoring function through backpropagation, the model learns an effective abnormal behavior scoring mapping.

[0109] The model parameters are optimized by minimizing the marginal ranking loss function, enabling the sequence learning model to output abnormal scores for the input log sequences based on the scoring function during the inference stage.

[0110] After the model training is completed, in the inference stage, any input log sequence can be fed into the model, and the abnormal score value is output through the scoring function, and based on this, it is determined whether the behavior of the sequence is abnormal.

[0111] S6: Perform morphological similarity analysis on the periodic component, calculate the similarity between the current and historical periods based on the dynamic time warping method, and generate a periodic stability index in combination with the trend component.

[0112] In an embodiment of the present invention, to measure the stability degree of the target system log behavior in the periodic structure, a periodic stability index is jointly extracted from the periodic component and the trend component for the calculation of subsequent health metrics.

[0113] First, align the morphology of the periodic component of the current log sequence, select multiple stable periodic windows in the historical operation as the reference standard periods, use the dynamic time warping (DTW) method to align the current periodic component with each standard period, and obtain the period difference degree D by calculating the cumulative distance of the alignment path. dtw ;

[0114] On this basis, identify the regions with sudden curvature changes in the DTW path, count the proportion of the total alignment path, and construct the morphological variation ratio ρ to reflect the intensity and density of the abnormal stretching and compression regions in the period.

[0115] Furthermore, extract the moving average from the trend component and calculate its change amplitude M. trend and the change slope S. trend , where the change slope can indicate the long-term operation deviation direction of the system with positive or negative signs.

[0116] Construct the periodic stability index S. cycle as a weighted combination: S. cycle = α1·D. dtw + α2·ρ + α3·M. trend + α4·|S. trend |, and the weights α. b , b ∈ [1, 2, 3, 4] can be obtained based on deployment experience or through learning from historical samples.

[0117] The periodic stability index is used quantitatively to characterize the integrity of the periodic structure of the target system and the consistency of trends, and serves as the input for subsequent health metric values.

[0118] S7: Perform weighted fusion of the periodic stability index and the anomaly score to obtain a health metric value reflecting the operating state of the target system.

[0119] In an embodiment of the present invention, to construct a health metric value that can comprehensively reflect the operating state of the system, a weighted fusion method of the periodic stability index and the anomaly score is adopted, and a confidence factor and a non-linear weighting strategy are introduced to achieve dynamic adaptive integration of metrics from different sources. Specifically, it includes:

[0120] Obtain the periodic stability index S cycle (derived from the analysis of the periodic component and the trend component) and the anomaly score S anomaly (derived from the score output of the sequence learning model for the log sequence). For the same measurement standard, normalize the two metrics. The normalization method can choose min-max scaling or Z-score normalization to map both metrics to the [0,1] interval. Subsequently, construct the confidence factor for each metric:

[0121] Anomaly score confidence γ anomaly : It can be calculated from the score variance or the change amplitude of the log sequence within the sliding window. If the fluctuation is small, the confidence is high;

[0122] Periodic index confidence γ cycle : It can be estimated from the DTW path variation ratio (such as the proportion of curvature mutation segments) or the absolute value of the trend change slope. The smoother it is, the higher the confidence;

[0123] Taking the confidence factor as the input, dynamically generate a weighted vector through a non-linear function structure (including softmax or sigmoid). For example, use the softmax function to generate the fusion weights:

[0124]

[0125] Calculate the health metric value H as: H = β1·S cycle +β2·S anomaly , where β1 and β2 satisfy β1 + β2 = 1.

[0126] S8: Based on the joint result of the health metric value and the anomaly score, determine the anomaly event detection result, or dynamically adjust the subsequent alarm strategy and decision threshold.

[0127] In an embodiment of the present invention, based on the aforementioned obtained anomaly score and health metric value, a joint determination mechanism is constructed to determine whether an abnormal event occurs in the system and dynamically adjust the alarm strategy.

[0128] First, obtain the anomaly score S output from the sequence learning model anomaly and the health metric value H constructed by fusing the periodic stability index respectively, and input both into the joint decision function for joint determination. The joint decision function is executed based on the preset joint determination rules. For example:

[0129] Determination rule 1: When S anomaly > θ a and H < θ h , it is determined as abnormal;

[0130] Determination rule 2: When either of the two indicators meets the extreme value condition, a suspicious mark is triggered;

[0131] Determination rule 3: Use a custom boolean logic expression combination, such as (S anomaly > θ a ) ∧ (H < θ h ).

