System log anomaly detection method based on large language model

Abstract

The invention discloses a system log anomaly detection method based on a large language model, which comprises the following steps of: determining a finely-adjusted data set, and finely adjusting a large model by adopting the finely-adjusted data set; and generating cue words according to the cue word template through non-feedback planning, feedback planning and cue word combination, inputting the cue words into the fine-tuned large model, carrying out anomaly detection, and giving a final explanation. According to the method, the system log anomaly can be detected only by a small number of samples or even under the zero sample condition, the anomaly of the system log can be judged, and the reason of the anomaly can be generated to assist workers in eliminating the anomaly.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly to a method for detecting anomalies in system logs based on large language models. Background Art

[0002] Large language models (LLMs) are extremely large deep learning artificial intelligence models pre-trained on massive amounts of data. By training on large amounts of text data, they learn the grammar, semantics, and context information of language, enabling them to model and generate natural language text. In essence, they are trained in a probability-based manner. They are pre-trained based on a massive amount of training text corpus, and predict the next word based on the existing word sequence in front, thereby achieving natural language processing. Currently, most LLMs are implemented based on the Transformer model architecture. Using its self-attention mechanism, they can better capture the long-distance dependencies between different positions in the text sequence, thus improving the LLMs' understanding and processing ability of semantic information.

[0003] Although the large model itself has powerful capabilities, it is only used for natural language processing tasks. In order to unleash the powerful potential of the large model and apply it to solve tasks in other fields, various methods represented by fine-tuning and prompt engineering have been proposed.

[0004] Since the large model itself has powerful preparatory knowledge and generalization ability after being trained on massive amounts of data, on the basis of the pre-trained model by selecting relevant data, by setting appropriate hyperparameters and using a specific task objective function, necessary adjustments are made to the model to optimize its performance and make it suitable for downstream tasks in various fields. However, LLMs generally have a large number of parameters, and full-parameter fine-tuning of them requires consuming huge computing resources, which is not realistic. Therefore, parameter-efficient fine-tuning (PEFT) has been proposed. PEFT aims to minimize the number of fine-tuned parameters and computational complexity. For example, certain layers of the pre-trained model are frozen and only a few specific layers are fine-tuned, so as to achieve the model's learning of knowledge in various fields and improve its performance in downstream tasks in the corresponding fields at a relatively low computational resource cost.

[0005] Given the powerful internal knowledge and generalization ability of large models, in order to enable them to solve unknown problems by leveraging their potential capabilities when faced with unknown tasks, prompt engineering is required. Prompt engineering involves designing corresponding prompt templates for specific tasks to guide LLMs to think in the correct direction using their own knowledge, thereby guiding the large model to generate corresponding outputs according to requirements. A prompt template generally consists of three parts, namely: (1) the prompt prefix, which is used to provide relevant information about the current task and its content is generally fixed; (2) the input slot, which generally serves as the input variable for the task, and the specific task object is filled in as the input; (3) the output slot, which is used to record the generation results of the large model and is generally located at the end of the prompt template.

[0006] Anomaly detection of logs has always been a top priority in the security field. Due to the natural language characteristics and strong context correlation characteristics of logs, it is reasonable to use a deep learning neural network model based on long short-term memory (LSTM) in the deep learning model for log anomaly detection.

[0007] However, LSTM does not perform well on long and complex sequences, and LSTM often only cares about the previous sequences of log information. However, it is also very important to associate subsequent content for log anomaly detection. Therefore, researchers have begun to focus on using the semantic information of logs and language models based on transformers, such as Bert and GPT, which can have stronger medium- and long-term dependencies.

[0008] However, both the LSTM approach and the approach using language models face the problem that these methods strongly rely on existing log datasets for learning. However, for online scenarios or new devices, there is often a lack of a large number of excellent datasets for training. At the same time, these methods can only detect anomalies and cannot give reasons for the judgment. Security staff often need to determine the reasons for the anomalies themselves. Therefore, large language models with vast knowledge and powerful generalization ability have come into people's view. Summary of the Invention

[0009] In view of this, the present invention provides a method for system log anomaly detection based on a large language model. By fine-tuning the large model and designing various prompt engineering methods based on the large language model, the large model is applied to log anomaly detection, providing a new solution for log anomaly analysis in the security field, so as to be able to detect log anomalies using a variety of open-source large models at a relatively low cost and under zero-shot conditions.

[0010] The present invention discloses a method for system log anomaly detection based on a large language model, which includes:

[0011] Step 1: Determine the fine-tuning dataset and use it to fine-tune the large model.

[0012] Step 2: Generate prompts according to the prompt template through zero-shot planning, few-shot planning, and prompt combinations respectively, input the prompts into the fine-tuned large model for anomaly detection, and give the final explanation.

[0013] Further, in the said Step 1:

[0014] The fine-tuning dataset includes the dataset after expanding the LogQA dataset and content related to cybersecurity books, security papers, and security communities; expand the LogQA dataset to enable the large language model to learn the formats of different types of system logs.

