Log anomaly detection method and device, computer equipment and storage medium

Abstract

The invention discloses a log anomaly detection method and device, computer equipment and a storage medium, and relates to the technical field of log processing, and the method comprises the following steps: determining an initial lexical element sequence of each target log in a target log sequence; vectorizing each initial lexical element sequence in the target log sequence through a pre-trained SBERT sub-model, and determining a log parameter matrix of the target log sequence and a log template feature matrix containing sequence context information in the target log sequence through a feature extraction sub-model, and performing sequence-level anomaly detection and single log anomaly detection on the target log sequence in parallel through the classification task sub-model, and determining a final anomaly detection result of the target log sequence based on two anomaly detection results of different levels. Through the parallel synergistic effect of the detection tasks with different granularities, the model can more comprehensively identify the anomaly, the generalization ability and the detection precision of the model are improved, and the anomaly detection precision of the complex and changeable log sequence is ensured.

Description

Technical Field

[0001] The present disclosure generally relates to the field of log processing technology, and more particularly to a log anomaly detection method, apparatus, computer equipment, and storage medium. Background Art

[0002] Logs, as historical records generated during system software operation, are a key component for developers, operations personnel, and security personnel to debug and maintain system software. Furthermore, anomaly detection in logs can identify potential risks within system software, promptly identify abnormal events, and provide early warning information to relevant personnel. Therefore, accurately and quickly detecting log anomalies is crucial.

[0003] In related technologies, binary classifiers are typically used to solve log anomaly detection tasks. First, word embedding technology is used to vectorize the log template. Then, a bidirectional long short-term memory (BiLSTM) network and an attention mechanism are used to generate a single vector representing the log sequence. Finally, a binary classifier is used to determine whether the log is abnormal.

[0004] However, since existing log anomaly detection methods mainly focus on pattern errors in log sequences and only use log templates as the basis for judging whether a log sequence is abnormal, although some methods also consider log parameters, they often model log templates and log parameters separately and perform feature fusion within the model. Therefore, for complex and changeable log sequences, existing log anomaly detection methods have certain limitations. Summary of the Invention

[0005] In view of the above-mentioned defects or deficiencies in the prior art, it is desired to provide a log anomaly detection method, apparatus, computer equipment and storage medium, which not only use a pre-trained SBERT model to avoid the model's assumption that the log pattern is closed and stable, but also design detection tasks of different granularities to perform parallel anomaly detection at two granularities, log sequence and single log. The sequence detection task only uses template information to avoid the noise introduced by dynamic parameters; the single log detection task combines template and parameter information to retain the complete features of the log information. The two detection tasks share the feature extraction sub-model of the model. The synergy of the two tasks enables the model to identify anomalies more comprehensively, improves the generalization ability and detection accuracy of the model, and thus ensures the anomaly detection accuracy for complex and changeable log sequences.

[0006] In a first aspect, the present application provides a log anomaly detection method. The method comprises: Determine an initial word sequence for each target log in the target log sequence; Input each of the initial word-gram sequences into the pre-trained SBERT sub-model in the log anomaly detection model, vectorize each of the initial word-gram sequences, and obtain an initial word-gram vector matrix corresponding to each of the initial word-gram sequences; Inputting each of the initial word element vector matrices into a feature extraction submodel in a log anomaly detection model, determining a log parameter matrix and a log template matrix of the target log sequence from the multiple initial word element vector matrices, and extracting context dependencies within the target log sequence based on the log template matrix and position information of the log template matrix to obtain a log template feature matrix containing sequence context information in the target log sequence; The log template feature matrix, the target log sequence, and the log parameter matrix are all input into the classification task sub-model in the log anomaly detection model. The target log sequence is subjected to overall anomaly detection based on the log template feature matrix. At the same time, the target log sequence is subjected to local anomaly detection based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism. The final anomaly detection result of the target log sequence is determined based on the overall anomaly detection result and the local anomaly detection result.

[0007] In conjunction with the first aspect, in a possible implementation, performing overall anomaly detection on the target log sequence based on the log template feature matrix includes: Determining an attention weight vector of the target log sequence based on a query vector and the log template feature matrix; Performing Softmax normalization on the attention weight vector, and aggregating all column vectors in the log template feature matrix based on the normalized attention weight vector to obtain a sequence feature column vector of the target log sequence, where the sequence feature column vector is used to represent the overall sequence information of the target log sequence; Extract and merge the sequence feature column vectors according to the fully connected layer parameters to obtain a sequence abnormality real number representing the overall abnormality of the target log sequence; The sequence anomaly real number is mapped to a preset numerical range, and the mapping result is the sequence anomaly probability of the target log sequence and belongs to the overall anomaly detection result.

[0008] In conjunction with the first aspect, in a possible implementation, performing local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix includes: Splicing the log template feature vector corresponding to the target log in the log template feature matrix with the log parameter vector corresponding to the target log in the log parameter matrix to obtain a log feature splicing vector of the target log; Perform feature extraction and merging on the log feature concatenation vector according to the fully connected layer parameters to obtain a log anomaly real number representing the abnormality of the target log; The log anomaly real number is mapped to a preset numerical range, and the mapping result is the log anomaly probability of the target log and belongs to the local anomaly detection result.

[0009] In conjunction with the first aspect, in one possible implementation, determining the final anomaly detection result of the target log sequence based on the overall anomaly detection result and the local anomaly detection result includes: In a case where the local anomaly detection result includes a log anomaly probability of each target log in the target log sequence, determining abnormal logs in the target log sequence based on a magnitude relationship between the anomaly probability of each log and a preset log anomaly probability threshold; wherein the preset log anomaly probability threshold is determined based on the dynamic threshold function; Determining a first anomaly detection result of the target log sequence based on a magnitude relationship between a proportion of the anomaly logs in the target log sequence and a preset proportion threshold; wherein the process of determining the first anomaly detection result is determined by the voting mechanism; In a case where the overall anomaly detection result includes the sequence anomaly probability, determining a second anomaly detection result of the target log sequence based on a magnitude relationship between the sequence anomaly probability and a preset sequence probability threshold; Performing a logical OR operation on the first abnormality detection result and the second abnormality detection result to obtain the final abnormality detection result.

[0010] In conjunction with the first aspect, in a possible implementation, the method further includes: In the case where each Transformer encoder in the pre-trained SBERT sub-model includes a multi-head self-attention mechanism module and a multi-layer perceptron module, and the classification task sub-model includes an attention pooling module and a classifier module, In response to the software version update instruction, insert each preset MLP-Adapter module into the corresponding Transformer encoder in parallel with the corresponding multi-layer perceptron module, and insert each preset ATT-Adapter module after the corresponding multi-head self-attention mechanism module and in series with the multi-head self-attention mechanism module to obtain an updated SBERT model; The updated SBERT model replaces the pre-trained SBERT model to obtain an updated log anomaly detection model; The updated log anomaly detection model is retrained using a sample log sequence; the retraining includes performing parameter update training on the module parameters of each of the preset MLP-Adapter modules, each of the preset ATT-Adapter modules, the attention pooling module, and the classifier module, and the parameter matrix in the preset ATT-Adapter module uses a low-rank matrix of a preset dimension; the retrained log anomaly detection model is used to perform log anomaly detection on a new target log sequence.

[0011] In conjunction with the first aspect, in one possible implementation, determining the log parameter matrix and the log template matrix of the target log sequence from the multiple initial word element vector matrices includes: Decomposing each of the initial word unit vector matrices into an initial word unit template matrix and an initial word unit parameter matrix; Vector aggregation is performed on a group of initial word-unit template vectors contained in each of the initial word-unit template matrices and a group of initial word-unit parameter vectors contained in each of the initial word-unit parameter matrices to obtain the log parameter matrix and the log template matrix.

[0012] In conjunction with the first aspect, in a possible implementation, determining the initial word sequence of each target log in the target log sequence includes: Preprocessing the original log sequence collected from the target application software to obtain the target log sequence; wherein the preprocessing includes deleting empty logs and logs containing missing fields in the original log sequence, replacing spaces between special characters in the logs and merging adjacent continuous spaces, and standardizing the content format of the logs; Each target log in the target log sequence is segmented into word units to obtain the initial word unit sequence of each target log.

[0013] In a second aspect, the present application also provides a log anomaly detection device. The device includes: a word-gram sequence determination unit, configured to determine an initial word-gram sequence for each target log in the target log sequence; A log feature extraction unit is configured to input each of the initial word-meta sequence into a pre-trained SBERT sub-model in a log anomaly detection model, vectorize each of the initial word-meta sequence, and obtain an initial word-meta vector matrix corresponding to each of the initial word-meta sequence; input each of the initial word-meta vector matrices into a feature extraction sub-model in the log anomaly detection model, determine a log parameter matrix and a log template matrix of the target log sequence from the multiple initial word-meta vector matrices, and extract context dependencies within the target log sequence based on the log template matrix and position information of the log template matrix to obtain a log template feature matrix containing sequence context information in the target log sequence; The log anomaly detection unit is configured to input the log template feature matrix, the target log sequence, and the log parameter matrix into the classification task submodel in the log anomaly detection model, perform overall anomaly detection on the target log sequence based on the log template feature matrix, and simultaneously perform local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism; and determine a final anomaly detection result for the target log sequence based on the overall anomaly detection result and the local anomaly detection result.

