Log anomaly detection method fusing log multi-feature time graph attention network

Abstract

According to an existing log anomaly detection method, log anomaly data imbalance and relevance between log features are often ignored, so that anomaly detection accuracy is low. In order to solve the problem, the invention provides a log anomaly detection method (LTGATLog) fused with a log multi-feature time graph attention network. According to the model, firstly, semantic information, log sequences and time structures of log data are extracted through a feature extraction module, relevance between log features is enhanced, a log time graph is constructed by adopting a module for constructing a relationship between log time sequences, attribute features of logs are captured, and space structure features of the logs are reserved. And then, a log time graph generation module is adopted to solve the problem that a detection result is unstable due to unbalanced log data in anomaly detection. And finally, performing anomaly detection on the log time graph by adopting a graph attention mechanism. Experimental results show that the LTGATLog model can effectively solve the problem of log data imbalance, the relevance of log data features is fully considered, and the omission ratio is effectively reduced. Experimental results on three common data sets of BGL, Thunderbit and HDFS show that the F1 Score of the LTGATLog model is up to 99.0%, the F1 Score of the LTGATLog model is up to 98.7%, and the F1 Score of the LTGATLog model is up to 98.1%.

Description

Technical Field

[0001] The present invention relates to the technical field of log anomaly detection. The present invention proposes a log anomaly detection model (LTGATLog) that integrates a log multi-feature temporal graph attention network. Background Art

[0002] In computer network security, log anomaly detection can detect anomalies in large logs, thereby protecting computer systems from external attacks. However, the proportion of abnormal data in logs is relatively small, resulting in an imbalanced data distribution and poor generalization of various deep learning-based anomaly detection models. Furthermore, log anomalies can typically be captured from a variety of features, such as semantic anomalies, execution path anomalies, and latency anomalies. However, existing methods fail to integrate temporal, semantic, and log sequence features, and ignore the relationship between log events, resulting in poor robustness of detection models. Summary of the Invention

[0003] The purpose of the present invention is to address the fact that existing log anomaly detection methods often ignore the imbalance of log anomaly data and the relationship characteristics between log features, resulting in high false alarm rates and missed alarm rates. To address these problems, the present invention proposes an anomaly detection method (LTGATLog) that integrates log time relationship features and log attribute features. The model extracts and integrates multiple features of the log through a hybrid log graph construction module, and constructs a log graph to enhance the correlation between log features. It balances abnormal nodes by designing a balanced log graph generation module, and finally performs anomaly detection through a graph log anomaly detection module to obtain rich spatial structure attributes, semantic information of the log, and time information between logs, effectively improving the accuracy of anomaly detection.

[0004] A log anomaly detection method integrating log multi-feature time graph attention network, characterized by comprising the following steps:

[0005] S1: Obtain application log data from the network security monitoring system, perform data preprocessing based on the log exploratory analysis method, and generate a sequence representation that conforms to log sequence modeling.

[0006] S2: Design a multi-head attention log sequence semantic learning model to obtain a low-dimensional log embedding representation vector.

[0007] S3: Design a log parser S i , by matching the log sequence with the event template, it is used to extract the event feature sequence in the log sequence.

[0008] S4: Design a log time distance calculation method. According to the log anomaly time interval threshold, calculate the time difference between logs and obtain the log time distance sequence.

[0009] S5: Based on the log semantic features, log event sequence and time structure features obtained in the previous steps, the fusion feature method is used to construct the log time series graph.

[0010] S6: Design a log multi-feature time graph attention anomaly detection model, which includes: feature input layer, graph attention embedding layer, and node representation learning layer. The features of the original nodes of the log graph ( ) as input, and the weights between them and their first-order neighbor nodes are learned through the self-attention mechanism. Then they are normalized by the Softmax function. Finally, the normalized attention weights are weightedly aggregated on the features of each node's first-order neighbor nodes to generate the embedded representation of each node in the Graph Attention Network (GAT).

[0011] This paper proposes a log anomaly detection model (LTGATLog) that integrates log multi-feature temporal graph attention networks. This model extracts and fuses multiple log features through a hybrid log graph construction module, constructs a log graph to enhance the correlation between log features, and balances abnormal nodes through a balanced log graph generation module. Finally, a graph log anomaly detection module performs anomaly detection, acquiring rich spatial structural attributes, semantic information about logs, and temporal information between logs, effectively improving the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 The overall structure of the LTGATLog model;

[0013] Figure 2 Comparison of Precision Values ​​of Each Model

[0014] Figure 3 Comparison of Recall values ​​of various models

[0015] Figure 4 F1 values ​​of different models under different imbalance ratios

[0016] Figure 5 Prediction of each model instance on HDFS dataset DETAILED DESCRIPTION

[0017] The present invention will be further described in detail below with reference to specific embodiments.

[0018] The log anomaly detection method described in this embodiment is a log multi-feature time graph attention network fusion method. Figure 1, its specific implementation is as follows:

[0019] All examples in this chapter are based on a laboratory hardware environment with an Intel(R) Xeon(R) Gold6154 CPU, 256 GB of computer memory, and a Quadro RTX 6000 graphics card. The experimental environment framework uses PyTorch, Python 3.8.1, and CUDA version 11.1.