[0015] Further, in the said Step 1:

[0016] LoRA fine-tuning adds a bypass in the network. The bypass is the multiplication of two matrices A and B; the dimension of matrix A is d, and the dimension of matrix B is r, where r << d. The number of parameters of the bypass is much smaller than the parameter W of the original network. During LoRA fine-tuning, the parameter W of the original network is frozen, and only the bypass parameters A and B are trained, that is:

[0017] h = Wx + ΔWx = Wx + BAx

[0018] where W is the parameter of the pre-trained model, ΔW is the parameter to be updated, x is the input of the large language model, h is the output of the large language model. After LoRA fine-tuning, the reverse process updates the weight parameters according to and to update the weight parameters.

[0019] Further, before the said Step 2, it also includes:

[0020] Before designing the prompts, construct a standardized prompt template for subsequent filling of prompts and logs, reducing the uncertainty of the content generated by the large model;

[0021] Standardize the input and output of the large model through the prompt template to facilitate subsequent collation of the output results of the large model, and also facilitate the replacement of prompts obtained by using different prompt engineering;

[0022] Set a sliding window to input multiple logs for subsequent anomaly detection, and set the maximum number of tokens. When performing anomaly detection on each log, use multiple logs related to it up and down as the judgment benchmark and input them to the large model.

[0023] Further, the said Step 2 includes:

[0024] Anomaly detection is performed through feed - forward planning, and the final explanation method is as follows:

[0025] When using feed - forward planning, it is divided into implicit and explicit guidance for the large - model to think; the large - model is required to think step by step whether the log is normal. Its thinking generation module adopts the sample form, decomposes the log - based anomaly detection into multiple steps, each step thinks from different angles, draws different conclusions respectively, and each thinking angle is independently distributed; and relevant restrictions are imposed on the thinking; the relevant restrictions include requiring the large - model to consider whether there is a problem with the log order and whether the log information parameters are incorrect;

[0026] Anomaly detection is performed through feedback planning, and the final explanation method is as follows:

[0027] The large - language model itself is optimized through iterative feedback from multiple angles to improve the accuracy of log anomaly detection and the quality of the generated explanations, and the large - model is used to optimize the answers;

[0028] Anomaly detection is performed through a combination of prompting words, and the final explanation method is as follows:

[0029] Combine the two prompting engineering techniques of CoT and In - Context. By randomly selecting a specified number of normal logs and abnormal logs as the input for context learning, it is expected that the large - model will establish an implicit thinking process for judging whether the log is normal by learning the normal and abnormal forms of the logs; in combination with the way of the chain of thought, guide the large - model to think to reduce the judgment errors caused by the large - model's excessive thinking.

[0030] Furthermore, through the prompting engineering technique of ToT, the large - model establishes a tree - shaped thinking process, thinks about the problem from multiple angles, and finally obtains the answer that best meets the requirements. In the feed - forward planning: each stage of ToT consists of a thinking generation module and a state evaluation module respectively. In each step, the thinking generation module conducts multi - angle thinking for this stage, and the state evaluation module selects the best answer for this stage and passes it to the next stage. In this way, after a specified maximum number of thinking stages, the final answer is obtained.

[0031] Furthermore, the thinking generation module is as follows:

[0032]

[0033] where ans (j) is the thinking answer finally obtained in the j - th stage, which follows the probability model of the prompting words designed based on CoT for this stage, that is, the output of the large - language model; ans is the thinking answer obtained in the i - th stage; (ans i+1 |x, ans i+1 |x, ans1…i ) is the initial input x and the answer ans obtained from the iterations in the previous stages from 1 to i 1…i , under this state, input ans i+1 ; each ans is the thinking result output at each stage; s is the thinking stage of each one, that is, each state is composed of a thinking sequence of multiple different steps after inputting the fine-tuned large model according to the previously designed prompt template and multiple log data included through a sliding window, that is, [x, ans 1…i ; x is the input of the large language model, that is, the input log data; j represents the j-th level of thinking stage, j = 1…k, and k represents the total number of thinking stages;

[0034] For the state evaluation module, in a voting manner, by simulating multiple experts in the security field to evaluate each thinking stage s, the voting result V(p θ , S) is obtained, and its specific formula is:

[0035] V(p θ , S)(s) = I[s = s *

[0036] Among them, V(p θ , S) is the voting result under the prompt p θ and the state environment S, s is each state, the selected state s* is to select the best analysis result through the judgment of the large model among different states in the S environment; I[s = s * means that when s = s * , the value of the indicator function I[s = s * is 1; when s ≠ s * , the value of the indicator function I[s = s * is 0;

[0037] According to the relevant knowledge learned about the log field before, generate log anomaly detection steps from different angles, select the best steps and conclusions through the voting mechanism, finally establish a thinking chain, and generate the complete log anomaly detection results and reasons.

[0038] Furthermore, in ToT, the breadth-first search algorithm is adopted, and the best answer to the problem maintaining the current thinking angle is retained at each step until the set maximum number of thinking steps is reached to obtain the final result;

[0039] Finally, through ToT, the large language model is guided to perform tree-shaped thinking from multiple different angles, and finally the input log data is detected for anomalies and the final explanation is given.