[0014] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the log anomaly detection method described in the first aspect when executing the computer program.

[0015] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the log anomaly detection method described in the first aspect.

[0016] The present invention provides a log anomaly detection method, apparatus, computer equipment, and storage medium. The log anomaly detection method vectorizes the initial word-meta sequence of each target log in a target log sequence through a pre-trained SBERT sub-model, determines the log parameter matrix of the target log sequence and the log template feature matrix containing sequence context information in the target log sequence based on the initial word-meta vector matrix corresponding to each initial word-meta sequence through a feature extraction sub-model, performs sequence-level anomaly detection and single-log anomaly detection on the target log sequence in parallel through a classification task sub-model, and determines the final anomaly detection result of the target log sequence based on the anomaly detection results at two different levels. In this way, not only can the use of the pre-trained SBERT model avoid the model's assumption that the log pattern is closed and stable, but by designing detection tasks of different granularities, anomaly detection can be performed in parallel at two granularities: log sequence and single log. The sequence detection task only uses template information to avoid the noise introduced by dynamic parameters; the single log detection task combines template and parameter information to retain the complete features of the log information. The two detection tasks share the model's feature extraction sub-model and serve as regularization terms for each other. The synergy of the two tasks enables the model to identify anomalies more comprehensively, improves the model's generalization ability and detection accuracy, and thus ensures the accuracy of anomaly detection for complex and changeable log sequences. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 This is a flow chart of a log anomaly detection method according to one embodiment; Figure 2 This is a second flow chart of a log anomaly detection method according to an embodiment; Figure 3 A schematic diagram of log preprocessing and parsing in one embodiment; Figure 4 This is a third flow chart of a log anomaly detection method according to an embodiment; Figure 5 This is a fourth flow chart of a log anomaly detection method according to an embodiment; Figure 6 This is a fifth flow chart of log anomaly detection in one embodiment; Figure 7 This is a sixth flow chart of log anomaly detection in one embodiment; Figure 8 The figure is a schematic diagram of the insertion positions and structures of two different adapter modules in one embodiment; Figure 9 A schematic diagram of a multi-task learning framework structure in one embodiment; Figure 10 This is a structural block diagram of a log anomaly detection device in one embodiment; Figure 11 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are intended only to illustrate the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the invention are shown in the accompanying drawings.

[0019] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. In addition, the term "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "first" and "second" in the description and claims of the embodiments of the present invention are used to distinguish different objects, rather than to describe a specific order of objects.

[0020] Logs, as historical records generated during the operation of system software, are a key resource for developers, operations and maintenance personnel, and security personnel to debug and maintain system software. Log files are often referred to as the "black box" of system software. By embedding logging statements in code, developers can capture critical data such as program execution, variable states, and exception information. When system software experiences an abnormal state, the relevant processes automatically record information and write it to log files. These log files not only help developers troubleshoot and reproduce issues but also provide critical data support for pattern recognition and prediction of abnormal system behavior. Log-based anomaly detection can identify potential risks in system software, promptly detect abnormal events, and provide early warning information to relevant personnel. Automated analysis of large amounts of log data can quickly identify abnormal system behavior, helping operations and maintenance personnel efficiently locate problems and reduce the time and cost of manual intervention. Furthermore, log data can support system health assessment, performance optimization, and security protection. The value of log anomaly detection technology in fault diagnosis, risk prediction, and system optimization has become a focus of widespread attention in industry and academia. Therefore, developing efficient and intelligent log anomaly detection methods is of great practical significance and has broad application prospects.

[0021] With the recent development of deep learning and pre-trained language models, some research has begun to incorporate them into log anomaly detection. For example, DeepLog models log templates, using a recurrent neural network (RNN) to capture template sequence information, learn the patterns of normal log template sequences, and then determine whether the log sequence is anomalous by outputting the probability distribution of the next log template and judging whether the true value exists in the top-N probability options. LogBERT uses an unsupervised training model, using mask prediction and hypersphere minimization tasks in the pre-training phase to learn the patterns of normal template sequences. The prediction phase adopts a similar approach to DeepLog. LogRobust models log anomaly detection as a classic binary classification problem. It first vectorizes the log template using word embedding technology, then uses a BiLSTM network and an attention mechanism to generate a single vector representing the log sequence. A binary classifier is then used to determine whether the log is anomalous.

[0022] Therefore, it is understandable that most existing log anomaly detection methods primarily use log templates, assuming that log templates are closed and stable. Log templates can capture structured patterns in logs, helping models identify common software behavior patterns. The parameter portion may contain rich information such as timestamps and error levels, which is crucial for identifying specific types of anomalies. For detecting log sequence patterns, the template portion may play a dominant role. Errors may be introduced during log data collection and preprocessing. More seriously, even the most advanced log parsers may inevitably introduce noise due to the inherent distribution of the training data. This can lead to misidentification of parameters as templates, or to discarding parts of templates as parameters. This missing information can lead to misjudgment and reduce model accuracy. Parameters also provide important information for detecting individual log instances. Therefore, using only templates to determine whether a log sequence is anomaly may not only miss key information but also lead to poor performance when dealing with single log instance anomalies. Although some existing methods consider both templates and parameters, these methods split logs into templates and parameters and feed them into the embedding model separately. This artificially disrupts contextual continuity, preventing the model from capturing the underlying semantic dependencies between templates and parameters. Furthermore, if the parser returns an error, the parsing error will directly contaminate the embedding input, making the results irreversible. These methods fuse the extracted template and parameter features within the model, making it difficult to balance the importance of the two sources. The extracted feature representations can be confusing, and the model ultimately outputs a single result, failing to provide fine-grained feedback on whether the overall log sequence or a specific log entry is abnormal.

[0023] From the perspective of software iteration, log pattern changes are typically smooth, meaning that the differences between versions are not significant. Furthermore, descriptions of similar problems may be similar across different software systems. Therefore, the model should be capable of knowledge retention and continuous learning. Existing methods do not fully consider this issue and typically employ a full parameter update approach. This means that each version of the software requires retraining the model and updating all parameters. Furthermore, all parameters of the corresponding models for different software versions must be saved for subsequent use. This approach not only consumes significant computing power but also leads to bloated storage space, increasing maintenance costs and limiting its scalability and practicality in practical applications.

[0024] To solve the above technical problems, the present invention proposes a log anomaly detection method, computer device and storage medium. (1) The complete log text is input into the SBERT model as a whole, and the parameters and template information are distinguished at the token level in combination with the log parsing results. Mean pooling is performed to extract vector representations respectively, thereby maintaining the continuity of semantic context and fine modeling of structural information. Compared with the existing method of separating first and then embedding, the method avoids context fragmentation, enhances the model's ability to capture the potential semantic dependency between parameters and templates, and is more tolerant to inaccurately parsed logs, thereby enhancing the model's stability and robustness. (2) In response to the two types of requirements of "local anomalies" and "sequence anomalies" in log anomaly detection, the present invention designs a single log detection task and a log sequence detection task in the multi-task learning mechanism of log anomaly detection for the first time, and adopts differentiated input feature design: the former uses parameters and template vectors together to retain complete semantic features, while the latter only uses template vectors with context information to suppress the influence of parameter noise. The two tasks share a feature extraction submodule, and through joint training, achieve structural orthogonality and semantic complementarity, thereby improving the breadth and generalization ability of detection. (3) In the inference stage, the present invention addresses the problem of false positive accumulation when the sequence length increases, proposes a single log judgment threshold function based on dynamic adjustment of the sequence length, and combines the abnormal log ratio to control the sequence judgment threshold, and forms a dual-task joint judgment mechanism with the sequence detection output results, which effectively alleviates the accumulation of false positives and enhances the stability and fault tolerance of the model in actual deployment. (4) In response to the problem of high parameter update and storage overhead in version migration and continuous update of the model, the present invention proposes a dual Adapter mode (parallel MLP-Adapter and serial ATT-Adapter), in which the main model parameters remain frozen and only the Adapter module and task head are updated, which has modular and pluggable characteristics. Figures 1 to 11The present invention describes a log anomaly detection method, apparatus, computer device, and storage medium, wherein the execution subject of the log anomaly detection method can be a computer device, which can be a personal computer, server, embedded system, or other device. This application does not specifically limit this. Furthermore, the log anomaly detection method can also be applied to a log anomaly detection device provided in a computer device, which can be implemented by software, hardware, or a combination of both. The following describes the log anomaly detection method using a computer device as an example.

