Log abnormal behavior analysis method and system based on ranking learning and attention mechanism

Abstract

This invention discloses a method and system for analyzing log anomaly behavior based on ranking learning and attention mechanisms, belonging to the field of system operation and maintenance technology. The method includes: performing structured parsing on raw log data and constructing log sequences; extracting periodic components, trend components, and residual components through periodic neural decomposition; generating runtime phase labels based on service call relationships and labeling the log sequences; modeling the correlation structure between log events using a phase-aware multi-head attention mechanism, and outputting anomaly scores by combining a ranking learning strategy; fusing periodic stability indicators and anomaly scores to construct health metrics, and executing anomaly judgment and alarm policy control based on the joint results; introducing a structure-constrained adversarial example mechanism and structure deviation detection during training and inference to enhance the model's robustness to structural perturbations. This invention possesses technical advantages such as strong adaptability in periodic modeling, high anomaly detection accuracy, and excellent structural defense capabilities.

Description

Technical Field

[0001] This invention relates to the field of system operation and maintenance technology, specifically to a method and system for analyzing abnormal log behavior based on ranking learning and attention mechanisms. Background Technology

[0002] The widespread deployment of distributed systems in cloud computing, microservice architectures, and containerized environments has made real-time awareness of system operational status a critical task for ensuring service reliability and stability. Logs, as the most important time-series structured operational records, are crucial for system behavior analysis and anomaly detection. However, system operation is often accompanied by complex periodic behaviors, such as scheduled tasks, scheduling strategies, and peak user access. Traditional methods struggle to effectively separate periodic patterns from aperiodic anomalies, leading to decreased anomaly detection accuracy. Most models fail to fully utilize system operational structure information when processing log sequences, ignoring the call relationships and contextual dependencies between microservices, resulting in a lack of structural semantic support for anomaly judgment. Existing anomaly detection methods often employ a single supervised learning objective, making it difficult to reflect the overall relative anomaly of the sequence, especially in scenarios such as boundary events and weak signal attacks. Furthermore, there is a lack of proactive defense mechanisms against complex log perturbation behaviors, particularly under adversarial attacks, where existing models lack stable structure detection capabilities and anomaly identification path redundancy.

[0003] Therefore, there is an urgent need for a log anomaly analysis method that is oriented towards complex log structures, integrates system operation status modeling and behavior anomaly sorting, and has robust defense capabilities, in order to improve system security, controllability, and intelligent operation and maintenance capabilities. Summary of the Invention

[0004] To address the problems of poor periodicity recognition, weak structure awareness, and unstable anomaly scoring in existing technologies for log behavior analysis, this invention proposes a log anomaly behavior analysis method and system based on ranking learning and attention mechanisms.

[0005] The present invention achieves the above objectives through the following technical solutions:

[0006] A log-based abnormal behavior analysis method based on ranking learning and attention mechanisms, the method comprising:

[0007] The raw log data collected from the target system is structured and parsed to extract log timestamps, event types, and content parameters, generating log sequences.

[0008] Periodic neural decomposition is performed on the log sequence, and the signal decomposition is completed by using the spectrum-guided periodic basis function to obtain periodic components, trend components and residual components. The parameters of the periodic basis function are dynamically adjusted according to the system deployment version.

[0009] A service topology graph is established based on the call relationship between microservices in the target system. The running phase boundary is identified according to the dependency path and tracing identifier, and a phase label is assigned to each log data in the log sequence.

[0010] The residual components and phase labels are divided into multiple time windows according to time order and input into the sequence learning model. The sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase labels so that log events within the same phase receive high attention weights.

[0011] The sequence learning model is trained using a ranking learning strategy to minimize the ranking error of log sequence pairs, so that abnormal log sequences can obtain higher anomaly scores than normal log sequences.

[0012] A morphological similarity analysis is performed on the periodic components, and the similarity between the current period and historical periods is calculated based on the dynamic time warping method. A periodic stability index is generated by combining the trend components.

[0013] The periodic stability index and the anomaly score are weighted and fused to obtain a health metric that reflects the operating status of the target system.

[0014] Based on the combined results of the health metrics and the anomaly scores, the abnormal event detection results are determined, or the subsequent alarm strategies and judgment thresholds are dynamically adjusted.

[0015] A further improvement of the present invention is that the method for implementing the execution cycle neural decomposition specifically includes:

[0016] The event intensity or embedding vector of each log data in the log sequence is constructed into a time-continuous signal, and the dominant frequency is extracted using fast Fourier transform to form a candidate set of periodic basis functions;

[0017] A set of periodic basis functions is constructed by selecting frequency components from the candidate set of periodic basis functions. Each periodic basis function is defined as: g i (t)=a i ·cos(2πf i t+φ i );

[0018] The periodic component is formed by a weighted superposition of multiple periodic basis functions, expressed as:

[0019] By introducing a sparse regularization loss term, redundant basis functions are suppressed:

[0020] In the formula, g i (t) represents the output of the i-th periodic basis function at time t; a i f i φi Let x(t) represent the amplitude, frequency, and phase shift of the basis function in the i-th period, respectively; and let x(t) be the original input signal at time t. This represents the reconstruction result of the periodic portion of the original input signal x(t); k represents the total number of periodic basis functions selected for reconstructing the periodic signal; The total loss function in the optimization process is λ; λ is the sparsity control coefficient.

[0021] Define the residual components as The trend component is extracted by combining the moving average, and the trend component and the periodic component are used together in the subsequent periodic stability analysis and health measurement.

[0022] The initialization method and candidate frequency range of trainable parameters in the periodic basis function set are dynamically adjusted based on the metadata of the system deployment version to enhance the adaptability of periodic decomposition under system version change scenarios.