[0132] After the judgment is completed, the system adds an anomaly label to the current log sequence to form a joint feature vector: (S anomaly , H, label);

[0133] Input the joint feature vector into a predefined classifier, which can be a random forest, support vector machine, multi-layer perceptron, or lightweight Transformer structure, to further determine the type label (such as resource exhaustion type, service loss type, etc.) or anomaly level label (such as high risk, medium risk, low risk) of the abnormal event, and output the anomaly type label or anomaly level label;

[0134] According to the recognition result, the system executes the matching alarm strategy control logic, including but not limited to:

[0135] Alarm level hierarchical mapping (high risk → emergency push; medium risk → page prompt);

[0136] Alarm frequency setting control (set the minimum interval time for the same type of anomaly);

[0137] Target module routing switch (high-level anomaly triggers the disaster recovery routing or fuse mechanism).

[0138] To improve the system's adaptability, during the system operation, continuously maintain a sliding time window to track the change trends of the anomaly score and health metric value, and at the same time record the difference degree between the detection output and the operation and maintenance feedback (such as false alarm rate, missed alarm rate);

[0139] When a continuous deviation between the threshold setting and the true feedback is observed, the abnormal threshold θ is automatically triggered. a And the adjustment strategy for the healthy threshold θ h such as using exponential moving average (EMA) or Bayesian optimization to update the abnormal threshold, to achieve the co-evolution of the detection strategy and the dynamic state of the system.

[0140] Through the above mechanism, the present invention realizes the closed-loop dynamic feedback of the abnormal detection result and the alarm response, and improves the stability, response accuracy and robustness of the system in complex deployment scenarios.

[0141] As an optional implementation manner of the present invention, to improve the recognition ability of the sequence learning model for abnormal behaviors under structural consistency, and at the same time enhance the inference stability under the interference of adversarial samples, a structure-constrained adversarial sample training strategy is adopted, and a structure deviation degree index and a backup detection path mechanism are introduced in the inference stage.

[0142] During the training process, structure-constrained adversarial samples are constructed based on the original log data. The structure-constrained adversarial samples are generated by adding perturbation vectors that maintain structural consistency to the original log sequence. The perturbation process is controlled by the constraint of the log template syntax tree structure to ensure the parsability and field integrity of the structure-constrained adversarial samples in terms of syntax structure;

[0143] Specifically, the process of constructing the log template syntax tree includes: extracting templates from the original historical log data (such as using structured parsing methods such as Drain, Spell, etc.), generating a field-level and syntax pattern node graph, where the node graph includes fixed template fields (such as service name, timestamp format) and variable parameter fields (such as IP address, resource usage, user identification). During the perturbation process, only perturbations are allowed to be added to the variable parameter fields, and any modification to the fixed template fields is prohibited to ensure that the generated samples can still be correctly parsed under the syntax tree structure;

[0144] In the training stage, the structure-constrained adversarial samples and the normal log sequences are input into the sequence learning model together to participate in the ranking learning training process. During the learning process, the model learns a stronger semantic discrimination ability within the structure by comparing the scoring differences between the positive samples and the structure-constrained perturbation samples, thereby improving the robustness to structure-preserving anomalies.

[0145] In the inference stage, the syntax structure of each input log sequence is parsed, its field structure is mapped to a preset log template structure, and the structure deviation degree index is calculated. This index can be measured by means such as the edit distance of the field path, the syntax node matching rate, or the template occupancy ratio, reflecting the degree of difference between the current input log sequence and the template at the structural level.

[0146] When the value of the structural deviation index exceeds the set threshold (such as less than 90% of the matching degree, the number of field path differences exceeds the limit), the system will determine that the input log sequence is "structurally suspicious" and switch to an alternative detection structure that includes a rule-constrained path. This structure can be a hard-coded rule model, a syntax tree matching detector, or a lightweight semantic verification branch, which is used to execute a robust anomaly discrimination logic under highly uncertain inputs.

[0147] Through the above training enhancement and inference branch mechanism, the system can improve the judgment security in the adversarial sample environment while ensuring the model's expressive ability, and construct a closed-loop and interpretable structure-protected anomaly detection framework.