[0025] To facilitate understanding of the log anomaly detection method provided by the embodiments of the present application, the log anomaly detection method provided by the present application will be described in detail below through the following exemplary embodiments. It is understood that the following exemplary embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0026] Reference Figure 1 , which is one of the flow charts of the log anomaly detection method provided in the embodiment of the present application, such as Figure 1 As shown, the log anomaly detection method includes the following steps 101 to 104.

[0027] Step 101: Determine an initial word sequence for each target log in a target log sequence.

[0028] The target log sequence is a log sequence that does not contain empty logs. Each target log does not contain missing fields, special characters, or consecutive spaces, and its content format is standardized. Each target log may include a timestamp, event type, log level, and message content.

[0029] Each initial word sequence is a fine-grained token sequence representation of the corresponding target log, and each token is defined as a natural language unit (such as a word, character, number, etc.).

[0030] Specifically, the computer device determines the target log sequence by screening logs that meet the target log requirements from a large number of log instances stored in the computer device, and then uses all screened logs as the target logs in the target log sequence. The process of determining the target log sequence is not specifically limited here.

[0031] In addition, for the target log sequence, the computer device may use a token generation algorithm to determine the initial word sequence of each target log. The present invention does not specifically limit the specific process of determining the initial word sequence of each target log.

[0032] Step 102: Input each initial word-gram sequence into the pre-trained SBERT sub-model in the log anomaly detection model, vectorize each initial word-gram sequence, and obtain an initial word-gram vector matrix corresponding to each initial word-gram sequence.

[0033] The pre-trained SBERT sub-model includes N stacked pre-trained Transformer encoders (T-Encoders), where N is a positive integer greater than 0. In other words, the pre-trained SBERT sub-model is a pre-trained language model based on the Transformer architecture.

[0034] SBERT's English full name is Sentence-Bidirectional Encoder Representations from Transformers, and its Chinese full name can be Sentence Embedding-Bidirectional Encoder Representation Method, Sentence Embedding-Bidirectional Transformer Model, or Sentence Embedding-Bidirectional Encoder Representations from Transformers.

[0035] Specifically, by inputting each initial word-gram sequence into the pre-trained SBERT sub-model, the output of the last hidden layer of the pre-trained SBERT sub-model before aggregation is obtained; the specific output here is the vector representation corresponding to each token in each initial word-gram sequence, thereby obtaining the initial word-gram vector matrix corresponding to each initial word-gram sequence.

[0036] It should be noted that although the default output of the pre-trained SBERT sub-model aggregates the vectors corresponding to each token to obtain a vector representation of a single target log, in order to utilize the semantic information corresponding to the template and parameters in a more fine-grained manner, the present invention selects the output of the last hidden layer before aggregation of the pre-trained SBERT sub-model to obtain the vector representation corresponding to each token. This strategy not only avoids the semantic fragmentation caused by log disassembly, but also enables the template and parameters to be collaboratively represented in the same semantic space, and is closely integrated with the multi-task learning structure.

[0037] For example, The field of real numbers All the shapes above are The set of matrices, taking any target log in the target log sequence as an example, the pre-trained SBERT sub-model outputs the token vectors of all tokens corresponding to the target log, recorded as the initial word element vector matrix ,in h Indicates the number of tokens of the target log, column vector express h The first of the tokens k The vector representation of tokens, d Indicates the dimension of the vector.

[0038] Step 103: Input each initial word element vector matrix into the feature extraction sub-model in the log anomaly detection model, determine the log parameter matrix and log template matrix of the target log sequence from multiple initial word element vector matrices, and extract the context dependency within the target log sequence based on the log template matrix and the position information of the log template matrix to obtain a log template feature matrix containing the sequence context information in the target log sequence.

[0039] Specifically, by inputting each initial word unit vector matrix into the feature extraction sub-model, we can first perform average pooling operations on the token-level vectors of the log template and the token-level vectors of the log parameters in each initial word unit vector matrix, aggregate the tokens of each target log, and generate the log parameter vector and log template vector of each target log respectively, thereby obtaining the log parameter matrix and log template matrix of the target log sequence.

[0040] To incorporate sequence positional information, sine and cosine positional encoding is used to encode the log template vector. The log template vector corresponding to each target log in the template log sequence is then fed into two layers of T-Encoders to capture contextual dependencies within the target log sequence. By stacking these multiple layers of T-Encoders, the feature extraction sub-model effectively captures long-range dependencies within the target log sequence, enhancing the expressive power of features.

[0041] For example, when the target log sequence includes n The log template matrix of the target log and target log sequence is and the log parameter matrix is , and when the feature extraction sub-model includes two layers of T-Encoder and each layer of T-Encoder includes a Multi Head Self-Attention Mechanism (MHSA) module, a Multilayer Perceptron (MLP) module, a Residual Connection module, and a Layer Normalization module, in order to further capture the contextual relationship in the target log sequence, especially the sequence information between log templates, the log template matrix can be The input is sent to a two-layer T-Encoder for further encoding. The T-Encoder models the sequence data through the MHSA module and the MLP module.

[0042] Before entering the T-Encoder, the position information matrix is ​​generated using the sine-cosine position encoding method and combined with the log template matrix The calculation formula of position coding can refer to formula (1) and formula (2).

[0043] (1) (2) In formula (1) and formula (2), Represents the position index, represents the index of the dimension in the log template vector, Indicates the dimension of the vector.

[0044] Next, we will describe the calculation process of MHSA in detail. Suppose T-Encoder Layer input , the number of attention heads is H , and usually requires Can be H Divisible by , the latitude of each attention head is , No. Layer query matrix , key matrix Sum Matrix The calculation process of is as shown in formula (3) to formula (5).

[0045] (3) (4) (5) In formula (3) to formula (5), denote the learnable parameter matrices used to generate query, key, and value representations, respectively.

[0046] First, the T-Encoder l Layer input Perform linear transformation to obtain the query matrix , key matrix Sum Matrix , three learnable parameter matrices Initialized randomly and updated during model training.

[0047] Then the query matrix , key matrix Sum Matrix According to the characteristic latitude, it is divided into H sub-matrices, for each attention head, the current attention head The query matrix, key matrix, and value matrix are 、 、 .

[0048] Furthermore, each attention head is then subjected to the following calculation process (6) to (8) to capture the contextual relationship of the target log sequence.

[0049] (6) Will H The outputs of the attention heads are concatenated in the column direction and linearly projected to obtain the T-Encoder Layer input .

[0050] (7) (8) In formula (6) to formula (8), Represents the current attention head The output, express H The output of each attention head is concatenated in the column direction. Represents the projection matrix. Here we only describe the key multi-head attention layer in detail, and do not describe the multi-layer perceptron, residual connection and layer normalization. After encoding by the two-layer T-Encoder, we get the log template feature matrix containing the context information of the target log sequence. .

[0051] Step 104: Input the log template feature matrix, the target log sequence, and the log parameter matrix into the classification task sub-model in the log anomaly detection model. Perform overall anomaly detection on the target log sequence based on the log template feature matrix. At the same time, perform local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism. The final anomaly detection result of the target log sequence is determined based on the overall anomaly detection result and the local anomaly detection result.

[0052] Specifically, through the classification task sub-model in the log anomaly detection model, sequence-level anomaly detection and fine-grained anomaly detection can be performed on the target log sequence, that is, the two different levels of detection strategies designed for the target log sequence are sequence detection tasks and single log detection tasks.

[0053] For sequence detection tasks, sequence-level anomaly detection can be achieved by aggregating the log template feature matrix of the entire target log sequence. For single log detection tasks, the log template features and log parameter features of a single target log can be considered simultaneously to achieve fine-grained anomaly detection for a single template log.

[0054] The final anomaly detection result of the target log sequence needs to be determined comprehensively by the two detection tasks. For example, if the judgment results of both detection tasks are normal, the target log sequence can be determined to be normal. If the judgment result of at least one of the two detection tasks is abnormal, the target log sequence can be determined to be abnormal.

[0055] The log anomaly detection method provided by an embodiment of the present invention vectorizes the initial word-gram sequence of each target log in a target log sequence using a pre-trained SBERT sub-model, determines the log parameter matrix of the target log sequence and the log template feature matrix containing sequence context information in the target log sequence based on the initial word-gram vector matrix corresponding to each initial word-gram sequence using a feature extraction sub-model, and performs sequence-level anomaly detection and single-log anomaly detection on the target log sequence in parallel using a classification task sub-model. The final anomaly detection result of the target log sequence is determined based on the anomaly detection results at two different levels. In this way, not only can the use of the pre-trained SBERT model avoid the model's assumption that the log pattern is closed and stable, but also, by designing detection tasks of different granularities, anomaly detection is performed simultaneously at two granularities, log sequence and single log. The sequence detection task only uses template information to avoid noise introduced by dynamic parameters, while the single log detection task combines template and parameter information to retain the complete features of the log information. The two detection tasks share the model's feature extraction sub-model and serve as regularization terms for each other. The synergistic effect of the two tasks enables the model to more comprehensively identify anomalies, improves the model's generalization ability and detection accuracy, and thus ensures anomaly detection accuracy for complex and variable log sequences.