[0023] A further improvement of the present invention is that the method for establishing a service topology graph based on the call relationships between microservices in the target system and identifying runtime phase boundaries based on dependency paths and tracing identifiers includes:

[0024] The call request and response data between microservices are obtained in real time through the service mesh control plane call interface, and a directed graph composed of service nodes and call edges is constructed. The directed graph is dynamically updated to reflect changes in service relationships.

[0025] Distributed tracing technology is used to parse the tracing identifiers in the log sequence, extract the corresponding service call chain paths, and map them into directed path sequences in the service topology graph;

[0026] Structural similarity is calculated between different call chain paths, and the division, merging or splitting of the running phase is adaptively determined based on topological differences to avoid phase fragmentation caused by minor topological changes.

[0027] By combining path transition points and changes in call behavior patterns in the log sequence, candidate boundaries of the running phase are identified, and the boundary confidence is calculated based on the path switching frequency and log density change at the boundary. Only when the boundary confidence exceeds a set threshold is it confirmed as a running phase boundary.

[0028] The log sequence is divided into multiple running phase segments based on the running phase boundaries, and a corresponding phase label is attached to each log data entry.

[0029] A further improvement of the present invention is that the phase-aware multi-head attention mechanism includes:

[0030] For each attention head, a mask matrix based on phase labels is constructed, retaining only the attention connections between log events belonging to the same running phase;

[0031] A phase boundary suppression function is introduced into the mask matrix to perform attenuation processing on the attention connections between log events located in different running phases;

[0032] Construct an attention scoring matrix within each time window For any two log events m and j that do not belong to the same running phase, the attention score is set to a minimum negative value, and A is calculated according to the scaling dot product attention formula for the remaining positions. m,j ;

[0033] A phase structure difference regularization term is introduced among multiple attention heads to control the distribution differences in the connections between log events that each attention head focuses on.

[0034] A further improvement of the present invention is that training the sequence learning model using a ranking learning strategy includes:

[0035] The residual components and phase labels are input into the sequence learning model, and after processing by the phase-aware multi-head attention mechanism, the corresponding sequence representation is generated.

[0036] The sequence representation is input into a scoring function, which is a trainable linear transform or a multilayer perceptron structure, to output an anomaly score representing the degree of anomaly.

[0037] Training sample pairs consisting of abnormal log sequences and normal log sequences are constructed, and the marginal ranking loss function is used. Model training is defined as:

[0038] In the formula, s a s n These are the anomaly scores output by the model for the abnormal log sequences and the normal log sequences, respectively.

[0039] By minimizing the marginal ranking loss function to optimize the model parameters, the sequence learning model can output anomaly scores for the input log sequences based on the scoring function during the inference phase.

[0040] A further improvement of the present invention is that morphological similarity analysis is performed on the periodic components, specifically including:

[0041] The current periodic component is segmented and aligned with the historical standard period. The total distance of the alignment path between the current period and the historical period is calculated using the dynamic time warping method as the periodic difference degree. Local segments in the alignment path with a variation rate higher than a preset threshold are identified, and the morphological variation ratio is output.

[0042] By combining the magnitude and slope of the change in the moving average of the trend components, the periodicity and morphological variation ratio are weighted and integrated to construct a periodic stability index.

[0043] The periodic stability index is used to characterize the integrity and trend consistency of the periodic structure of the target system, and serves as input for subsequent health measurements.

[0044] A further improvement of the present invention is that the periodic stability index and the anomaly score are weighted and fused to obtain a health metric reflecting the operating state of the target system. The method includes:

[0045] The anomaly score and the periodic stability index are normalized respectively to construct the confidence scores of the anomaly score and the confidence scores of the periodic index. The confidence scores of the anomaly score are calculated based on the score volatility, and the confidence scores of the periodic index are calculated based on the morphological variation ratio.

[0046] Using the confidence scores of anomaly ratings and the confidence scores of periodic indicators as inputs, a weighted vector β1 and β2 are dynamically generated through a nonlinear function structure. The health metric H is then calculated as: H = β1·S cycle +β2·S anomaly , β1 and β2 satisfy β1+β2=1.

[0047] A further improvement of the present invention is that, based on the combined result of the health metric and the anomaly score, the abnormal event detection result is determined, or the subsequent alarm strategy and judgment threshold are dynamically adjusted, the method including;

[0048] The abnormal score and health metric value are input into a joint decision function. The function determines whether the abnormality is due according to the set joint decision rules and outputs an abnormality label. The joint decision rules include: the abnormal score is higher than the abnormal threshold, the health metric value is lower than the health threshold, or the combination of the two satisfies the set logical expression.

[0049] The joint feature vector composed of the anomaly score, health metric value and anomaly label is input into a predefined classifier, and the anomaly type label or anomaly level label is output.

[0050] The subsequent alarm strategy is controlled based on the anomaly type label or anomaly level label, including alarm level classification, alarm frequency setting, or target module routing switching.

[0051] During system operation, the abnormal threshold and health threshold are dynamically adjusted based on the changing trend of the sliding window of the abnormal score and health metric, as well as the difference between the detection results and alarm feedback.

[0052] A further improvement of the present invention is that the sequence learning model training and inference process further includes:

[0053] During training, structured adversarial examples are constructed based on the original log data. These structured adversarial examples are generated by adding perturbation vectors to maintain structural consistency. The perturbation process is controlled by the log template syntax tree structure to maintain the parsability and field integrity of the structured adversarial examples in terms of syntax.