[0040] ​Furthermore, through the prompt engineering method of Self-Refine, answers are generated and reflected on, and the answers are corrected according to the reflection, so as to obtain answers that meet the requirements. In the said feedback planning:

[0041] Prepare three different prompt words, namely p gen , p fb and p refine ; p gen is the prompt word used to generate the initial answer in the initial stage, p fb is the prompt word for generating reflections on the existing answers in the feedback stage, and p refine is the prompt word for optimizing the answers according to the reflection results in the optimization stage;

[0042] First is the initialization stage. Use the large model to perform anomaly detection and analysis on the log using p gen to obtain y0:

[0043] y0 = LLM(p gen ||x)

[0044] where y0 is the initial answer generated in the initial stage and x is the input;

[0045] Secondly is the feedback stage. Evaluate y0 according to p fb to obtain fb0:

[0046] fb0 = LLM(p fb ||x||y0)

[0047] where fb0 is the reflection conclusion generated by the large language model after thinking in the reflection stage based on the initial answer y0 and the input x;

[0048] Then is the optimization stage. Input fb0 and y0 into the LLM at the same time. The LLM optimizes y0 according to fb0 and generates y1:

[0049] y1 = LLM(p refine ||y0)

[0050] where y1 is the optimization result obtained after optimization in the optimization stage;

[0051] Finally, repeat the feedback stage and the optimization stage, and generate explanations and answers through iterative optimization; Set the number of iterations to two:

[0052] y final = LLM(p refine ||Logs||y0||fb0||y1||fb1)

[0053] Among them, LLM is a large language model, Logs is the input, i.e., the log data to be detected, fb1 is the reflection result obtained in the feedback stage, and y final is the obtained final result.

[0054] Furthermore, the reflections generated in the feedback stage include rechecking the detection results and providing feedback on the quality and rigor of the generated analysis; setting relevant thinking directions in p fb to guide the LLM to judge the anomaly detection results of the logs and give corresponding examples to guide the LLM to think about the quality of the generated reasons and provide feedback;

[0055] In the optimization stage, the LLM corrects the judgment results according to the feedback given in the feedback stage and improves the quality of the generated analysis;

[0056] Finally, through multiple rounds of self-reinforcing learning feedback loops, the best log anomaly detection results and reasonable explanations are obtained.

[0057] Due to the adoption of the above technical solutions, the present invention has the following advantages: Different from the traditional way of using deep learning, by combining the current hot large language model with the anomaly detection of system logs in the security field, it is proposed to improve the adaptability of the open-source large model to log domain tasks by means of fine-tuning. At the same time, the ability of the large model itself in the field of system log anomaly detection is improved by means of fine-tuning and prompt engineering, thus avoiding the dependence on powerful online closed-source large models such as ChatGPT. In addition, by combining the latest prompt engineering techniques of ToT and Self-Refine and attempting to combine existing simple prompt engineering techniques such as CoT and In-Context, in the case of few-shot or even zero-shot, it is used to improve the anomaly detection accuracy of the large model and the effect of the anomaly explanations generated in this way. It is proved that different current development directions of prompt engineering are helpful for using large models to detect and analyze security log anomalies, and it is expected to inspire subsequent research using large models in this field. Compared with the existing solutions, it mainly has the following beneficial effects and advantages:

[0058] 1. Different from traditional deep learning methods, by using the powerful capabilities of large models and prompt engineering methods, the high dependence on datasets is reduced, and the detection of system log anomalies can be achieved with only a small number of samples or even under zero-shot conditions;

[0059] 2. By using the powerful generation capabilities of large models and fine-tuning techniques, the ability of large models in the field of system log anomaly detection is improved, so that compared with traditional deep learning methods, it can not only judge the anomalies in system logs, but even generate the reasons for the anomalies to assist security personnel in eliminating anomalies;

[0060] 3. Combine the current popular large model with system log anomaly detection, make an attempt for the large model in the field of log anomaly detection, and provide inspiration for subsequent application research on large models in this field. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0062] Figure 1 Schematic diagram of the method for implementing system log anomaly detection using a large language model according to an embodiment of the present invention;

[0063] Figure 2 Schematic diagram of the LoRA fine-tuning process according to an embodiment of the present invention;

[0064] Figure 3 Schematic diagram of the prompt engineering template according to an embodiment of the present invention;

[0065] Figure 4 Schematic diagram of the use of ToT (Tree of Thoughts) for log anomaly detection according to an embodiment of the present invention;

[0066] Figure 5 Schematic diagram of the implementation of Self-Refine for system log anomaly detection according to an embodiment of the present invention;

[0067] Figure 6 Schematic diagram of the use of CoT+InContext for system log anomaly detection according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0068] The present invention will be further described in conjunction with the drawings and embodiments. The described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art shall fall within the scope of protection of the embodiments of the present invention.