[0056] Based on the above Figure 1 In the method shown in FIG. 1 , in an exemplary embodiment, the initial word sequence of each target log in the target log sequence is determined in step 101. The specific process in this embodiment can be performed by Figure 2 Steps 201 and 202 are implemented as shown.

[0057] Step 201: Preprocess the original log sequence collected from the target application software to obtain a target log sequence; wherein the preprocessing includes deleting empty logs and logs containing missing fields in the original log sequence, replacing spaces between special characters in the logs and merging adjacent continuous spaces, and standardizing the content format of the logs.

[0058] Step 202: perform word-gram segmentation on each target log in the target log sequence to obtain the initial word-gram sequence of each target log.

[0059] Each collected raw log is usually a semi-structured text, and may include but is not limited to a timestamp, event type, log level, message content, etc.

[0060] Specifically, the original logs are collected from the target application software. The collection method can be real-time collection or periodic collection, or other pre-defined collection methods can be used; no specific limitation is given here.

[0061] To ensure the quality of log data and provide effective input for subsequent analysis, the present invention can preprocess the collected raw log sequence containing a large number of raw logs. The preprocessing strategies adopted may include but are not limited to: deleting empty logs and logs with missing fields, writing regular expressions to uniformly replace special characters with spaces and merge adjacent consecutive spaces, and converting all log contents to lowercase to avoid case inconsistencies; thereby obtaining the target log sequence.

[0062] For example, when an original log is "DHCPOFFER on 10.100.4.251 to 00:11:43:e3:ba:c3 via eth1", the original log is preprocessed and the target log is "dhcpoffer on10.100.4.251 to 00:11:43:e3:ba:c3 via eth1". After preprocessing, the target log sequence can be obtained Indicates the length of the original log sequence, Indicates the length of the target log sequence.

[0063] For each target log in the target log sequence, a log parser can be used to further parse each target log; the log parser can separate each target log into a log template and log parameters, where the log template refers to the static part in the corresponding template log and is composed of fixed keywords, representing the structured part of the corresponding target log; the log parameter refers to the dynamic part in the corresponding template log, that is, the content marked by the mask tag, such as timestamp, IP address, etc.; the present invention uses open source tools (such as Drain) as log parsers, but is not limited to specific tools, and a suitable log parser can be selected according to actual needs.

[0064] For example, set up a log parser , target log sequence After being processed by the log parser, a set of log templates is output. and log parameter sequence , and the process refers to formula (9).

[0065] (9) In formula (9), Represents a log template collection, Indicates the number of log templates. Generally, Indicates the length of the original log sequence, Indicates the first The log template corresponding to the target log; Represents a log parameter sequence, Indicates the first The log parameters corresponding to the target log. Any target log in , which must match the log template set A log template in can be expressed as ,in and Not necessarily the same, that is, multiple template logs may correspond to the same log template, but their parameters are different.

[0066] For example, the target log =“ dhcpoffer on 10.100.4.251 to 00:11:43:e3:ba:c3 via eth1 "Separated into =“ dhcpoffer on<*>to<*>via<*> ”, = (“ 10.100.4.251 ”, “ 00:11:43: e3:ba:c3 ”, “ eth1 ”).

[0067] When the original log sequence contains 4 original logs, the 4 target logs obtained after preprocessing and the 4 log parameters obtained by parsing can be referred to Figure 3 shown.

[0068] Based on the above Figure 1 In the method shown in FIG. 1 , in an exemplary embodiment, in step 103, the log parameter matrix and the log template matrix of the target log sequence are determined from the multiple initial word element vector matrices. The specific process in this embodiment can be achieved by Figure 4 Steps 301 and 302 are implemented as shown.

[0069] Step 301: Decompose each initial word unit vector matrix into an initial word unit template matrix and an initial word unit parameter matrix.

[0070] Step 302: Perform vector aggregation on a set of initial word-unit template vectors contained in each initial word-unit template matrix and a set of initial word-unit parameter vectors contained in each initial word-unit parameter matrix to obtain a log parameter matrix and a log template matrix.

[0071] Specifically, for the target log sequence Any target log in , can be based on the target log The log parsing results and the word segmentation results output by the pre-trained SBERT sub-model generate its binary mask vector ,in express h The first of the tokens k tokens belong to the log template, express h The first of the tokens k Tokens belong to log parameters. h Indicates the target log The number of tokens. Based on the binary mask vector Target Log The initial word element vector matrix Divide into vectors corresponding to log templates and vectors corresponding to log parameters, let They are the index collections of log template token and log parameter token respectively, where and .

[0072] Target Log The initial word element vector matrix Can be decomposed into the initial word template matrix and the initial word parameter matrix ;in, Here you can filter the target log by a feature filter. The initial word element vector matrix Extract the vector corresponding to the token representing the template and parameter, that is, extract the target log The initial word template matrix and the initial word parameter matrix .

[0073] Then the target log The initial word template matrix and the initial word parameter matrix They are processed separately, that is, the target log is pooled through the mean pooling layer. The initial word template matrix Aggregate into template vector , initial word parameter matrix Aggregate into parameter vector , respectively represent the target log The template information and parameter information of provide a more detailed feature representation for the subsequent network. The calculation formula of the mean pooling layer refers to Equation (10) and Equation (11).

[0074] (10) (11) Similarly, each target log in the target log sequence is processed in the above way to obtain the template vector and parameter vector corresponding to each target log, and then obtain the sequence-level log template matrix and the log parameter matrix .

[0075] Based on the above Figure 1 In the method shown in FIG. 1 , in an exemplary embodiment, in step 104, an overall anomaly detection is performed on the target log sequence based on the log template feature matrix. The specific process in this embodiment can be performed by Figure 5 Steps 401 to 404 are implemented as shown.

[0076] Step 401: Determine the attention weight vector of the target log sequence based on the query vector and the log template feature matrix.

[0077] Step 402: Perform Sofmax normalization on the attention weight vector, and aggregate all column vectors in the log template feature matrix based on the normalized attention weight vector to obtain the sequence feature column vector of the target log sequence. The sequence feature column vector is used to represent the overall sequence information of the target log sequence.

[0078] Step 403: Extract and merge the sequence feature column vectors according to the fully connected layer parameters to obtain a sequence anomaly real number representing the overall anomaly of the target log sequence.

[0079] Step 404: Map the sequence anomaly real number to a preset numerical range. The mapping result is the sequence anomaly probability of the target log sequence and is the overall anomaly detection result.

[0080] Specifically, the classification task sub-model provided by the present invention is a model obtained by jointly training the sequence anomaly detection task and the single log detection task. Specifically, the sequence anomaly detection task focuses on identifying the abnormal pattern of the target log sequence from a holistic perspective, and the single log detection task focuses on the local abnormal behavior of a single target log. Since the two tasks are highly correlated in the goal of anomaly detection, the present invention adopts a hard parameter sharing mechanism, that is, sharing parameters in the shallow feature extraction part of the model, and processing the two tasks separately through independent task heads in the deep layer, that is, the model is forced to infer a common feature representation that is applicable to both sequence anomaly detection and single log anomaly detection. The two detection tasks serve as each other's regularization terms, which improves the robustness of the feature space to changes in the semantic pattern of the log and effectively reduces the risk of overfitting of the model, thereby achieving collaborative optimization and resource sharing between tasks.

[0081] The following describes the detection process of the sequence detection task; considering that different log instances in a log sequence may contribute differently to the model decision, it is necessary to distinguish the importance of these log instances. Specifically, using the query vector and the log template feature matrix with context information , obtain the attention weight vector of the target log sequence , for the attention weight vector After the Softmax layer is normalized, the normalized attention weight vector is obtained. , and then use the normalized attention weight vector Aggregate log template feature matrix All column vectors in generate a single column vector representing the information of the entire target log sequence, that is, the sequence characteristic column vector of the target log sequence is obtained , and its calculation process can refer to formula (12).

[0082] (12) The sequence feature column vector The data is fed into two fully connected layers, and the rectified linear unit (RELU) function is used as the activation function. The sigmoid function is then used to map the output to between 0 and 1. The abnormal probability distribution of the entire sequence is output, that is, the sequence abnormality probability of the target log sequence is output. The entire process can be referred to in Equations (13) to (16).