[0054] Constructing the log template syntax tree structure includes: extracting templates from the raw log data, generating a field hierarchy and syntax pattern node diagram, and allowing perturbations only to be added to variable parameter fields during the perturbation process, while prohibiting any modifications to fixed template fields;

[0055] The structure-constrained adversarial examples are introduced into the model training process and combined with normal log sequences as input to the sequence learning model to enhance the model's ability to identify anomalous behaviors under structural consistency.

[0056] During model inference, the input log sequence is parsed to analyze its syntax structure, and a structural deviation index between the log sequence and the log template is calculated. The structural deviation index represents the degree of difference between the current input and the log template in terms of field structure.

[0057] When the value of the structural deviation index exceeds the set threshold, the system switches to a backup detection structure that includes a rule-constrained path.

[0058] A log anomaly behavior analysis system based on ranking learning and attention mechanisms, applied to the log anomaly behavior analysis method based on ranking learning and attention mechanisms as described above, the system comprising:

[0059] The log collection and parsing module is used to collect raw log data generated during the operation of the target system, extract log timestamps, event types and content parameters, and generate structured log sequences.

[0060] The periodic neural decomposition module is used to perform periodic neural decomposition on the log sequence to construct periodic components, trend components, and residual components represented by trainable periodic basis functions.

[0061] The topology phase labeling module is used to construct a service topology graph based on microservice call relationships, and combine log tracing identifiers to parse service call chain paths, mark the running phase boundaries, and add running phase labels to each log data in the log sequence;

[0062] The sequence learning module includes a phase-aware multi-head attention mechanism and a ranking learning training strategy, which is used to model the relationship between log events based on the input residual components and phase labels, and output anomaly scores.

[0063] The periodic stability analysis module is used to calculate the periodic stability index based on the periodic component and the trend component, using the dynamic time warping method and the sliding trend analysis.

[0064] The health metric generation module is used to perform weighted fusion of anomaly scores and periodic stability indicators, and output health metric values ​​that reflect the operating status of the target system.

[0065] The joint judgment and alarm module is used to judge abnormal events based on the joint result of the abnormal score and health metric, and output abnormal labels, abnormal type labels or abnormal level labels according to the judgment result, while dynamically adjusting alarm strategies, abnormal thresholds and health thresholds.

[0066] The adversarial robustness enhancement module is used to generate structurally constrained adversarial examples during training and parse the grammatical structure of the input log sequence during the inference phase, calculate the structural deviation index, and switch to an alternative detection structure containing rule-constrained paths when the structural deviation index value exceeds a set threshold.

[0067] The beneficial effects of this invention are as follows: It introduces a periodic neural decomposition mechanism, constructs trainable periodic basis functions based on spectrum guidance, jointly extracts periodic components, trend components, and residual components, and achieves dynamic adaptation with system deployment versions, significantly enhancing the generalization ability and evolutionary adaptability of periodic modeling; it combines microservice topology and call chain tracing information to establish a service dependency graph and generate runtime phase labels, enabling log sequence partitioning and context modeling to be synchronized with system structure evolution; it inputs residual components and phase labels into the sequence learning model, and through a phase-aware multi-head attention mechanism, enables the model to focus on key behavioral events within the same runtime phase, reducing cross-node... This approach addresses attention diffusion caused by structural interference. A ranking learning strategy is employed to train the model, aiming to minimize the ranking error when abnormal sequence scores are higher than normal sequence scores. This avoids the problem of insufficient learning of boundary samples in traditional classification models, enabling relative ranking modeling of abnormal behavior. By integrating periodic stability and abnormal scores, a health metric is constructed, enhancing the stability and dynamic sensitivity of the overall system state judgment while maintaining real-time performance, providing quantitative support for subsequent abnormal responses. During the inference phase, combining structural deviation indicators and backup detection paths achieves adversarial perturbation detection capability under grammatical structure consistency, improving the model's robustness in open deployment environments. Attached Figure Description

[0068] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] in:

[0070] Figure 1 This is a flowchart of the method in an embodiment of the present invention;

[0071] Figure 2 This is a system structure block diagram in an embodiment of the present invention. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0073] like Figure 1 As shown, this is an embodiment of the present invention, which provides a log abnormal behavior analysis method based on ranking learning and attention mechanisms, including the following steps:

[0074] S1: Perform structured parsing on the raw log data collected from the target system, extract log timestamps, event types, content parameters, etc., and generate structured log sequences.

[0075] S2: Perform periodic neural decomposition on the log sequence, and complete the signal decomposition by using the spectrum-guided periodic basis function to obtain periodic components, trend components and residual components. The parameters of the periodic basis function are dynamically adjusted according to the system deployment version.

[0076] The periodic neural decomposition process is used to extract signal components reflecting the periodicity of system operation from log sequences, and to distinguish periodic components, trend components and residual components in a structured manner, providing stable feature inputs for subsequent phase labeling and anomaly detection.

[0077] In one embodiment, the method for implementing step S2 includes:

[0078] S21: Arrange the raw log data collected from the target system in chronological order and extract the event intensity value of each log, or generate the corresponding embedding vector through a preset log embedding coding network to form an input signal sequence;

[0079] S22: Perform spectral analysis on the input signal sequence using Fast Fourier Transform (FFT) to extract several dominant frequencies to form a frequency set {f1, f2, ..., f...} m This set of frequencies is used as a candidate frequency set for periodic basis functions, where each frequency analysis corresponds to a candidate basis function structure.

[0080] S23: In the actual modeling process, k frequency components are selected from the candidate set to construct a set of periodic basis functions. Each periodic basis function is defined as: g i (t)=a i ·cos(2πf i t+φ i ); where g i (t) represents the output of the i-th periodic basis function at time t; a i f i φ i These are the magnitude, frequency, and phase shift of the basis function in the i-th period, respectively, which can be optimized through backpropagation during training.