[0069] The present invention mainly uses a large model to solve the problems existing in the current commonly used method of log anomaly detection based on deep learning:

[0070] 1. Aiming at the fact that traditional deep learning methods cannot handle long and complex log sequences well, the present invention intends to use a large model as an alternative to the original deep learning solution. Logs themselves have certain natural language attributes, which are naturally aligned with the powerful natural language processing capabilities of large models. Utilize the powerful natural language processing capabilities and context memory capabilities of large models to achieve the processing of long and complex log sequences;

[0071] 2. For traditional deep learning-based log anomaly detection methods, it is often necessary to train based on a large amount of data to obtain the corresponding deep learning model. Therefore, using traditional deep learning models often has strong specificity. For new systems that emerge, traditional deep learning methods lack generality. Due to the lack of a large amount of log data, they cannot be put into use immediately. When the existing system is updated, due to the emergence of new log data, the deep learning model trained based on the existing log data is very likely unable to adapt well after the update, resulting in negative effects such as false alarms. Therefore, the present invention intends to use large models to solve the above problems. Large models themselves have powerful generalization capabilities. By using fine-tuning techniques, large models can be made to have the ability to adapt to the log field. At the same time, by using prompt engineering techniques, the generalization capabilities of large models can be fully utilized, enabling large models to achieve few-shot or even zero-shot learning. Thus, when facing brand-new logs of unseen systems, they can also perform log anomaly detection well. Therefore, this application has stronger generality;

[0072] 3. For the increasingly large amount of log data, traditional deep learning-based methods that merely predict and determine whether the log is abnormal are not enough. On the basis of determining the anomaly, network security staff hope to obtain reasonable explanations for the log anomaly judgment, thereby reducing their analysis work on a large amount of logs. The method based on large language models proposed by the present invention, due to the powerful natural language generation ability of large models themselves, can effectively improve the log understanding and analysis ability of large models after fine-tuning the large models, and then guide the large models to think logically through prompt engineering, thereby generating reasonable explanations.

[0073] Traditional deep learning-based log anomaly detection fields often face poor interpretability and high dependence on existing log data. Traditional log anomaly detection methods based on deep learning or language models can indeed detect abnormal situations in logs. However, for the increasingly large amount of log data, simply detecting anomalies is not enough. Security staff are more eager to explain the detected abnormal logs, so as to provide inspiration for subsequent problem troubleshooting. Traditional log anomaly detection methods based on deep learning and language models often require a large amount of normal logs for training to obtain better anomaly detection effects. However, in actual application scenarios, it is often necessary to perform anomaly detection and analysis on logs from multiple different devices. Only relying on the training data of a single device cannot obtain good anomaly detection effects. For new devices, there is often a lack of log data, and it is often impossible to train a log anomaly detection model with good effects. For existing devices, problems such as changes in log formats that may occur during device updates will all cause a decline in the anomaly detection effect of the model trained based on existing data.

[0074] The method proposed by the present invention combines the innovative applications of prompt engineering and fine-tuning in large model technology, which can well solve these problems. First of all, large models have powerful domain adaptation capabilities. For large models, the emergence of fine-tuning technology can improve the adaptation ability of general large models in the log field, increase log-related knowledge, enable the LLM to better solve the log anomaly detection task, and improve the quality of the reasons generated for anomaly detection. At the same time, based on the log anomaly detection of large models, through its powerful logical reasoning ability and generation ability, it can detect abnormal logs and generate reasons for abnormal judgments according to the reasoning logic to assist security staff in diagnosing problems. At the same time, based on the large model approach, through the guidance of prompt engineering, the LLM can utilize existing knowledge, like humans, through logical analysis, to detect abnormal logs, rather than relying on the training of existing data.

[0075] See Figure 1 , the present invention provides an embodiment of a system log anomaly detection method based on a large language model. First is the input module. For large models, due to their powerful natural language processing capabilities, they can understand the log itself according to the context of the log data. And this means that the anomaly detection method based on large models does not need to preprocess the original log data like traditional log anomaly detection methods. It can use parameters such as the parameter time in the log as the judgment benchmark for whether the log is abnormal, improving the quality of the reasons generated for log anomaly detection. Secondly is the large model module. By means of fine-tuning, it improves the general large model's own understanding ability of log data and its ability in the log field. Finally is the prompt engineering module. In this module, according to the pre-constructed prompt template, it guides the large model to think and then conduct anomaly detection on the log, standardizes the generation of the large model to obtain the anomaly detection results and corresponding reasons for the log.

[0076] In the present invention, in order to improve the detection effect of large models on log anomalies, the selection of prompt words is no longer a simple direct prompt or CoT method, but the newly proposed ToT, Self-Refine, and the CoT+In-Context method that combines simple prompt engineering methods.

[0077] Regarding the fine-tuning of large models:

[0078] For general large models, the fine-tuning method can be used to improve the adaptability of large models in the log field, increase the relevant professional knowledge of large language models in the log field, so as to improve the correctness of the detection results of large language models for abnormal logs and the quality of the generated reasons.

[0079] In order to improve the efficiency of fine-tuning and reduce the overhead of fine-tuning, LoRA fine-tuning is adopted. See Figure 2, LoRA fine-tuning adds a bypass structure to the network. The bypass is the multiplication of two matrices A and B. The dimension of matrix A is d, and the dimension of matrix B is r; where r << d, and generally r takes 1, 2, 4, 8. Then the number of parameters of this bypass will be much smaller than the parameters W of the original network. During LoRA fine-tuning, the parameters W of the original network are frozen, and only the bypass parameters A and B are trained, that is:

[0080] h = Wx + ΔWx = Wx + BAx

[0081] where W is the parameter of the pre-trained model, ΔW is the parameter to be updated, x is the input of the large language model, and h is the output of the large language model. After LoRA fine-tuning, the reverse process updates the weight parameters according to and to update the weight parameters.