[0148] As Figure 2 shown, this is another embodiment of the present invention. This embodiment provides a log anomaly behavior analysis system based on ranking learning and attention mechanism, which is applied to the log anomaly behavior analysis method based on ranking learning and attention mechanism as described above, including:

[0149] A log collection and parsing module, which is used to collect the original log data generated during the operation of the target system, extract the log timestamp, event type, and content parameters, and generate a structured log sequence;

[0150] A periodic neural decomposition module, which is used to perform periodic neural decomposition on the log sequence, and construct a periodic component, a trend component, and a residual component represented by trainable periodic basis functions;

[0151] A topological phase annotation module, which is used to construct a service topology graph based on the microservice call relationship, combine the log trace identifier to parse the service call chain path, calibrate the operation phase boundary, and add an operation phase label to each log data in the log sequence;

[0152] A sequence learning module, which includes a phase-aware multi-head attention mechanism and a ranking learning training strategy, and is used to model the relationship between log events based on the input residual component and phase label, and output an anomaly score;

[0153] A periodic stability analysis module, which is used to calculate the periodic stability index based on the periodic component and the trend component by using the dynamic time warping method and the sliding trend analysis;

[0154] A health metric generation module, which is used to perform weighted fusion on the anomaly score and the periodic stability index, and output a health metric value reflecting the operation state of the target system;

[0155] A joint determination and alarm module, which is used to determine anomaly events based on the joint result of the anomaly score and the health metric value, and output an anomaly label, an anomaly type label, or an anomaly level label according to the determination result, and at the same time dynamically adjust the alarm strategy, the anomaly threshold, and the health threshold;

[0156] An adversarial robustness enhancement module is used to generate structurally constrained adversarial samples during the training process, and parse the syntax structure of the input log sequence in the inference phase, calculate the structural deviation metric, and when the value of the structural deviation metric exceeds the set threshold, switch to an alternative detection structure that includes a rule-constrained path.

[0157] In summary, the present invention realizes the collaborative modeling of periodic structures, running semantics, and behavioral anomalies in log sequences by introducing periodic neural decomposition, phase-aware attention mechanism, and ranking learning strategy, improves the accuracy, structural adaptability, and adversarial robustness of anomaly detection, and can effectively support intelligent log analysis and dynamic anomaly response in complex distributed systems.

[0158] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various changes or substitutions, and these should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism, characterized in that The method includes: Performing structured parsing on the original log data collected in the target system, extracting the log timestamp, event type, and content parameters, and generating a log sequence; Performing periodic neural decomposition on the log sequence, completing signal decomposition through spectrum-guided periodic basis functions, and obtaining periodic components, trend components, and residual components, where the parameters of the periodic basis functions are dynamically adjusted according to the system deployment version; Based on the call relationship between microservices in the target system, establishing a service topology graph, identifying the running phase boundary according to the dependency path and trace identifier, and assigning a phase label to each log data in the log sequence; Dividing the residual components and phase labels into multiple time window input sequences in chronological order and inputting them into a sequence learning model. The sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase label, so that log events within the same phase obtain high attention weights; Training the sequence learning model using a ranking learning strategy, minimizing the ranking error of log sequence pairs, and making the abnormal log sequence obtain an abnormal score higher than that of the normal log sequence; Performing morphological similarity analysis on the periodic components, calculating the similarity between the current and historical periods based on the dynamic time warping method, and generating a periodic stability index in combination with the trend components; Performing weighted fusion on the periodic stability index and the abnormal score to obtain a health metric value for reflecting the running state of the target system; Based on the joint result of the health metric value and the abnormal score, determining the abnormal event detection result, or dynamically adjusting the subsequent alarm strategy and decision threshold.