[0081] S24: The sum of all periodic basis functions constitutes the approximate reconstruction term of the periodic signal, i.e., the periodic component, expressed as:

[0082] S25: To prevent the model from learning redundant periodicity during training and to improve the interpretability and generalization ability of periodic modeling, a sparse regularization loss term is introduced during training. The overall optimization objective is:

[0083] In the formula, x(t) is the original input signal at time t. This represents the reconstruction result of the periodic portion of the original input signal x(t); k represents the total number of periodic basis functions selected for reconstructing the periodic signal; λ represents the total loss function during the optimization process; λ is the sparsity control coefficient, which can adjust the degree of retention of periodic components.

[0084] S26: After completing the extraction of the periodic components, define the residual components as follows: To further extract the long-term trend changes of the system, the multi-scale moving average method is used to calculate the trend value in different time windows. Finally, the multi-scale trends are weighted and combined to form the trend component T(t). The trend component and the periodic component are used together in the subsequent periodic stability analysis and health measurement.

[0085] S27: To enhance the model's adaptability to changes in system deployment structure, an embedding vector of the deployment version is introduced during the periodic basis function construction stage. This vector serves as meta-information to control the initial frequency range and parameter initialization method of the periodic basis function, enabling dynamic adjustment of the periodic modeling strategy under different log versions.

[0086] The periodic neural decomposition process in step S2 effectively decomposes the log sequence into periodic components, trend drift, and unstructured residuals, providing a highly interpretable and adaptive feature base to support subsequent phase modeling, anomaly scoring, and health measurement.

[0087] S3: Establish a service topology graph based on the call relationship between microservices in the target system, identify the running phase boundary according to the dependency path and tracing identifier, and assign a phase label to each log data in the log sequence.

[0088] In one embodiment, the method for implementing step S3 includes:

[0089] S31: Access the service mesh control plane components deployed in the target system, such as Istio or Linkerd, and obtain real-time call request and response data between microservices through their call monitoring interface. Based on this call information, construct a directed graph containing service nodes and call edges, where each service node represents a specific microservice entity, and call edges represent the actual call relationship between two services. The weight of the call edge can be accompanied by attribute indicators such as call frequency or average response latency. The directed graph is dynamically updated in units of sliding time windows to adapt to changes in the microservice architecture.

[0090] S32: Parse the tracing identifiers contained in each log data, and use a distributed tracing system (such as OpenTelemetry, Jaeger) to extract the complete service call chain path. The call chain consists of a directed path sequence composed of multiple service nodes. The path can be mapped in the established service topology graph. Each call chain path and the corresponding log sequence fragment form a one-to-one correspondence, which is convenient for subsequent phase division.

[0091] S33: For the set of call chain paths extracted from the log sequence, calculate the graph similarity index between the path structures, such as path edit distance or Jaccard path overlap rate; based on the significance of the topology changes, decide whether to divide, merge or split the existing running phases to reduce the phase fragmentation problem caused by system structure fine-tuning.

[0092] S34: By combining path transition points and significant changes in service call behavior (such as sudden changes in call hop count, entry service switching, etc.) in the log sequence, identify possible candidate boundaries of the runtime phase. For each candidate boundary, calculate the path switching frequency and the magnitude of log density changes, construct a boundary confidence index, and only confirm that the boundary is an actual runtime phase boundary when the boundary confidence exceeds a set threshold;

[0093] S35: The log sequence is segmented based on the identified operational phase boundaries, and each log data entry is assigned a unique label to its respective operational phase. The phase label serves as an attention window control condition in the subsequent attention mechanism, dynamically constraining the range of attention calculations between events within the same phase.

[0094] Through step S3, this embodiment can not only reliably identify the boundaries of the running phase in a dynamic microservice environment, but also improve the ability of the subsequent anomaly detection model to understand structural semantics, thereby improving the accuracy and interpretability of the overall anomaly judgment.

[0095] S4: The residual components and phase labels are divided into multiple time windows according to time order and input into the sequence learning model. The sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase labels, so that log events within the same phase receive high attention weights.

[0096] Phase-aware multi-head attention mechanisms are used to model the contextual relationships between events within different runtime phases in a log sequence and enhance the model's ability to identify structural behavioral differences. Specifically, a runtime phase label matrix is ​​first constructed for the log sequence within each time window to determine whether any two log events belong to the same runtime phase. Based on this label, a mask matrix M∈{0,1} is then constructed. T×T M m,j =1 indicates that the m-th log event and the j-th log event belong to the same running phase, and their attention connection is preserved; otherwise, it is set to zero. This mask matrix is ​​used to limit the perceptual range of attention calculation and avoid irrelevant interference between different phases.

[0097] Construct an attention scoring matrix within each time window (That is, the attention scoring matrix A is a T×T two-dimensional matrix in the real number field), where T represents the number of log events (sequence length) within the current time window. For any two log events m and j that do not belong to the same running phase, the attention score is set to a minimum negative value, i.e., M. m,j =0 when A m,j =-∞, after the softmax operation, the weight at this position approaches 0, thus achieving cross-phase attention connection masking;

[0098] If M m,j =1, then A is calculated using the scaling dot product attention formula. m,j ; Q m K is the query vector for the m-th log event; j Let be the key vector (Key) of the j-th log event. Indicates transpose, d k The dimension of the key vector, used for scaling;

[0099] To enhance the complementarity of different attention heads in structural modeling, a phase structure difference regularization term is introduced among multiple attention heads. For example, the distance between the output attention distributions of each attention head is calculated as the regularization objective, encouraging each attention head to focus on different operational substructures during optimization.