[0082] Since the number of parameters of A and B is much smaller than W, the memory overhead required during training is greatly reduced. Through the LoRA fine-tuning method, the number of parameters is reduced from d2 to 2rd, which greatly improves the fine-tuning efficiency and at the same time greatly reduces the training cost.

[0083] The dataset used to fine-tune the large model comes from the LogQA dataset provided by Shaohan Huang et al. This dataset involves log data of various different systems and explains the log data in the form of questions and answers, which helps to improve the model's own understanding and analysis ability of system logs. In order to improve the adaptability of the large model in the field of network security logs, the dataset is extended in the way of LogQA so that it can learn as many different formats of system logs as possible and improve the large model's ability to detect log anomalies in different systems. In addition to LogQA, relevant books, security papers, and content related to security communities in network security are also used as the fine-tuning dataset to improve the knowledge and adaptability of CLogLLM in the field of network security, so as to improve its ability to detect and analyze log anomalies.

[0084] The large model with specialized knowledge obtained after fine-tuning will be used as the core component in the subsequent steps of log anomaly detection, and combined with the subsequent prompt engineering to achieve log anomaly detection.

[0085] Regarding prompt engineering:

[0086] To guide the thinking of large models and bring out their prior knowledge and generalization ability trained with massive data, it is necessary to use prompt engineering. Currently, common prompt engineering methods include: Input-output (IO) prompting, CoT prompting, Self-prompt, In-context Prompt, etc. However, with the advancement of prompt engineering research, more complex but more effective prompt engineering methods have been proposed. Therefore, this paper will attempt to improve the existing simple prompt methods by using more advanced prompt engineering methods and combining simple prompt engineering methods, so as to improve the anomaly detection effect of logs and the quality of generated explanations.

[0087] Before designing the prompt words, it is first necessary to construct a standardized prompt template for subsequent filling of prompt words and logs, reducing the uncertainty of the content generated by the LLM. As shown by Figure 3 the prompt template can standardize the input and output of the large model, facilitating the subsequent collation of the output results of the large model, and also conducive to replacing the prompt words of different prompt engineering methods. For the anomaly detection of logs, it is not enough to judge based on the logs themselves. Although the LLM itself has a memory function, in order to not only rely on the previous log information but also combine the subsequent log information for anomaly judgment. Therefore, in this invention, a sliding window will be set to input multiple logs for subsequent anomaly detection, and a maximum number of tokens is set to avoid too long input length. In this way, when detecting the anomaly of each log, multiple logs related to it above and below can also be used as judgment benchmarks and input to the large model. For the anomaly detection of logs, the parameters of the logs are also very important for judging whether the logs are abnormal. In order to give full play to the thinking ability and prior knowledge of the LLM, different from the traditional method that requires preprocessing the log file to extract the log template, the log itself together with the logs related to it above and below is directly input into the large model. Its specific structure is as shown by Figure 3 shown.

[0088] The present invention proposes three different prompting engineering methods, namely Thought of Tree (ToT), Self-Refine, and the combination of the existing CoT and In-Context, to improve the ability of large models pre-finetuned in log anomaly detection and analysis. These three methods respectively represent three different research directions of large models for prompting engineering, which are feedback-free planning, feedback-based planning, and prompt combination. In the present invention, the prompting engineering methods of these three directions will be used respectively to improve the ability of large models to detect and analyze anomalies in security logs. And verify the feasibility of these three directions for improving the ability of large models in the field of log anomaly detection and analysis, hoping to inspire subsequent research on log anomaly detection and analysis based on large models.

[0089] Among them, regarding Thought of Tree (ToT):

[0090] For log anomaly detection and analysis, it is often necessary to consider different aspects for judgment. This not only requires decomposing the problem into multiple steps to solve, but also requires considering multiple factors in each step.

[0091] The emergence of Tree of Thoughts (ToT) well makes up for this deficiency. ToT simulates the way of human thinking by decomposing a complex problem into multiple simpler problems that are easier to solve. Each thought is a coherent sequence of language, and this sequence is the intermediate step to solve the problem. Among these discrete separate units, a list of potential reasoning step candidates will be generated, and then these candidate lists will be evaluated and finally a solution to the problem will be determined. Therefore, in the present invention, referring to this prompting template method of ToT, the thinking of the LLM is guided by designing prompts, so as to perform log anomaly detection on log information and generate corresponding analysis.