[0020] (1) Input log sequence L i = <Log1,Log2,Log3,Log4,…,Log n >, is the number of logs;

[0021] (2) Extraction of L i Log semantic information

[0022] (3) Using a log parser , extract L i Log sequence characteristics

[0023] By matching the parsed original log sequence with the event template, the corresponding event sequence can be obtained. .

[0024] (4) Extraction of L i Log time structure information

[0025] The time series in the log consists of the timestamps in the log entries, represented as (p represents the total number of words in the log message), and calculate the difference between them to generate a time difference set: , where k and j represent the kth and jth log entries. The final set of log time differences is obtained, and a logarithmic transformation is used to amplify small differences and compress large differences, thereby better capturing changes in a short period of time and compressing large differences into a smaller range.

[0026] (5) Constructing a log graph

[0027] Log graph construction constructs the extracted log semantic features, log event sequence and time structure features into a log graph, denoted as , where V represents the log node set of the input network, corresponding to each log in the log sequence. log represents the node feature set, corresponding to the log semantic vector. is the set of edge weights, representing the edge The time difference of the corresponding log node. E represents the set of edges , that is, the log event sequence S Seq In the example, the event Sj following the event Si corresponds to a pair of log nodes. For log sequences, the order relationship between log events is usually an important indicator of normality or abnormality. The log graph construction module generates edges according to the log execution order, thereby capturing the log execution path through the graph structure. See Appendix Figure 1 .

[0028] (6) Randomly initialize the feature extractor, edge generator, and node classifier.

[0029] First, the features of the original nodes in the log graph ( ) as input and learn the weights between it and its first-order neighbor nodes through the self-attention mechanism. It is then normalized by the Softmax function. Finally, the normalized attention weights are weightedly aggregated on the features of each node's first-order neighbor nodes to generate the embedded representation of each node in the Graph Attention Network (GAT).

[0030] The input of the feature extractor is a set of node features of the log graph G , where N is the number of nodes, and the output is a set of new features of nodes, .

[0031] By taking the weighted sum of neighbor nodes as a method, new features are generated. After feature extraction, the embedded representation of each node in GAT can be obtained. .

[0032] Set log a For the abnormal log node with label 0. First find a The nearest neighbor nodes of the same category are then used to generate synthetic nodes. . A hyperparameter is used to control the amount of samples that need to be generated. After synthesizing the node, the corresponding timestamp features of the synthesized node are calculated using the original timestamp to generate the edge weight. The edge generator is trained on real nodes and existing edges to predict the adjacency information of those synthesized nodes. These new nodes and edges are then added to the initial adjacency matrix A as input to the classifier. The edge generator implements this edge generator through weighted inner product. For the synthesized node 𝑣′, the edge generator uses soft edges instead of binary edges.

[0033] (7) Abnormal node classification.

[0034] The embedding similarity of the logs is calculated by calculating the dot product of the transformed node vectors in the graph. In order to achieve adaptive linear combination of node features, highlight the information of important nodes, and weaken the influence of unimportant nodes, so as to improve the representation ability of the log graph, the log time features are integrated into the constructed log time graph by combining the time interval information, capturing the temporal structure relationship in the log, calculating the time interval of the log and projecting it into the graph embedding space, see the appendix. Figure 1 After calculating the semantic similarity and time interval between logs, the semantic similarity and time interval The attention results are added together, and then the tanh activation function is used to obtain the joint weight when the nodes are aggregated. Finally, the softmax layer is input for anomaly detection. In the model training stage, the cross entropy loss function is used. The edge prediction loss and the node classification loss are trained together, that is, using to update the model.

[0035] (8) Return the feature extractor, edge generator, and node classifier modules.

[0036] Performance Analysis

[0037] To verify the anomaly detection performance of the LTGATLog model under different balancing strategies, the model's parameter count is primarily determined by the Graph Attention Network (GAT) layer, the feature extraction module, and the log graph construction module. Because the GAT layer uses a self-attention mechanism, the model's parameter count is linearly proportional to the number of nodes and edges in the graph, significantly reducing the model's parameter count and improving its computational efficiency.

[0038] In the balanced log graph generation module, the time complexity of the GAT feature extractor depends primarily on the number of nodes N and edges E in the graph. For each node, GAT calculates the attention coefficient between it and its neighboring nodes. If the GAT network has L layers, the total time complexity is O(LE). The time complexity of the degree matrix node generator depends on the number of new nodes generated. If the number of new nodes generated is M, the time complexity is approximately O(M). In addition, the time complexity of the edge generator depends on the number of existing edges E in the graph and the number of newly generated edges M. The total time complexity is O(E + M).

[0039] Taking all factors into consideration, the overall time complexity of the balanced log graph generation module is O(LE + 2M + E). L, E, and M represent the number of GAT layers, the number of edges in the graph, and the number of new nodes and edges generated, respectively. Table 2 shows the performance analysis of anomaly detection on 10,000 HDFS logs using the same hardware configuration.