[0083] (13) (14) (15) (16) In formulas (13) to (16), Indicates that the sequence feature column vector is processed according to the fully connected layer parameters Perform feature extraction and merging, and Represents the two weight matrices of the fully connected layer, and Represents the two bias vectors of the fully connected layer, 、 、 and are all fully connected layer parameters, represents the probability of sequence anomaly of the target log sequence; Represents the mapping function of the real number range, the preset value range is .

[0084] It should be noted that during the model training process, a randomly initialized query vector is introduced into the Attention Pooling module. The query vector is projected through a parameter-learnable projection matrix, which makes the query vector generalizable and is considered to be a query representation of which log instance is more important. Based on the above Figure 1 In the method shown in FIG. 1 , in an exemplary embodiment, in step 104, local anomaly detection is performed on the target log sequence based on the log template feature matrix and the log parameter matrix. The specific process in this embodiment can be achieved by Figure 6 Steps 501 to 503 are implemented as shown.

[0085] Step 501: Concatenate the log template feature vector corresponding to the target log in the log template feature matrix with the log parameter vector corresponding to the target log in the log parameter matrix to obtain a log feature concatenation vector of the target log.

[0086] Step 502: extract and merge the log feature concatenation vector according to the fully connected layer parameters to obtain a log anomaly real number representing the abnormality of the target log.

[0087] Step 503: Map the log anomaly real number to a preset value range. The mapping result is the log anomaly probability of the target log and is a local anomaly detection result.

[0088] Specifically, since the classification task sub-model provided by the present invention is obtained by jointly training the sequence anomaly detection task and the single log detection task, the detection process for the single log detection task will be described here, while the detection process for the sequence detection task has been described above.

[0089] After obtaining the log template feature matrix with context information , and the log parameter matrix In order to combine the parameters and template information, the log parameter vector corresponding to each target log can be and the log template feature vector Perform splicing to obtain the log feature splicing vector of the target log v , and the process can refer to formula (17).

[0090] (17) In formula (17), Represents a splicing operation, Indicates the dimension of the vector.

[0091] After that, the log feature concatenation vector of the target log is , and sent to two fully connected layers in sequence, using RELU as the activation function, and then using the Sigmoid function to map the output to between 0 and 1, outputting the abnormal probability distribution of a single target log, that is, outputting the log abnormality probability of the target log. The specific process can be referred to formula (18).

[0092] (18) In formula (18), Represents a mapping function for the range of real numbers, Indicates the first i The log anomaly probability of the target log, Indicates the concatenation vector of log features according to the fully connected layer parameters Perform feature extraction and merging; the preset value range is .

[0093] Repeat the above process to traverse all target logs in the target log sequence, thereby obtaining the log anomaly probability of each target log.

[0094] Based on the above Figure 1 In the method shown in FIG. 1 , in an exemplary embodiment, the final anomaly detection result of the target log sequence is determined based on the overall anomaly detection result and the local anomaly detection result in step 104. The specific process in this embodiment can be achieved by Figure 7 Steps 601 to 604 are implemented as shown.

[0095] Step 601: When the local anomaly detection result includes the log anomaly probability of each target log in the target log sequence, determine the abnormal logs in the target log sequence based on the size relationship between each log anomaly probability and a preset log anomaly probability threshold; wherein the preset log anomaly probability threshold is determined based on a dynamic threshold function.

[0096] Step 602: Determine a first anomaly detection result of the target log sequence based on a relationship between a ratio of abnormal logs in the target log sequence and a preset ratio threshold. The process of determining the first anomaly detection result is determined by a voting mechanism.

[0097] Step 603: When the overall anomaly detection result includes the sequence anomaly probability, determine a second anomaly detection result of the target log sequence based on a magnitude relationship between the sequence anomaly probability and a preset sequence anomaly probability threshold.

[0098] Step 604: Perform a logical OR operation on the first abnormality detection result and the second abnormality detection result to obtain a final abnormality detection result.

[0099] Specifically, in the inference phase, the classification task sub-model gives the final detection result by integrating the abnormal probabilities output by the two detection tasks. Define the indicator function As shown in formula (19).

[0100] (19) For the sequence detection task, the sequence anomaly probability of the target log sequence is , the abnormality judgment of the target log sequence can be expressed as , Represents the first anomaly detection result of the target log sequence. , it indicates that the task determines that the target log sequence is abnormal.

[0101] For a single log detection task, if a fixed threshold is used to determine anomalies for a single log, the probability of misjudgment (false positive) will accumulate as the length of the log sequence increases, leading to a sharp increase in the overall false alarm rate, affecting the stability and practicality of the system. For example, if the false positive rate of the model for a single log is only 1%, if a fixed threshold of 0.5 is used as the judgment standard, and any log in the sequence is considered abnormal, the entire sequence will be considered abnormal. As the sequence length increases, the false alarm rate of the entire sequence will increase significantly. Specifically, when the sequence length is 10, the overall false alarm rate is approximately , when the sequence length is 100, the overall false alarm rate is as high as about 63%. This phenomenon causes the false alarm rate to increase dramatically when processing long log sequences, seriously affecting the stability of the system and the actual application effect. To alleviate the above problem, a dynamic threshold function is introduced. The dynamic threshold function is specifically a probability threshold function , the abnormal judgment threshold of a single target log can be based on the probability threshold function Adjustment, probability threshold function The definition of is shown in formula (20).

[0102] (20) In formula (20), Indicates the maximum increase in the control threshold. Indicates the speed at which the control threshold rises.

[0103] No. i The abnormality judgment of a target log can be expressed as , Indicates that when the independent variable The value is The corresponding preset log anomaly probability threshold is Indicates the number of target logs in the target log sequence. When , it means that the task judges the target log sequence iThe target log is an abnormal log. Then a voting mechanism is introduced. When the proportion of abnormal logs in the target log sequence exceeds the preset ratio threshold, The target log sequence is considered abnormal only when , and the process can refer to formula (21).

[0104] (twenty one) In formula (21), Indicates the number of target logs in the target log sequence, represents the abnormal probability of the second sequence of the target log sequence, represents the first anomaly detection result of the target log sequence; when , it indicates that the task determines that the target log sequence is abnormal.

[0105] The final anomaly determination of the target log sequence is determined by the combination of two detection tasks, namely, ,in Represents a logical OR operation, represents the final anomaly detection result of the target log sequence; when , it means that the model finally determines that the target log sequence is abnormal.

[0106] It is understandable that from the perspective of software iteration, changes in log patterns are generally smooth, meaning that the differences in log patterns between versions are not excessive. Furthermore, descriptions of similar problems may also be similar between different software systems. Therefore, the model should be capable of knowledge retention and continuous learning. Existing technologies do not fully consider this issue and typically employ a full parameter update approach for the model. This means that each version of the software requires retraining the model and updating all parameters. At the same time, all parameters of the corresponding models for different software versions need to be saved for subsequent use. This approach not only consumes a large amount of computing power but also leads to the expansion of storage space, increasing maintenance costs and limiting its scalability and practicality in practical applications.

[0107] To address this issue, the present invention introduces the concept of efficient parameter updates to address the frequent updates of log systems and the demands of new application scenarios. This approach aims to leverage knowledge from existing models to quickly update models in new versions or with different log formats, rather than training all parameters from scratch. Existing technologies typically employ two traditional approaches: one is to fine-tune all parameters, which, while fully adaptable to new data, is computationally expensive; the other is to freeze the parameters of the feature extraction network and only update task-related modules. However, this can lead to performance degradation due to the inability to update key feature extraction network parameters.

[0108] The present invention realizes efficient parameter update based on the Adapter module, that is, two different Adapter modules (preset MLP-Adapter module and preset ATT-Adapter module) are inserted into each T-Encoder of the pre-trained SBERT sub-model. The insertion position and structure are as follows Figure 8 As shown in the figure, when the model is updated, only the parameters of the Adapter module and the task head are updated, while other network parameters remain frozen. The task head includes an attention pooling module and classifiers corresponding to the two detection tasks. Therefore, when the log anomaly detection model needs to be retrained to adapt to a new version or scenario, all parameters in the backbone network are frozen, and only the parameters of the inserted Adapter module and the two task heads are updated. This design significantly reduces the computational and storage costs of model updates, ensuring that the model can retain and utilize existing knowledge in new tasks. Furthermore, by dynamically loading different Adapter modules, plug-and-play multi-version support is achieved, reducing the model's storage costs.

[0109] Taking any log in the sample log sequence as an example, in the first training, the log will be directly input into the SBERT sub-model to obtain its initial word element vector matrix E When the model is updated, each T-Encoder in SBERT will introduce the above two Adapter modules, and the input log will be encoded into a new initial word element vector matrix E ', and then adopt the same training and inference strategies.

[0110] For each inserted preset MLP-Adapter module, the classic form of Adapter is used and the calculation method is shown in Equation (22).