[0092] See Figure 4 , when using ToT, it is necessary to guide the LLM thinking implicitly and explicitly. In the previous finetuning task, the LLM has learned log-related knowledge, and by asking the LLM to think step by step about whether the log is normal. Its thinking generation module adopts the sample form (such as formula As shown in the figure, log anomaly detection is broken down into multiple steps. Each step draws different conclusions from a different perspective, and each perspective is independently distributed. To guide its thinking and prevent LLM from overthinking and diverging, certain constraints are also imposed. For example, it is required to consider whether there are problems with the log sequence or incorrect log information parameters. The specific process is shown in the following formula, where each ans is the thinking result output at each stage, and s is each thinking stage. In other words, each state is formed through a sequence of multiple thinking steps after the fine-tuned large model is fed with the previously designed prompt word template and multiple log data items covered by the sliding window, i.e., [x, ans1…i].

[0093] In feedback-free planning: Each stage of ToT consists of a thinking generation module and a state evaluation module. In each step, the thinking generation module will first conduct multi-angle thinking for that stage, and then select the best answer for that stage through the state evaluation module and pass it to the next stage. This cycle repeats until the final answer is obtained after the specified maximum number of thinking stages.

[0094] The thinking generation module is as follows:

[0095]

[0096] Among them, ans (j) The final answer to the thought in stage j is based on the prompt words designed based on CoT in this stage. The probability model of , that is, the output of the large language model; ans i+1 The answer to the thinking obtained in stage i; (ans i+1 |x,ans 1…i ) is the initial input x and the answer ans obtained from the previous 1 to i stages of iteration 1…i In the state, enter ans i+1 ; Each ans is the thinking result output at each stage; s is each thinking stage, that is, each state is composed of a thinking sequence of multiple different steps after the fine-tuning large model is input with the previously designed prompt word template and multiple log data included by the sliding window, that is, [x,ans 1…i ]; x is the input of the large language model, i.e., the input log data; j represents the jth level of thinking stage, j = 1…k, k represents the total number of thinking stages;

[0097] For the status evaluation module, since it is difficult to score using a score for the reason of log anomaly detection, a voting method is adopted. By simulating multiple experts in the security field to evaluate it, the best explanation and evaluation thinking scheme are obtained through voting in the end. The specific formula is as follows, where the selected status s* is to select the best analysis result through the judgment of the large model among different statuses in the S environment.

[0098] V(p θ ,S)(s)=I[s=s *

[0099] Among them, V(p θ ,S) is the voting result in the prompt p θ and the status environment S, s is each status, The selected status s* is to select the best analysis result through the judgment of the large model among different statuses in the S environment; I[s=s * means that when s=s * , the value of the indicator function I[s=s * is 1; when s≠s * , the value of the indicator function I[s=s * is 0;

[0100] Then, under the premise of maintaining this conclusion, continue to promote thinking. According to the relevant knowledge learned about the log field before, continuously generate log anomaly detection steps from different angles, and select the best steps and conclusions through the vote mechanism. Finally, establish a whole appropriate thinking chain, and generate the complete log anomaly detection results and reasons.

[0101]

[0102] In ToT, the breadth-first search (BFS) algorithm is adopted. At each step, the best answer to the problem maintaining the current thinking angle is retained until the set maximum thinking step is reached, and finally the final result is obtained.

[0103] Finally, through ToT, the large model is guided to perform tree-shaped thinking from multiple different angles, and finally the input log data is detected for anomalies and the final explanation is given.

[0104] Among them, regarding Self-Refine:

[0105] When directly using the large model to detect anomalies in the log and then generate corresponding explanations. However, the large model itself may make mistakes, so a certain error correction mechanism is needed to improve the effect of the large model in log anomaly detection and the quality of generating explanations.

[0106] ​The second method for the large model to detect system log anomalies based on prompt engineering proposed by the present invention is Self-Refine. It iteratively optimizes itself from multiple perspectives, thereby improving the accuracy of log anomaly detection and the quality of generated explanations. Different from the traditional iterative refinement of answers that requires training a refinement model with specific domain data, Self-Refine utilizes the powerful capabilities of the large model to optimize the answers instead of relying on additional training. Its specific implementation framework is as Figure 5 shown.

[0107] The Self-Refine method requires preparing three different prompt words, namely p gen , p fb , and p refine . p gen is the prompt word used to generate the initial answer in the initial stage, p fb is the prompt word for generating reflections on the existing answer in the feedback stage, and p refine is the prompt word for generating optimized answers based on the reflection results in the optimization stage. First is the Initial generation (initialization) stage. The large model uses p gen to perform simple anomaly detection and analysis on the log, obtaining an initial simple judgment and analysis reason y0.

[0108] y0 = LLM(p gen ||x)

[0109] where y0 is the initial answer generated in the initial stage, and x is the input;

[0110] Secondly is the Feedback (feedback) stage. According to p fb , y0 is evaluated, and corresponding optimization suggestions fb0 are proposed. Then comes the Refine stage. fb0 and y0 are simultaneously input into the LLM, and the LLM optimizes y0 according to fb0 to generate y1.

[0111] fb0 = LLM(p fb ||x||y0)

[0112] where fb0 is the reflection conclusion generated by the large language model after thinking in the reflection stage based on the initial answer y0 and the input x;

[0113] Next is the Refine (optimization) stage. fb0 and y0 are simultaneously input into the LLM, and the LLM optimizes y0 according to fb0 to generate y1:

[0114] y1 = LLM(p refine ||y0)

[0115] Among them, y1 is the optimization result obtained after optimization in the optimization stage;

[0116] Finally, repeat the Feedback and Refine stages to generate appropriate explanations and answers through multiple iterative optimizations. In the present invention, considering the need to process a large amount of log data, multiple iterative optimizations cannot be performed, and the number of iterations in the present invention is set to two.