2. The method for analyzing abnormal behavior of logs based on ranking learning and attention mechanism according to claim 1, characterized in that The specific implementation method of performing periodic neural decomposition specifically includes: Constructing the event intensity or embedding vector of each log data in the log sequence into a time-continuous signal, and using the fast Fourier transform to extract the dominant frequency to form a candidate set of periodic basis functions; Construct a set of periodic basis functions by selecting frequency components from the set of periodic basis function candidates. Each periodic basis function is defined as: g i (t) = a i ·cos(2πf i t + φ i ); The periodic component is formed by weighted superposition of a plurality of periodic basis functions and is expressed as: Suppress redundant basis functions by introducing a sparse regularization loss term: where g i (t) is the output of the i-th periodic basis function at time t; a i , f i , φ i are the amplitude, frequency, and phase shift of the i-th periodic basis function, respectively; x(t) is the original input signal at time t, is the reconstruction result of the periodic part of the original input signal x(t); k represents the total number of periodic basis functions selected for reconstructing the periodic signal; is the total loss function in the optimization process; λ is the sparsity control coefficient; Define the residual component as and extract the trend component by combining the moving average. The trend component, together with the periodic component, participates in the subsequent periodic stability analysis and health measurement; Dynamically adjusting the initialization method of the trainable parameters and the candidate frequency range in the periodic basis function set according to the meta-information of the system deployment version to enhance the adaptability of periodic decomposition in the system version change scenario.

3. The method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism according to claim 1, wherein The method of establishing a service topology graph based on the call relationship between microservices in the target system and identifying the running phase boundary according to the dependency path and trace identifier includes: Real-time obtaining the call requests and response data between microservices through the service mesh control plane call interface, constructing a directed graph composed of service nodes and call edges, and dynamically updating the directed graph to reflect changes in service relationships; Parsing the trace identifiers in the log sequence through distributed tracing technology, extracting the corresponding service call chain path, and mapping it as a directed path sequence in the service topology graph; Calculating the structural similarity between different call chain paths, and adaptively determining the division, merging, or splitting operations of the running phase based on the topological difference to avoid phase fragmentation caused by topological micro-changes; Combining the path transition points and changes in call behavior patterns in the log sequence to identify candidate running phase boundaries, and calculating the boundary confidence according to the path switching frequency and log density change degree at the boundary. Only when the boundary confidence exceeds the set threshold is it confirmed as the running phase boundary; Divide the log sequence into multiple running phase segments according to the running phase boundary, and attach the phase label to which each log data belongs.

4. The method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism according to claim 1, wherein The phase-aware multi-head attention mechanism includes: Construct a mask matrix based on phase labels for each attention head, and only retain the attention connections between log events belonging to the same running phase; Introduce a phase boundary suppression function in the mask matrix to perform attenuation processing on the attention connections between log events in different running phases; Construct an attention scoring matrix within each time window Among them, for any two log events m and j that do not belong to the same running phase, set the attention scoring value to a very small negative value, and calculate A at the remaining positions according to the scaled dot-product attention formula m,j ; Introduce a phase structure difference regularization term among multiple attention heads to control the distribution difference in the connections between the log events concerned by each attention head 5. The method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism according to claim 4, wherein The method of training the sequence learning model using a ranking learning strategy includes: Input the residual component and phase label into the sequence learning model, and generate corresponding sequence representations after being processed by the phase-aware multi-head attention mechanism; Input the sequence representation into a scoring function, which is a trainable linear transformation or multi-layer perceptron structure for outputting an anomaly score representing the degree of anomaly; Construct training sample pairs composed of abnormal log sequences and normal log sequences, and use the margin ranking loss function Perform model training, defined as: where s a and s n are the anomaly score values output by the model for the anomaly log sequence and the normal log sequence, respectively; Optimize the model parameters by minimizing the margin ranking loss function, so that the sequence learning model can output an anomaly score for the input log sequence based on the scoring function during the inference phase.

6. The method for analyzing abnormal behavior of logs based on ranking learning and attention mechanism according to claim 1, wherein Perform morphological similarity analysis on the periodic component, specifically including: Segmentally align the current periodic component with the historical standard period, use the dynamic time warping method to calculate the total distance of the alignment path between the current and historical periods as the period difference degree, and identify the local sections with a mutation rate higher than the preset threshold in the alignment path, and output the morphological mutation ratio; Combine the sliding mean change amplitude and change slope of the trend component, and perform weighted integration on the period difference degree and morphological mutation ratio to construct a period stability index; The period stability index is used to characterize the integrity of the period structure and trend consistency of the target system, and is used as the input of the subsequent health metric value.