[0111] (twenty two) In formula (22), represents the dimensionality reduction matrix and is used to reduce the dimension of the input vector, Represents the dimension-raising matrix and is used to restore the original dimension of the vector. Each preset MLP-Adapter module and the corresponding multi-layer perceptron (MLP) module are inserted in parallel. is the vector output after passing through the MHSA module, the preset ATT-Adapter and the normalization module. Its calculation process is shown in formula (23).

[0112] (twenty three) Parallel insertion provides the model with two feature transformation paths: one is the original multi-layer perceptron path, and the other is the adapter path specifically adjusted for new features. Fusing these two pieces of information can obtain richer and more robust feature representations.

[0113] Considering that MLP-Adapter may not be able to fully capture global dependencies and contextual semantics, and in order to maintain a higher consistency with the original model structure, this method adopts a low-rank decomposition strategy and proposes a preset ATT-Adapter module based on the low-rank strategy and attention mechanism. The calculation process is the same as formula (3) to formula (8). The key is that the parameter matrix of the mapping QKV and the final restored dimension in the preset ATT-Adapter module uses the dimension A low-rank matrix instead of ,in , compared with the original self-attention module, the number of parameters of each mapping matrix is A significant decrease Taking the SBERT sub-model output dimension of 768 as an example, when r=32 is selected, the number of parameters of each mapping matrix is ​​greatly reduced from the original 768×768 to 768×32, and the parameter reduction rate is as high as 95.83%.

[0114] Each preset ATT-Adapter module is inserted in series after the corresponding multi-head self-attention mechanism (MSHA) module. is the output of the previous layer T-Encoder, and its calculation process is shown in formula (24).

[0115] (twenty four) This design maintains the self-attention mechanism's advantage in capturing global semantics and dependencies while also allowing for only a small number of parameter updates during fine-tuning, thus striking a balance between update efficiency and performance. The MHSA module is responsible for capturing global dependencies and contextual semantics, while the pre-installed ATT-Adapter, inserted in series, further fine-tunes these global features. This insertion ensures that the ATT-Adapter only supplements and fine-tunes existing global features.

[0116] The preset MLP-Adapter (r=32) and ATT-Adapter (r=32) inserted into each T-Encoder layer require updates of approximately 0.58M and 1.18M, ​​respectively. The feature extraction layer requires approximately 124.55M parameters, and the task header requires approximately 2.36M parameters. Compared to full fine-tuning, the model update method proposed in this paper only requires (0.58 + 1.18 + 2.36) / (110 + 14.55 + 2.36) = 3.25% of the updated parameters.

[0117] The model is first pre-trained on the initial version of the software or a stable version. A full parameter update strategy is adopted, and all model parameters are saved. Subsequently, when the model is updated (such as with a software update), the feature extraction layer of the initial model is frozen, and only the parameters of the inserted adapter module and task header are updated. Since only the parameters of the adapter module and task header are updated, subsequent versions only need to save these incremental parameters, while the main parameters of the pre-trained model remain unchanged. This modular design allows the adapter to be independently replaced as a plug-in, enabling rapid switching between versions. In this way, the model significantly reduces the number of updated parameters and enables smooth migration between different software versions.

[0118] Reference Figure 9 The schematic diagram of the multi-task learning framework shown in Figure 9 In the , the feature extraction layer includes the pre-trained SBERT sub-model and the feature extraction sub-model. The pre-trained SBERT sub-model is Figure 9 The Sentence-BERT in the classification task sub-model is specifically Figure 9 There are two classifier modules and an attention pooling module in it.

[0119] The following combination Figure 9 , the training process of the log anomaly detection model is described in detail: First, a large amount of raw log data is collected from the target software system or other application software and preprocessed, and all the preprocessed logs are used as sample logs in a sample log sequence. The sample log sequence can be used for model training and can also be used for the model retraining process where parameters are efficiently updated. The preprocessing process involved can refer to the aforementioned embodiment and will not be repeated here.

[0120] Secondly, based on the preprocessing, a log parser is used to further parse each sample log in the sample log sequence. The log parser separates each sample log into a log template and log parameters, where the log template refers to the static part of the corresponding sample log, which is composed of fixed keywords; the log parameter refers to the dynamic part of the corresponding log, that is, the content marked by the mask tag; the parsing process involved can refer to the aforementioned embodiment; it will not be repeated here. The sample log sequence is then cut to construct input data acceptable to the model; the present invention adopts a cutting strategy with a fixed number of logs to cut the sample log sequence into multiple continuous non-overlapping log subsequences; that is, the cutting window size is set to n , the sample log sequence is divided into log subsequences, denoted as , among which i Log subsequences , the log subsequence is used as a sample of the model input; the sample log sequence is divided into multiple log subsequences containing a fixed number of logs as the input of the subsequent multi-task learning framework.

[0121] Then, the model is first trained on a labeled dataset. Each sample log in the sample log sequence is segmented and input into the pre-trained SBERT sub-model. The output of the last hidden layer before aggregation is taken to obtain the token-level vector representation of each sample log. Subsequently, a feature filter (i.e. Figure 9 Filter in ), extract the vectors corresponding to the tokens representing the template and parameters respectively. Mean Pooling operations are performed on the token-level vectors of the template and parameters respectively, aggregating the tokens of each log instance to generate the parameter vector and template vector for each sample log respectively. To introduce sequence position information, sine and cosine position encoding is used to encode the position information of the template vector. The template vector corresponding to each sample log in the corresponding sample log sequence is input into a two-layer Transformer encoder (T-Encoder) to capture the contextual dependencies within the sample log sequence. By stacking multiple layers of T-Encoders, the model can effectively capture long-distance dependencies in the sequence and enhance the expressiveness of features.

[0122] First i Log subsequences s i As an example, according to the feature extraction process described in the above embodiment, we get i The sample log parameter matrix of the log subsequences and the i The sample log template feature matrix of the sequence context information in the log subsequence is constructed. This enables the separate extraction of log sequence templates and parameters and the modeling of the contextual relationship between log sequence templates, providing high-quality input features for subsequent multi-task learning. The model will further combine the multi-task learning framework to jointly optimize the loss for different types of anomaly detection tasks, thereby improving detection accuracy and robustness.

[0123] Finally, this method designs two different levels of detection strategies for logs: 1. Sequence detection task: Globally aggregate the template information of the entire log sequence to achieve sequence-level anomaly detection; 2. Single log detection task: Simultaneously consider the template and parameter information of a single log instance to achieve fine-grained anomaly detection for a single log instance. By hard-sharing the underlying feature extraction module, the model is forced to learn a common feature representation that is applicable to both sequence anomaly detection and single instance anomaly detection. The two tasks serve as regularization terms for each other, improving the robustness of the feature space to changes in log semantic patterns and effectively reducing the risk of overfitting of the model. During training, both tasks use the cross-entropy loss function, and the model is trained end-to-end using a joint loss. The following describes the processing flow of the two task heads in detail.

[0124] Sequence detection task: At this point, the i The sample log parameter matrix of the log subsequences and the i The sample log template feature matrix of the sequence context information in the log subsequence , according to the above determination of the target log sequence i The log anomaly probability of target logs And the probability of sequence anomaly of the target log sequence The determination process can be obtained i The first log subsequence j The log anomaly probability of sample logs and i The probability of a sequence anomaly of log subsequences .

[0125] For a single log detection task, since a log subsequence contains n sample logs, the detection task will eventually output n Log predicted probability , the classification heads of the two detection tasks have their own independent parameters. During the training phase, the cross entropy loss function is used as the loss function for the two detection tasks, and the loss function for the sequence detection task is Refer to formula (25).

[0126] (25) Loss function for a single log detection task Refer to formula (26).

[0127] (26) In formula (25) and formula (26), Represents a sample log sequence The size of Indicates the first i The labels of the log subsequences, Indicates the first i The first log subsequence j The label of the sample log, 0 represents normal and 1 represents abnormal; Indicates the i The first log subsequence j The log anomaly probability of a sample log, Indicates the i The probability of a sequence being abnormal for a log subsequence.

[0128] In multi-task learning, the loss functions of different detection tasks may have different scales and difficulties. Directly using a fixed weight combination can easily lead to a certain task playing a dominant role in the overall loss during training. At the same time, the determination of the optimal weight also requires a lot of experiments. To alleviate this phenomenon, the present invention introduces uncertainty modeling, automatically learns the noise level of each task, and dynamically adjusts the weight of each task loss term in the joint loss. That is, introduces two positive learnable scalars and , represents the inherent uncertainty of each detection task, and the joint loss function of the two detection tasks Refer to formula (27).

[0129] (27) In formula (27), Represents the loss function for the sequence detection task The weight of Represents the loss function of a single log detection task The weight of As a regularization term, preventing and Approaches positive infinity to avoid weight approaching 0; and The initial value of is 1, which represents the assumption that the noise of the two detection tasks is balanced at the beginning.