[0117] y final = LLM(p refine ||Logs||y0||fb0||y1||fb1)

[0118] Among them, LLM is a large language model, Logs is the input, i.e., the log data to be detected, fb1 is the reflection result obtained in the feedback stage, and y final is the final result obtained.

[0119] In the present invention, the Feedback generated in the Feedback stage includes rechecking the detection result and providing feedback on the quality and rigor of the generated analysis. To guide the LLM to think about how to provide feedback, relevant thinking directions are set in p fb to guide the LLM to judge the anomaly detection result of the log and give corresponding examples, and to guide the LLM to think about the quality of the generated reasons and provide feedback. In the Refine stage, the LLM corrects the judgment result according to the feedback given in the Feedbcak stage and improves the quality of the generated analysis. Finally, through multiple rounds of self-reinforcing learning feedback loops, an optimal log anomaly detection result and reasonable explanation are finally obtained.

[0120] Among them, regarding CoT+In-Context:

[0121] In the process of practical application, relying solely on a single simple prompting engineering technique often has certain deficiencies, while combining different prompting engineering techniques can often effectively improve the effect of the large model in solving tasks. For example, relying solely on InContext cannot generate good reasons for anomalies, and relying solely on CoT itself still has room for improvement. Both of these methods are simple prompting engineering methods, and their advantages are that the design of the prompting words is simple, and their advantages and disadvantages can complement each other well. Therefore, try to combine the two prompting engineering techniques of CoT and InContext, and study the improvement brought by them to the large model in the log anomaly detection task and the generated explanations compared with using a single prompting engineering technique.

[0122] The prompting engineering method of CoT+InContext constructed by the present invention is as Figure 6As shown, by randomly selecting an appropriate number of normal logs and abnormal logs as the input for context learning, it is expected that the LLM can establish an implicit thinking process to judge whether the log is normal by learning the normal and abnormal forms of the logs. At the same time, in order to improve the abnormal detection rate of the logs, the way of chain of thought is combined to guide the LLM to think, reduce the judgment errors caused by the LLM's excessive thinking, and thus improve the accuracy and the quality of the generated analysis.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the specific implementation manners of the present invention can still be modified or equivalently replaced, and any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall be covered by the protection scope of the claims of the present invention.

Claims

1. A method for detecting anomalies in system logs based on large language models, characterized in that, Including: Step 1: Determine the fine-tuning dataset and use it to fine-tune the large model. Step 2: Generate prompts according to the prompt template through zero-shot planning, few-shot planning, and prompt combination respectively, input the prompts into the fine-tuned large model for anomaly detection, and give the final explanation.

2. The method according to claim 1, wherein In Step 1: The fine-tuning dataset includes the dataset after expanding the LogQA dataset and content related to cybersecurity books, security papers, and security communities. Expand the LogQA dataset to enable the large language model to learn the formats of different types of system logs.

3. The method according to claim 1, characterized in that, In Step 1: LoRA fine-tuning adds a bypass in the network. The bypass is the multiplication of two matrices A and B. The dimension of matrix A is d, and the dimension of matrix B is r, where r << d. The number of parameters of the bypass is much smaller than the original network parameter W. During LoRA fine-tuning, the original network parameter W is frozen, and only the bypass parameters A and B are trained, that is: h = Wx + ΔWx = Wx + BAx Among them, W is the parameter of the pre-trained model, ΔW is the parameter to be updated, x is the input of the large language model, h is the output of the large language model. After LoRA fine-tuning, the backward process updates the weight parameters according to and to update the weight parameters.

4. The method according to claim 1, wherein Before Step 2, it also includes: Before designing the prompts, construct a standardized prompt template for subsequent filling of prompts and logs, reducing the uncertainty of the content generated by the large model. Standardize the input and output of the large model through the prompt template to facilitate subsequent collation of the output results of the large model and also facilitate the replacement of prompts obtained using different prompt engineering methods. Set a sliding window to input multiple logs for subsequent anomaly detection, and set the maximum number of tokens. When performing anomaly detection on each log, use multiple logs related to it above and below as the judgment basis and input them to the large model.

5. The method according to claim 1, wherein Step 2 includes: The method for anomaly detection through zero-shot planning and giving the final explanation is: When using zero-shot planning, it is divided into implicit and explicit guidance for the large model to think. The large model is required to think step by step whether the log is normal. Its thinking generation module uses the sample form, decomposes the log judgment anomaly detection into multiple steps, each step thinks from different angles, and obtains different conclusions respectively. Each thinking angle is independently distributed; and relevant restrictions are imposed on the thinking; the relevant restrictions include requiring the large model to consider whether the log order is incorrect and whether the log information parameters are incorrect. The method for anomaly detection through few-shot planning and giving the final explanation is: Optimize the large language model itself through iterative feedback from multiple angles to improve the accuracy of anomaly detection of logs and the quality of the generated explanations, and use the large model to optimize the answers. The method for anomaly detection through prompt combination and giving the final explanation is: Combine the CoT and InContext prompt engineering techniques. Randomly select a specified number of normal logs and abnormal logs as the input for context learning. Expect the large model to establish an implicit thinking process for judging whether the log is normal by learning the normal and abnormal forms of the logs; combine the way of thinking chain to guide the large model to think, so as to reduce the misjudgment caused by the large model's excessive thinking.