[0040] Time consumption of different models

[0041] Table 6 Different Model Time Consumption

[0042] Model Number of logs time consuming Deeplog 10000 1m52s LogAnomaly 10000 2m57s LogGD 10000 3m10s LTGATLog 10000 3m4s

[0043] Compared to traditional log anomaly detection methods, graph-based log anomaly algorithms require more time but have higher accuracy. Furthermore, compared to LogGD, LTGATLog further improves processing speed through optimized graph construction and feature processing.

[0044] In order to verify the anomaly detection performance of LTGATLog when the log anomaly ratio is unbalanced, this paper compares it with 8 groups of comparative experiments to verify the performance of different algorithms under different imbalance rates in order to evaluate the robustness of the model. Since the HDFS dataset is grouped by identifier, this part of the experiment is only conducted on the BGL and Thunderbird datasets. By selecting different continuous log sequences, the anomaly rates are set to {0.07%, 0.14%, 0.5%} and {0.47%, 0.99, 1.37%} respectively, and the oversampling ratio is set to 0.8. 25 comparative experiments are conducted on the same dataset and the average effect is taken. Bold fonts represent the best results under the same indicators, see the appendix. Figure 4 .

[0045] In order to verify the log anomaly detection performance of the LTGATLog model, two machine learning methods SVM[2] and PCA[3], six advanced deep learning methods DeepLog

[13] , LogRobust[5], LogAnomaly[4], LogBERT

[14] , NeuralLog[7], LogGD[8] and the model TRGATLog proposed in Chapter 3 were used as baseline models for comparative experiments. 25 comparative experiments were conducted on the BGL, Thunderbird and HDFS datasets. The anomaly ratios of the three datasets were 0.070%, 0.47% and 2.93% respectively. The oversampling ratio was set to 0.8 and the average effect was taken. The method of generating log sequences was the same as in Chapter 3. The session window method was used on the BGL and HDFS datasets to group log messages by the same block ID because both datasets are marked by blocks. For the Thunderbird dataset, a fixed window was selected instead of a session or sliding window to group the log sequences. The fixed window size of the input data was set to 100 logs. The experimental results can be found in the Appendix. Figure 2 、 3 、4.

[0046] The above-described embodiments are only preferred embodiments of the present invention and are not intended to limit the scope of implementation of the present invention. Therefore, any changes made based on the shape and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A log anomaly detection method integrating log multi-feature temporal graph attention network (LTGATLog), characterized by: The following steps are involved: S1: Obtain application log data from the network security monitoring system, perform data preprocessing based on the log exploratory analysis method, and generate a sequence representation that conforms to log sequence modeling. S2: Design a multi-head attention log sequence semantic learning model to obtain a low-dimensional log embedding representation vector. S3: Design a log parser to extract event feature sequences from log sequences by matching them with event templates. S4: Design a log time distance calculation method. According to the log anomaly time interval threshold, calculate the time difference between logs and obtain the log time distance sequence. S5: Based on the log semantic features, log event sequence and time structure features obtained in the previous steps, the fusion feature method is used to construct the log time series graph. . S6: Design an anomaly detection model that integrates log multi-feature temporal graph attention. The model consists of a feature input layer, a graph attention embedding layer, and a node representation learning layer. The features of the original nodes in the log graph are used as input, and the weights between them and their first-order neighbor nodes are learned through a self-attention mechanism. This is then normalized using a softmax function. Finally, the normalized attention weights are weightedly aggregated with the features of each node's first-order neighbor nodes to generate an embedded representation of each node in the graph attention network. .

2. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 1), log data is obtained from the monitoring system. According to the log exploratory analysis method, data analysis is performed on a large amount of log data, log feature selection, log feature extraction and simple feature selection and feature extraction are performed to generate log sequences.

3. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 2), log semantic information is extracted. Each log message is encoded into a vector representation with a fixed dimension.

4. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 3), design the log parser , mapping log events to log templates. The log parser is used to extract log sequence features. By matching the parsed original log sequence with the event template, the corresponding event sequence can be obtained.

5. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 4), the time series in the log is composed of the timestamps in the log entries. In order to extract the log time features as the edge weights for constructing the log time graph, the timestamps of the two log entries corresponding to all edges are traversed and the difference between them is calculated to generate a time difference set. In addition, the present invention uses a logarithmic transformation to amplify small differences and compress large differences, thereby better capturing changes in a short period of time and compressing large differences into a smaller range.

6. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 5), a log graph is constructed based on the log event sequence and log time distance features obtained in the previous steps. The log graph construction module constructs the extracted log semantic features, log event sequence, and time structure features into a log graph corresponding to each log in the log sequence.

7. The log anomaly detection method integrating log multi-feature temporal graph attention network according to claim 1 is characterized by: In step 6, a log-multi-feature temporal graph attention anomaly detection model is designed. First, the features of the original node in the log graph are taken as input. The self-attention mechanism learns the weights between the nodes and their first-order neighbor nodes. Then, the features are normalized using the Softmax function. Finally, the normalized attention weights are weightedly aggregated with the features of each node's first-order neighbor nodes to generate an embedded representation of each node in the graph attention network. The input of the feature extractor is a set of node features of the log graph, and the output is a set of new features of the nodes.

Images