[0130] The training process adopts a gradient update mechanism based on small batch samples. For each iteration, a batch is sampled from the log subsequences of the training set. This batch is input into the two subtasks of log sequence anomaly detection and log instance anomaly detection. The corresponding joint loss function value is calculated, and the Adam optimizer is used to update the model parameters based on the loss value.

[0131] After each iteration, the performance indicators of the current model on the validation set (such as F1-Score) are calculated, and an early stopping strategy is used. When the performance indicators do not improve significantly within several rounds, the model is considered to have converged, the training process is terminated, and the current model is saved as the final log anomaly detection model. Otherwise, the next batch is sampled from the training set and training continues until the training termination condition is met.

[0132] It should be noted that the training phase and the inference phase are consistent in processing flow, and both perform anomaly detection at the log instance level and the log sequence level on the input log sequence at the same time, and output the corresponding anomaly probability. The main difference between the two is that the training phase needs to calculate the joint loss based on the anomaly probabilities and sample labels output by the two subtasks to drive model parameter optimization and evaluate convergence; while the inference phase no longer performs parameter updates, but directly determines the final anomaly judgment output based on the detection results and inference strategies of the two subtasks. Therefore, compared with the prior art, the present invention has the following technical effects: (1) Multi-granularity structured semantic modeling: This method is based on the token-level representation capability of the pre-trained language model SBERT and combines it with the results of structured log parsing. After the complete log text is input into the model, the template and parameters are divided according to the token position and aggregated into vector representations. While maintaining the continuity of the context, it achieves fine-grained extraction of the log structure semantics. In this way, not only is the modeling capability of the potential dependency between templates and parameters enhanced, but also the fault tolerance and overall robustness of the model in the case of parsing errors are improved.

[0133] (2) Task-coordinated multi-perspective anomaly detection mechanism: This paper constructs log sequence detection and single log detection tasks, targeting the global behavior pattern of log sequences and the local semantics of single logs, respectively. The former only models the context structure based on template vectors, while the latter uses parameters and template vectors together to improve fine-grained recognition capabilities. The two tasks share a feature extraction module and are jointly trained, with the characteristics of structural orthogonality and semantic complementarity, significantly improving the comprehensiveness, accuracy and generalization ability of anomaly detection.

[0134] (3) Dual-task joint discrimination mechanism: To address the problem of false positives accumulating easily in long log sequences, this paper proposes a dynamic threshold adjustment mechanism based on sequence length, and performs joint judgment in combination with the abnormal log ratio, which effectively alleviates the propagation of false positives and improves the stability and applicability of the model in actual deployment environments.

[0135] (4) Efficient model updates: By introducing two lightweight modules, the parallel MLP-Adapter and the serial ATT-Adapter, into the main model, the main model parameters are kept frozen and only the Adapter and task header are updated, enabling rapid model iteration and adaptation. This structure offers the advantages of pluggability and portability, significantly reducing parameter update overhead and making it suitable for online deployment and long-term maintenance under the frequent evolution of software versions.

[0136] By combining the multi-task learning paradigm with an efficient parameter migration mechanism, the present invention provides a flexible, highly accurate, and robust log anomaly detection method, which is particularly suitable for complex scenarios with unstable log structures and frequent system evolution.

[0137] It should be noted that although the operations of the present method are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in that particular order, or that all of the illustrated operations must be performed to achieve the desired results. Rather, the steps depicted in the flowcharts may be performed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into a single step, and / or a single step may be broken down into multiple steps.

[0138] In one embodiment, the present invention further provides a log anomaly detection device, such as Figure 10 As shown, the log anomaly detection device includes: a word sequence determination unit 1001, a log feature extraction unit 1002 and a log anomaly detection unit 1003.

[0139] The word-gram sequence determining unit 1001 is configured to determine an initial word-gram sequence of each target log in the target log sequence.

[0140] The log feature extraction unit 1002 is used to input each initial word-meta sequence into the pre-trained SBERT sub-model in the log anomaly detection model, vectorize each initial word-meta sequence, and obtain an initial word-meta vector matrix corresponding to each initial word-meta sequence; input each initial word-meta vector matrix into the feature extraction sub-model in the log anomaly detection model, determine the log parameter matrix and log template matrix of the target log sequence from multiple initial word-meta vector matrices, and extract the context dependency within the target log sequence based on the log template matrix and the position information of the log template matrix to obtain a log template feature matrix containing sequence context information in the target log sequence.

[0141] The log anomaly detection unit 1003 is used to input the log template feature matrix, the target log sequence, and the log parameter matrix into the classification task sub-model in the log anomaly detection model, perform overall anomaly detection on the target log sequence based on the log template feature matrix, and at the same time, perform local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism; and determines the final anomaly detection result of the target log sequence based on the overall anomaly detection result and the local anomaly detection result.

[0142] In one embodiment, the log anomaly detection unit 1003 is specifically used to determine the attention weight vector of the target log sequence based on the query vector and the log template feature matrix; perform Softmax normalization on the attention weight vector, and aggregate all column vectors in the log template feature matrix based on the normalized attention weight vector to obtain a sequence feature column vector of the target log sequence, and the sequence feature column vector is used to characterize the overall sequence information of the target log sequence; perform feature extraction and merging on the sequence feature column vector according to the fully connected layer parameters to obtain a sequence anomaly real number that characterizes the overall anomaly of the target log sequence; map the sequence anomaly real number to a preset numerical range, and the mapping result is the sequence anomaly probability of the target log sequence and belongs to the overall anomaly detection result.

[0143] In one embodiment, the log anomaly detection unit 1003 is specifically used to splice the log template feature vector corresponding to the target log in the log template feature matrix and the log parameter vector corresponding to the target log in the log parameter matrix to obtain the log feature splicing vector of the target log; perform feature extraction and merging on the log feature splicing vector according to the fully connected layer parameters to obtain a log anomaly real number representing the abnormal situation of the target log; map the log anomaly real number to a preset numerical range, and the mapping result is the log anomaly probability of the target log and is a local anomaly detection result.

[0144] In one embodiment, the log anomaly detection unit 1003 is specifically configured to, when the local anomaly detection result includes the log anomaly probability of each target log in the target log sequence, determine the abnormal logs in the target log sequence based on the size relationship between each log anomaly probability and a preset log anomaly probability threshold; wherein the preset log anomaly probability threshold is determined based on a dynamic threshold function; determine a first anomaly detection result for the target log sequence based on the size relationship between the proportion of abnormal logs in the target log sequence and a preset proportion threshold; wherein the process of determining the first anomaly detection result is determined by a voting mechanism; when the overall anomaly detection result includes the sequence anomaly probability, determine a second anomaly detection result for the target log sequence based on the size relationship between the sequence anomaly probability and the preset sequence probability threshold; and perform a logical OR operation on the first anomaly detection result and the second anomaly detection result to obtain a final anomaly detection result.

[0145] In one embodiment, the log anomaly detection device provided by the present invention also includes a parameter efficient updating unit, which is used to, in response to a software version update instruction, insert each preset MLP-Adapter module into the corresponding Transformer encoder in parallel with the corresponding multi-layer perceptron module, and insert each preset ATT-Adapter module after the corresponding multi-head self-attention mechanism module and in series with the multi-head self-attention mechanism module when each Transformer encoder in the pre-trained SBERT sub-model includes a multi-head self-attention mechanism module and a multi-layer perceptron module, and the classification task sub-model includes an attention pooling module and a classifier module, to obtain an updated SBERT model; replace the pre-trained SBERT model with the updated SBERT model to obtain an updated log anomaly detection model; retrain the updated log anomaly detection model using a sample log sequence; the retraining includes parameter update training of the module parameters of each preset MLP-Adapter module, each preset ATT-Adapter module, the attention pooling module and the classifier module, and the parameter matrix in the preset ATT-Adapter module uses a low-rank matrix of a preset dimension; the retrained log anomaly detection model is used to perform log anomaly detection on the new target log sequence.

[0146] In one embodiment, the log feature extraction unit 1002 is specifically used to decompose each initial word unit vector matrix into an initial word unit template matrix and an initial word unit parameter matrix; perform vector aggregation on a set of initial word unit template vectors contained in each initial word unit template matrix and a set of initial word unit parameter vectors contained in each initial word unit parameter matrix to obtain a log parameter matrix and a log template matrix.

[0147] In one embodiment, the word-gram sequence determination unit 1001 is specifically used to preprocess the original log sequence collected from the target application software to obtain a target log sequence; wherein the preprocessing includes deleting empty logs and logs containing missing fields in the original log sequence, replacing special characters in the log with spaces and merging adjacent continuous spaces, and standardizing the content format in the log; each target log in the target log sequence is word-gram segmented to obtain an initial word-gram sequence for each target log.