6. The method according to claim 5, wherein Through prompting engineering with ToT, the large model establishes a tree-shaped thinking process, thinks about problems from multiple perspectives, and finally arrives at the answer that best meets the requirements. In the said unfeedback planning: Each stage of ToT consists of a thinking generation module and a state evaluation module. In each step, the thinking generation module thinks about the stage from multiple perspectives, and the state evaluation module selects the best answer for this stage and passes it to the next stage. This process repeats, and after a specified maximum number of thinking stages, the final answer is obtained.

7. The method according to claim 6, wherein The thinking generation module is as follows: Among them, ans (j) The final answer to the thought in stage j is based on the prompt words designed based on CoT in this stage. The probability model of , that is, the output of the large language model; ans i+1 The answer to the thinking obtained in stage i; (ans i+1 |x,ans 1…i ) is the initial input x and the answer ans obtained from the previous 1 to i stages of iteration 1…i In the state, enter ans i+1 ; Each ans is the thinking result output at each stage; s is each thinking stage, that is, each state is composed of a thinking sequence of multiple different steps after the fine-tuning large model is input with the previously designed prompt word template and multiple log data included by the sliding window, that is, [x,ans 1…i ]; x is the input of the large language model, i.e., the input log data; j represents the jth level of thinking stage, j = 1…k, k represents the total number of thinking stages; For the status evaluation module, a voting method is adopted. By simulating multiple experts in the security field to evaluate each thinking stage s, the voting result V(p θ , S) is obtained. The specific formula is as follows: V(p θ ,S)(s) = I[s = s * ​ Among them, V(p θ , S) is the voting result under the prompt p θ and the state environment S, s is each state, The selected state s* is obtained by comparing different states in the S environment and selecting the best analysis result through the judgment of the large model; I[s = s * indicates that when s = s * , the value of the indicator function I[s = s * is 1; when s ≠ s * , the value of the indicator function I[s = s * is 0; According to the relevant knowledge learned previously about the logging field, generate logging anomaly detection steps from different perspectives, select the best steps and conclusions through a voting mechanism, finally establish a thinking chain, and generate a complete logging anomaly detection result and reason.

8. The method according to claim 6, wherein In ToT, a breadth-first search algorithm is adopted. At each step, the best answer to the problem that retains the current thinking perspective is maintained until the set maximum number of thinking steps is reached to obtain the final result; Finally, through the guidance of ToT, the large language model conducts tree-shaped thinking from multiple different perspectives, finally performs anomaly detection on the input logging data, and gives a final explanation.

9. The method according to claim 5, characterized in that, Through the prompting engineering method of Self-Refine, generate an answer and reflect on the answer, and revise the answer according to the reflection, so as to obtain an answer that meets the requirements. In the said feedback planning: Prepare three different prompt words, namely p gen , p fb and p refine ; p gen is the prompt word used to generate the initial answer in the initial stage, p fb is the prompt word for generating reflections on the existing answer in the feedback stage, p refine is the prompt word for optimizing the answer based on the reflection results in the optimization stage; First is the initialization phase, using the large model to use p gen Perform anomaly detection and analysis on the logs to obtain y0: y0 = LLM(p gen ||x) Among them, y0 is the initial answer generated in the initial stage, and x is the input; Next is the feedback stage, according to p fb evaluate y0 to obtain fb0: fb0 = LLM(p fb ||x||y0) Among them, fb0 is the reflection conclusion generated by the large language model after thinking in the reflection stage according to the initial answer y0 and the input x; Next is the optimization stage. Input fb0 and y0 into the LLM at the same time. The LLM optimizes y0 according to fb0 to generate y1: y1 = LLM(p refine ||y0) Among them, y1 is the optimized result obtained after being optimized in the optimization stage; Finally, repeat the feedback stage and the optimization stage, and generate an explanation and an answer through iterative optimization; set the number of iterations to two: y final = LLM(p refine ||Logs||y0||fb0||y1||fb1) Among them, LLM is a large language model, Logs is the input, i.e., the log data to be detected, fb1 is the reflection result obtained in the feedback stage, and y final is the obtained final result.

10. The method according to claim 7, characterized in that, The reflections generated in the feedback phase include rechecking the detection results and providing feedback on the quality and rigor of the generated analysis; setting relevant thinking directions in p fb to guide the LLM to judge the abnormal detection results of the logs and give corresponding examples, and to guide the LLM to think about the quality of the generated reasons and give feedback; In the optimization stage, the LLM corrects the judgment result according to the feedback given in the feedback stage and improves the quality of the generated analysis; Finally, through multiple rounds of self-reinforcement learning feedback loops, the best logging anomaly detection result and a reasonable explanation are obtained.

Images