[0100] S5: The sequence learning model is trained using a sorting learning strategy to minimize the sorting error of log sequence pairs, so that abnormal log sequences can obtain higher anomaly scores than normal log sequences.

[0101] In one alternative implementation, step S5 includes the following:

[0102] First, the residual components obtained after periodic neural decomposition are combined with the corresponding phase labels to form an input sequence, which is then fed into the constructed sequence learning model. This model includes a phase-aware multi-head attention mechanism, which can model the contextual relationships between log events within each running phase.

[0103] During the model's forward propagation, the attention layer weights and encodes log events within the same running phase to generate a sequence context representation. Next, temporal pooling is performed on the output of each time window; for example, mean pooling is used to aggregate all attention output vectors, forming a fixed-dimensional sequence representation.

[0104] The sequence representation is input into the scoring function, which is a trainable linear transformation structure that outputs an anomaly score representing the degree of anomaly. Where h represents the sequence representation after pooling, w and b are trainable parameters of the scoring function, and the output scalar s represents the anomaly score of the corresponding sequence.

[0105] To optimize the model's discriminative ability, a set of sample pairs (x, x) is constructed during the training phase. a ,x n ), where x a This represents a sequence containing exception log events, x n This represents a normal log event sequence. By inputting both into the model, the corresponding score value s is obtained. a s n ;

[0106] Marginal ranking loss function is used during training. Model training is defined as:

[0107]

[0108] This loss function encourages the model to output a ranking relationship where "abnormal sequence scores are higher than normal sequence scores." By continuously updating the parameters of the attention layer and the scoring function through backpropagation, the model learns an effective mapping for abnormal behavior scores.

[0109] By minimizing the marginal ranking loss function to optimize the model parameters, the sequence learning model can output anomaly scores for the input log sequences based on the scoring function during the inference phase.

[0110] After the model training is completed, during the inference phase, any input log sequence can be fed into the model, and an anomaly score value can be output through the scoring function to determine whether the sequence’s behavior is abnormal.

[0111] S6: Perform morphological similarity analysis on the periodic components, calculate the similarity between the current and historical periods based on the dynamic time warping method, and generate a periodic stability index by combining the trend components.

[0112] In one embodiment of the present invention, in order to measure the stability of the target system log behavior in terms of periodic structure, a periodic stability index is jointly extracted from the periodic component and the trend component for subsequent health measurement calculation.

[0113] First, the periodic components of the current log sequence are morphologically aligned. Multiple stable periodic windows from historical runs are selected as reference standard periods. The Dynamic Time Warping (DTW) method is used to align the current periodic component with each standard period. The periodic difference D is obtained by calculating the cumulative distance of the alignment path. dtw ;

[0114] Based on this, regions of curvature abrupt change in the DTW path are identified, their proportion in the total alignment path is statistically analyzed, and the morphological variation ratio ρ is constructed to reflect the intensity and density of abnormal stretching and compression regions in the cycle.

[0115] Furthermore, the moving average is extracted from the trend component and its magnitude of change M is calculated. trend With the slope of change S trend The slope of the change can indicate the direction of the system's long-term operational offset;

[0116] Constructing a periodic stability index S cycle For weighted combination: S cycle =α1·D dtw +α2·ρ+α3·M trend +α4·|S trend |, weights α of each item b b∈[1,2,3,4] can be obtained based on deployment experience or through learning from historical samples.

[0117] Periodic stability indices are used quantitatively to characterize the integrity and trend consistency of the periodic structure of a target system, serving as inputs for subsequent health metrics.

[0118] S7: Perform a weighted fusion of the periodic stability index and the anomaly score to obtain a health metric that reflects the operating status of the target system.

[0119] In one embodiment of the present invention, to construct a health metric that comprehensively reflects the system's operating status, a weighted fusion method of periodic stability indicators and anomaly scores is adopted, and a confidence factor and a nonlinear weighting strategy are introduced to achieve dynamic adaptive integration of indicators from different sources. Specifically, this includes:

[0120] Obtain the periodic stability index S cycle (derived from periodic component and trend component analysis) and anomaly score S anomaly (Derived from the scoring output of a sequence learning model on log sequences), the two metrics are normalized using the same standard. Normalization methods can include min-max scaling or Z-score standardization, mapping both metrics to the [0,1] interval. Subsequently, a confidence factor is constructed for each metric:

[0121] Anomaly rating confidence level γ anomaly The confidence level can be calculated from the variance or variation of the log sequence within the sliding window; if the fluctuation is small, the confidence level is high.

[0122] Confidence level γ of the cycle indicator cycle It can be estimated by the DTW path variation ratio (such as the proportion of curvature abrupt change segments) or the absolute value of the trend change slope; the more stable it is, the higher the confidence level.

[0123] Using confidence factors as input, a weighted vector is dynamically generated through a non-linear function structure (including softmax or sigmoid). For example, the softmax function can be used to generate the fusion weights.

[0124]

[0125] The health measurement value H is calculated as follows: H = β1·S cycle +β2·S anomaly , β1 and β2 satisfy β1+β2=1.

[0126] S8: Based on the combined results of the health metric and the anomaly score, determine the anomaly event detection result, or dynamically adjust the subsequent alarm strategy and judgment threshold.

[0127] In one embodiment of the present invention, a joint determination mechanism is constructed based on the aforementioned abnormality score and health metric value to determine whether an abnormal event has occurred in the system and to dynamically adjust the alarm strategy.