[0148] It should be understood that the units recorded in the log anomaly detection device and the reference Figure 1 The various steps in the described method correspond to each other. Therefore, the operations and features described above for the method are also applicable to the log anomaly detection device and the units contained therein, and will not be repeated here. The log anomaly detection device can be pre-implemented in the browser or other security application of the computer device, or loaded into the browser or its security application of the computer device by downloading or other means. The corresponding units in the log anomaly detection device can cooperate with the units in the computer device to implement the solution of the embodiment of the present application.

[0149] Reference below Figure 11 , which shows a structural diagram of a computer system 1100 suitable for implementing a computer device or server of an embodiment of the present application.

[0150] like Figure 11 As shown, computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage unit 1108 into a random access memory (RAM) 1103. Various programs and data required for the operation of system 1100 are also stored in RAM 1103. CPU 1101, ROM 1102, and RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to bus 1104.

[0151] The following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, mouse, and the like; an output section 1107 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 1108 including a hard disk; and a communication section 1109 including a network interface card such as a LAN card or a modem. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. Removable media 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1110 as needed, so that computer programs read from the media can be installed in the storage section 1108 as needed.

[0152] In particular, according to the embodiments of the present application, the above reference Figure 1 The described processes may be implemented as computer software programs. For example, embodiments of the present application include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising instructions for executing Figure 1 In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 1109 and / or installed from the removable medium 1111 .

[0153] It should be noted that the computer-readable medium described herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical cable, RF, or any suitable combination thereof.

[0154] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code includes one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0155] The units or modules involved in the embodiments described in this application may be implemented in software or hardware. The units or modules described may also be provided in a processor. The names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0156] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the computer device described in the above embodiment, or may exist independently without being assembled into the computer device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the method described in the present application. For example, it can be executed Figure 1 The individual steps of the method are shown.

[0157] The present application embodiment provides a computer program product, which includes instructions. When the instructions are executed, the method described in the embodiment of the present application is executed. For example, you can execute Figure 1 The individual steps of the method are shown.

[0158] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0159] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features having similar functions disclosed in this application.

Claims

1. A log anomaly detection method, characterized in that: The method comprises: Determine an initial word sequence for each target log in the target log sequence; Input each of the initial word-gram sequences into the pre-trained SBERT sub-model in the log anomaly detection model, vectorize each of the initial word-gram sequences, and obtain an initial word-gram vector matrix corresponding to each of the initial word-gram sequences; Inputting each of the initial word element vector matrices into a feature extraction submodel in a log anomaly detection model, determining a log parameter matrix and a log template matrix of the target log sequence from the multiple initial word element vector matrices, and extracting context dependencies within the target log sequence based on the log template matrix and position information of the log template matrix to obtain a log template feature matrix containing sequence context information in the target log sequence; The log template feature matrix, the target log sequence, and the log parameter matrix are all input into the classification task sub-model in the log anomaly detection model. The target log sequence is subjected to overall anomaly detection based on the log template feature matrix. At the same time, the target log sequence is subjected to local anomaly detection based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism. The final anomaly detection result of the target log sequence is determined based on the overall anomaly detection result and the local anomaly detection result.

2. The method according to claim 1, characterized in that The performing overall anomaly detection on the target log sequence based on the log template feature matrix includes: Determining an attention weight vector of the target log sequence based on a query vector and the log template feature matrix; Performing Softmax normalization on the attention weight vector, and aggregating all column vectors in the log template feature matrix based on the normalized attention weight vector to obtain a sequence feature column vector of the target log sequence, where the sequence feature column vector is used to represent the overall sequence information of the target log sequence; Extract and merge the sequence feature column vectors according to the fully connected layer parameters to obtain a sequence abnormality real number representing the overall abnormality of the target log sequence; The sequence anomaly real number is mapped to a preset numerical range, and the mapping result is the sequence anomaly probability of the target log sequence and belongs to the overall anomaly detection result.

3. The method according to claim 2, characterized in that The performing local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix includes: Splicing the log template feature vector corresponding to the target log in the log template feature matrix with the log parameter vector corresponding to the target log in the log parameter matrix to obtain a log feature splicing vector of the target log; Perform feature extraction and merging on the log feature concatenation vector according to the fully connected layer parameters to obtain a log anomaly real number representing the abnormality of the target log; The log anomaly real number is mapped to a preset numerical range, and the mapping result is the log anomaly probability of the target log and belongs to the local anomaly detection result.

4. The method according to claim 3, characterized in that The determining of the final anomaly detection result of the target log sequence based on the overall anomaly detection result and the local anomaly detection result includes: In a case where the local anomaly detection result includes a log anomaly probability of each target log in the target log sequence, determining abnormal logs in the target log sequence based on a magnitude relationship between the anomaly probability of each log and a preset log anomaly probability threshold; wherein the preset log anomaly probability threshold is determined based on the dynamic threshold function; Determining a first anomaly detection result of the target log sequence based on a relationship between a proportion of the anomaly logs in the target log sequence and a preset proportion threshold; wherein the process of determining the first anomaly detection result is determined by the voting mechanism; In a case where the overall anomaly detection result includes the sequence anomaly probability, determining a second anomaly detection result of the target log sequence based on a magnitude relationship between the sequence anomaly probability and a preset sequence probability threshold; Performing a logical OR operation on the first abnormality detection result and the second abnormality detection result to obtain the final abnormality detection result.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: In the case where each Transformer encoder in the pre-trained SBERT sub-model includes a multi-head self-attention mechanism module and a multi-layer perceptron module, and the classification task sub-model includes an attention pooling module and a classifier module, In response to the software version update instruction, insert each preset MLP-Adapter module into the corresponding Transformer encoder in parallel with the corresponding multi-layer perceptron module, and insert each preset ATT-Adapter module after the corresponding multi-head self-attention mechanism module and in series with the multi-head self-attention mechanism module to obtain an updated SBERT model; The updated SBERT model replaces the pre-trained SBERT sub-model to obtain an updated log anomaly detection model; The updated log anomaly detection model is retrained using a sample log sequence; the retraining includes performing parameter update training on the module parameters of each of the preset MLP-Adapter modules, each of the preset ATT-Adapter modules, the attention pooling module, and the classifier module, and the parameter matrix in the preset ATT-Adapter module uses a low-rank matrix of a preset dimension; the retrained log anomaly detection model is used to perform log anomaly detection on a new target log sequence.

6. The method according to any one of claims 1 to 4, characterized in that The step of determining the log parameter matrix and the log template matrix of the target log sequence from the plurality of initial word element vector matrices includes: Decomposing each of the initial word unit vector matrices into an initial word unit template matrix and an initial word unit parameter matrix; Vector aggregation is performed on a group of initial word-unit template vectors contained in each of the initial word-unit template matrices and a group of initial word-unit parameter vectors contained in each of the initial word-unit parameter matrices to obtain the log parameter matrix and the log template matrix.

7. The method according to any one of claims 1 to 4, characterized in that Determining the initial word sequence of each target log in the target log sequence includes: Preprocessing the original log sequence collected from the target application software to obtain the target log sequence; wherein the preprocessing includes deleting empty logs and logs containing missing fields in the original log sequence, replacing spaces between special characters in the logs and merging adjacent continuous spaces, and standardizing the content format of the logs; Each target log in the target log sequence is segmented into word units to obtain the initial word unit sequence of each target log.

8. A log anomaly detection device, characterized in that: The device comprises: a word-gram sequence determination unit, configured to determine an initial word-gram sequence for each target log in the target log sequence; A log feature extraction unit is configured to input each of the initial word-meta sequence into a pre-trained SBERT sub-model in a log anomaly detection model, vectorize each of the initial word-meta sequence, and obtain an initial word-meta vector matrix corresponding to each of the initial word-meta sequence; input each of the initial word-meta vector matrices into a feature extraction sub-model in the log anomaly detection model, determine a log parameter matrix and a log template matrix of the target log sequence from the multiple initial word-meta vector matrices, and extract context dependencies within the target log sequence based on the log template matrix and position information of the log template matrix to obtain a log template feature matrix containing sequence context information in the target log sequence; The log anomaly detection unit is configured to input the log template feature matrix, the target log sequence, and the log parameter matrix into the classification task submodel in the log anomaly detection model, perform overall anomaly detection on the target log sequence based on the log template feature matrix, and simultaneously perform local anomaly detection on the target log sequence based on the log template feature matrix and the log parameter matrix. The local anomaly detection adopts a decision strategy combining a dynamic threshold function based on sequence length with a voting mechanism; and determine a final anomaly detection result for the target log sequence based on the overall anomaly detection result and the local anomaly detection result.

9. A computer device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the log anomaly detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the log anomaly detection method according to any one of claims 1 to 7 is implemented.

Images