7. The method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism according to claim 6, wherein Perform weighted fusion on the period stability index and the anomaly score to obtain a health metric value for reflecting the running state of the target system. The method includes: Normalize the abnormal score and the cycle stability index respectively to construct the confidence of the abnormal score and the confidence of the cycle index, where the confidence of the abnormal score is calculated based on the score volatility, and the confidence of the cycle index is calculated based on the morphological variation ratio; using the confidence of the abnormal score and the confidence of the cycle index as inputs, dynamically generate weighted vectors β1 and β2 through a non-linear function structure, and calculate the health metric value H as: H = β1·S cycle + β2·S anomaly , where β1 and β2 satisfy β1 + β2 = 1.

8. The method for analyzing abnormal behavior of logs based on sorting learning and attention mechanism according to claim 7, characterized in that Based on the joint result of the health metric value and the anomaly score, determine the anomaly event detection result, or dynamically adjust the subsequent alarm strategy and decision threshold. The method includes; Input the anomaly score and health metric value into a joint decision function, and determine whether it is abnormal according to the set joint decision rule and output an anomaly label. The joint decision rule includes: the anomaly score is higher than the anomaly threshold, the health metric value is lower than the health threshold, or the combination of the two satisfies the set logical expression; Construct a joint feature vector from the anomaly score, health metric value and the anomaly label and input it into a predefined classifier to output an anomaly type label or anomaly level label; Control the subsequent alarm strategy according to the anomaly type label or anomaly level label, including alarm level classification, alarm frequency setting or target module routing switching; During the operation of the system, dynamically adjust the anomaly threshold and health threshold based on the sliding window change trend of the anomaly score and health metric value and the difference between the detection result and the alarm feedback.

9. The method for analyzing abnormal behavior of logs based on ranking learning and attention mechanism according to claim 1, wherein, During the training and inference process of the sequence learning model, it also includes: During the training process, construct structurally constrained adversarial samples based on the original log data. The structurally constrained adversarial samples are generated by adding perturbation vectors that maintain structural consistency, and the perturbation process is controlled by the constraint of the log template syntax tree structure to ensure the parseability and field integrity of the structurally constrained adversarial samples in terms of syntax structure. The construction of the log template syntax tree structure includes: extracting templates from the original log data to generate a field-level and syntax pattern node graph. During the perturbation process, only perturbations are allowed to be added to variable parameter fields, and any modification to fixed template fields is prohibited. Introduce the structurally constrained adversarial samples in model training, and jointly input the normal log sequences into the sequence learning model to enhance the model's ability to recognize abnormal behaviors under structural consistency. During the model inference process, parse the syntax structure of the input log sequence and calculate the structural deviation index between the log sequence and the log template. The structural deviation index represents the degree of difference in field structure between the current input and the log template. When the value of the structural deviation index exceeds the set threshold, switch to an alternative detection structure that includes a rule-constrained path.

10. A log abnormal behavior analysis system based on sorting learning and attention mechanism, which is applied to the log abnormal behavior analysis method based on sorting learning and attention mechanism according to any one of claims 1-9, and is characterized in that, The system includes: a log collection and parsing module for collecting the original log data generated during the operation of the target system, and extracting the log timestamp, event type, and content parameters to generate a structured log sequence. A periodic neural decomposition module for performing periodic neural decomposition on the log sequence to construct periodic components, trend components, and residual components represented by trainable periodic basis functions. A topological phase annotation module for constructing a service topology graph based on the microservice call relationship, parsing the service call chain path in combination with the log trace identifier, calibrating the running phase boundary, and adding running phase labels to each log data in the log sequence. A sequence learning module, which includes a phase-aware multi-head attention mechanism and a ranking learning training strategy, for modeling the relationships between log events based on the input residual components and phase labels and outputting an anomaly score. A periodic stability analysis module for calculating the periodic stability index based on the periodic components and trend components using the dynamic time warping method and sliding trend analysis. A health metric generation module for performing weighted fusion on the anomaly score and the periodic stability index and outputting a health metric value reflecting the running state of the target system. A joint determination and alarm module for determining abnormal events based on the joint results of the anomaly score and the health metric value, and outputting anomaly labels, anomaly type labels, or anomaly level labels according to the determination results. At the same time, dynamically adjust the alarm strategy, anomaly threshold, and health threshold. An adversarial robustness enhancement module for generating structurally constrained adversarial samples during the training process, parsing the syntax structure of the input log sequence during the inference phase, calculating the structural deviation index, and switching to an alternative detection structure that includes a rule-constrained path when the value of the structural deviation index exceeds the set threshold.

Images