[0128] First, obtain the anomaly score S from the output of the sequence learning model. anomaly The health metric H, constructed by integrating the cyclic stability index, and the health metric H are input into a joint decision function for joint judgment. The joint decision function is executed based on a preset joint judgment rule, for example:

[0129] Judgment Rule 1: When S anomaly >θ a And H < θ h At that time, it was identified as abnormal;

[0130] Judgment Rule 2: When either of the two indicators meets the extreme value condition, a suspicious flag is triggered;

[0131] Judgment Rule 3: Use a combination of custom Boolean logic expressions, such as (S anomaly >θ a )∧(H<θ h ).

[0132] After the judgment is completed, the system labels the current log sequence with an anomaly tag, forming a joint feature vector: (S anomaly H, label);

[0133] The joint feature vector is input into a predefined classifier, which can be a random forest, support vector machine, multilayer perceptron, or lightweight Transformer structure, to further determine the type label (such as resource exhaustion, service loss, etc.) or the anomaly level label (such as high risk, medium risk, low risk) of the abnormal event, and output the anomaly type label or anomaly level label.

[0134] Based on the identification results, the system executes the matching alarm policy control logic, including but not limited to:

[0135] Alarm level classification mapping (high risk → emergency push; medium risk → page prompt);

[0136] Alarm frequency setting control (setting the minimum interval time for the same type of anomalies);

[0137] Target module route switching (high-level anomalies trigger disaster recovery routing or circuit breaker mechanism).

[0138] To enhance the system's adaptive capabilities, a sliding time window is continuously maintained during system operation to track the changing trends of anomaly scores and health metrics, while also recording the degree of difference between detection outputs and operational feedback (e.g., false alarm rate and false negative rate).

[0139] When a persistent deviation between the threshold setting and the actual feedback is observed, the abnormal threshold θ is automatically triggered. a With health threshold θ h Adjustment strategies, such as using exponential moving average (EMA) or Bayesian optimization to update the anomaly threshold, can achieve the co-evolution of the detection strategy and the dynamic state of the system.

[0140] Through the above mechanism, this invention achieves closed-loop dynamic feedback between anomaly detection results and alarm responses, improving the stability, response accuracy, and robustness of the system in complex deployment scenarios.

[0141] As an optional implementation of the present invention, in order to improve the ability of the sequence learning model to identify abnormal behavior under structural consistency and enhance the inference stability under adversarial sample interference, a structurally constrained adversarial sample training strategy is adopted, and a structural deviation index and a backup detection path mechanism are introduced in the inference stage.

[0142] During training, structured adversarial examples are constructed based on the original log data. The structured adversarial examples are generated by adding perturbation vectors to the original log sequence to maintain structural consistency. The perturbation process is controlled by the log template syntax tree structure to maintain the parsability and field integrity of the structured adversarial examples in terms of syntax structure.

[0143] Specifically, the log template syntax tree construction process includes: extracting templates from the original historical log data (e.g., using structured parsing methods such as Drain and Spell), generating a field hierarchy and syntax pattern node graph, where the node graph includes fixed template fields (e.g., service name, timestamp format) and variable parameter fields (e.g., IP address, resource usage, user identifier). During the perturbation process, perturbations are only allowed to be added to the variable parameter fields, and no modifications are allowed to the fixed template fields, to ensure that the generated samples can still be correctly parsed under the syntax tree structure;

[0144] During the training phase, structurally constrained adversarial examples are input into the sequence learning model along with normal log sequences to participate in the ranking learning training process. During the learning process, the model learns stronger intra-structural semantic discrimination capabilities by comparing the score differences between positive samples and structurally constrained perturbation samples, thereby improving its robustness to structure-preserving anomalies.

[0145] During the inference phase, a syntax structure parsing is performed on each input log sequence, mapping its field structure to a preset log template structure, and calculating a structure deviation metric. This metric can be measured by methods such as field path edit distance, syntax node matching rate, or template ratio, reflecting the degree of difference between the current input log sequence and the template at the structural level.

[0146] When the structural deviation index value exceeds a set threshold (e.g., below 90% matching degree, or the number of field path differences exceeds a set limit), the system will determine the input log sequence as "suspicious in structure" and switch to a backup detection structure containing rule-constrained paths. This structure can be a hard-coded rule model, a syntax tree matching detector, or a lightweight semantic verification branch, used to execute robust anomaly detection logic under highly uncertain inputs.

[0147] Through the above training enhancement and inference branching mechanisms, the system can improve the security of judgment in adversarial example environments while ensuring the model's expressive power, and build a closed-loop, interpretable, structure-protected anomaly detection framework.

[0148] like Figure 2 As shown, another embodiment of the present invention provides a log anomaly behavior analysis system based on ranking learning and attention mechanisms, applied to the log anomaly behavior analysis method based on ranking learning and attention mechanisms as described above, including:

[0149] The log collection and parsing module is used to collect raw log data generated during the operation of the target system, extract log timestamps, event types and content parameters, and generate structured log sequences.

[0150] The periodic neural decomposition module is used to perform periodic neural decomposition on log sequences, constructing periodic components, trend components, and residual components represented by trainable periodic basis functions.

[0151] The topology phase labeling module is used to construct a service topology graph based on microservice call relationships, and combine log tracing identifiers to parse service call chain paths, mark the running phase boundaries, and add running phase labels to each log data in the log sequence;

[0152] The sequence learning module includes a phase-aware multi-head attention mechanism and a ranking learning training strategy, which is used to model the relationship between log events based on the input residual components and phase labels, and output anomaly scores.

[0153] The periodic stability analysis module is used to calculate the periodic stability index based on the periodic component and the trend component, using the dynamic time warping method and the sliding trend analysis.

[0154] The health metric generation module is used to perform weighted fusion of anomaly scores and periodic stability indicators, and output health metric values ​​that reflect the operating status of the target system.

[0155] The joint judgment and alarm module is used to judge abnormal events based on the joint results of abnormal scores and health metrics, and output abnormal labels, abnormal type labels or abnormal level labels according to the judgment results, while dynamically adjusting alarm strategies, abnormal thresholds and health thresholds.

[0156] The adversarial robustness enhancement module is used to generate structurally constrained adversarial examples during training and parse the grammatical structure of the input log sequence during the inference phase, calculate the structural deviation index, and switch to an alternative detection structure containing rule-constrained paths when the structural deviation index value exceeds a set threshold.

[0157] In summary, this invention, by introducing periodic neural decomposition, phase-aware attention mechanism, and ranking learning strategy, achieves collaborative modeling of periodic structure, operational semantics, and behavioral anomalies in log sequences, improving the accuracy, structural adaptability, and adversarial robustness of anomaly detection. It can effectively support intelligent log analysis and dynamic anomaly response in complex distributed systems.

[0158] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A log-based abnormal behavior analysis method based on ranking learning and attention mechanisms, characterized in that, The method includes: The raw log data collected from the target system is structured and parsed to extract log timestamps, event types, and content parameters, generating log sequences. The log sequence is subjected to periodic neural decomposition, which completes signal decomposition using a spectral-guided periodic basis function to obtain periodic components, trend components, and residual components. The parameters of the periodic basis function are dynamically adjusted according to the system deployment version. The specific implementation method of performing periodic neural decomposition includes: The event intensity or embedding vector of each log data in the log sequence is constructed into a time-continuous signal, and the dominant frequency is extracted using fast Fourier transform to form a candidate set of periodic basis functions; A set of periodic basis functions is constructed by selecting frequency components from the candidate set of periodic basis functions, and each periodic basis function is defined as follows: ; The periodic component is formed by a weighted superposition of multiple periodic basis functions, expressed as: ; By introducing a sparse regularization loss term, redundant basis functions are suppressed: ; In the formula, For the first Each periodic basis function in time The output; , , The first The magnitude, frequency, and phase shift of the periodic basis functions; For time The original input signal below, For the original input signal The periodic partial reconstruction results; This represents the total number of periodic basis functions selected for reconstructing the periodic signal; This is the total loss function during the optimization process; This is the sparsity control coefficient; Define the residual components as Furthermore, the trend component is extracted by combining the moving average, and the trend component, together with the periodic component, participates in the subsequent periodic stability analysis and health measurement. The initialization method and candidate frequency range of trainable parameters in the periodic basis function set are dynamically adjusted based on the metadata of the system deployment version to enhance the adaptability of periodic decomposition under system version change scenarios. A service topology graph is established based on the call relationship between microservices in the target system. The running phase boundary is identified according to the dependency path and tracing identifier, and a phase label is assigned to each log data in the log sequence. The residual components and phase labels are divided into multiple time windows according to time order and input into the sequence learning model. The sequence learning model includes a phase-aware multi-head attention mechanism, which dynamically adjusts the attention calculation range according to the phase labels so that log events within the same phase receive high attention weights. The sequence learning model is trained using a ranking learning strategy to minimize the ranking error of log sequence pairs, so that abnormal log sequences can obtain higher anomaly scores than normal log sequences. A morphological similarity analysis is performed on the periodic components, and the similarity between the current period and historical periods is calculated based on the dynamic time warping method. A periodic stability index is generated by combining the trend components. The periodic stability index and the anomaly score are weighted and fused to obtain a health metric that reflects the operating status of the target system. Based on the combined results of the health metrics and the anomaly scores, the abnormal event detection results are determined, or the subsequent alarm strategies and judgment thresholds are dynamically adjusted.

2. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 1, characterized in that, The method for establishing a service topology graph based on the call relationships between microservices in the target system and identifying runtime phase boundaries based on dependency paths and tracing identifiers includes: The call request and response data between microservices are obtained in real time through the service mesh control plane call interface, and a directed graph composed of service nodes and call edges is constructed. The directed graph is dynamically updated to reflect changes in service relationships. Distributed tracing technology is used to parse the tracing identifiers in the log sequence, extract the corresponding service call chain paths, and map them into directed path sequences in the service topology graph; Structural similarity is calculated between different call chain paths, and the division, merging or splitting of the running phase is adaptively determined based on topological differences to avoid phase fragmentation caused by minor topological changes. By combining path transition points and changes in call behavior patterns in the log sequence, candidate boundaries of the running phase are identified, and the boundary confidence is calculated based on the path switching frequency and log density change at the boundary. Only when the boundary confidence exceeds a set threshold is it confirmed as a running phase boundary. The log sequence is divided into multiple running phase segments based on the running phase boundaries, and a corresponding phase label is attached to each log data entry.

3. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 1, characterized in that, The phase-aware multi-head attention mechanism includes: For each attention head, a mask matrix based on phase labels is constructed, retaining only the attention connections between log events belonging to the same running phase; A phase boundary suppression function is introduced into the mask matrix to perform attenuation processing on the attention connections between log events located in different running phases; Construct an attention scoring matrix within each time window , This indicates the number of log events within the current time window, where any two log events that do not belong to the same running phase are excluded. The attention score is set to a minimum negative value, and the remaining positions are calculated using the scaled dot product attention formula. ; A phase structure difference regularization term is introduced among multiple attention heads to control the distribution differences in the connections between log events that each attention head focuses on.

4. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 3, characterized in that, The step of training the sequence learning model using a ranking learning strategy includes: The residual components and phase labels are input into the sequence learning model, and after processing by the phase-aware multi-head attention mechanism, the corresponding sequence representation is generated. The sequence representation is input into a scoring function, which is a trainable linear transform or a multilayer perceptron structure, to output an anomaly score representing the degree of anomaly. Training sample pairs consisting of abnormal log sequences and normal log sequences are constructed, and the marginal ranking loss function is used. Model training is defined as: ; In the formula, , These are the anomaly scores output by the model for the abnormal log sequences and the normal log sequences, respectively. By minimizing the marginal ranking loss function to optimize the model parameters, the sequence learning model can output anomaly scores for the input log sequences based on the scoring function during the inference phase.

5. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 1, characterized in that, Perform morphological similarity analysis on the periodic components, specifically including: The current periodic component is segmented and aligned with the historical standard period. The total distance of the alignment path between the current period and the historical period is calculated using the dynamic time warping method as the periodic difference degree. Local segments in the alignment path with a variation rate higher than a preset threshold are identified, and the morphological variation ratio is output. By combining the magnitude and slope of the change in the moving average of the trend components, the periodicity and morphological variation ratio are weighted and integrated to construct a periodic stability index. The periodic stability index is used to characterize the integrity and trend consistency of the periodic structure of the target system, and serves as input for subsequent health measurements.

6. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 5, characterized in that, The method involves weighted fusion of the periodic stability index and the anomaly score to obtain a health metric reflecting the operating status of the target system. The anomaly score and the periodic stability index are normalized respectively to construct the confidence scores of the anomaly score and the confidence scores of the periodic index. The confidence scores of the anomaly score are calculated based on the score volatility, and the confidence scores of the periodic index are calculated based on the morphological variation ratio. Using the confidence scores of anomaly ratings and the confidence scores of periodicity indicators as inputs, a weighted vector is dynamically generated through a nonlinear function structure. , Calculate health metrics for: , Indicators representing periodic stability Indicates an abnormal score. , satisfy .

7. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 6, characterized in that, Based on the combined results of the health metrics and the anomaly scores, the abnormal event detection results are determined, or the subsequent alarm strategies and judgment thresholds are dynamically adjusted. The methods include: The abnormal score and health metric value are input into a joint decision function. The function determines whether the abnormality is due according to the set joint decision rules and outputs an abnormality label. The joint decision rules include: the abnormal score is higher than the abnormal threshold, the health metric value is lower than the health threshold, or the combination of the two satisfies the set logical expression. The joint feature vector composed of the anomaly score, health metric value and anomaly label is input into a predefined classifier, and the anomaly type label or anomaly level label is output. The subsequent alarm strategy is controlled based on the anomaly type label or anomaly level label, including alarm level classification, alarm frequency setting, or target module routing switching. During system operation, the abnormal threshold and health threshold are dynamically adjusted based on the changing trends of the sliding window of the abnormal score and health metric, as well as the difference between the detection results and alarm feedback.

8. The log abnormal behavior analysis method based on ranking learning and attention mechanism according to claim 1, characterized in that, The training and inference process of the sequence learning model also includes: During training, structured adversarial samples are constructed based on the original log data. These structured adversarial samples are generated by adding perturbation vectors to maintain structural consistency. The perturbation process is controlled by the log template syntax tree structure to maintain the parsability and field integrity of the structured adversarial samples in terms of syntax structure. Constructing the log template syntax tree structure includes: extracting templates from the raw log data, generating a field hierarchy and syntax pattern node diagram, and allowing perturbations only to be added to variable parameter fields during the perturbation process, while prohibiting any modifications to fixed template fields; The structure-constrained adversarial examples are introduced into the model training process and combined with normal log sequences as input to the sequence learning model to enhance the model's ability to identify anomalous behaviors under structural consistency. During the model inference process, the input log sequence is parsed to analyze its syntax structure, and the structural deviation index between the log sequence and the log template is calculated. The structural deviation index represents the degree of difference between the current input and the log template in terms of field structure. When the value of the structural deviation index exceeds the set threshold, the system switches to a backup detection structure that includes a rule-constrained path.

9. A log abnormal behavior analysis system based on ranking learning and attention mechanisms, applied to the log abnormal behavior analysis method based on ranking learning and attention mechanisms as described in any one of claims 1-8, characterized in that, The system includes: The log collection and parsing module is used to collect raw log data generated during the operation of the target system, extract log timestamps, event types and content parameters, and generate structured log sequences. The periodic neural decomposition module is used to perform periodic neural decomposition on the log sequence to construct periodic components, trend components, and residual components represented by trainable periodic basis functions. The topology phase labeling module is used to construct a service topology graph based on microservice call relationships, and combine log tracing identifiers to parse service call chain paths, mark the running phase boundaries, and add running phase labels to each log data in the log sequence; The sequence learning module includes a phase-aware multi-head attention mechanism and a ranking learning training strategy, which is used to model the relationship between log events based on the input residual components and phase labels, and output anomaly scores. The periodic stability analysis module is used to calculate the periodic stability index based on the periodic component and the trend component, using the dynamic time warping method and the sliding trend analysis. The health metric generation module is used to perform weighted fusion of anomaly scores and periodic stability indicators, and output health metric values ​​that reflect the operating status of the target system. The joint judgment and alarm module is used to judge abnormal events based on the joint result of the abnormal score and health metric, and output abnormal labels, abnormal type labels or abnormal level labels according to the judgment result, while dynamically adjusting alarm strategies, abnormal thresholds and health thresholds. The adversarial robustness enhancement module is used to generate structurally constrained adversarial examples during training and parse the grammatical structure of the input log sequence during the inference phase, calculate the structural deviation index, and switch to an alternative detection structure containing rule-constrained paths when the structural deviation index value exceeds a set threshold.

Images