Automatic log analysis and operation and maintenance decision-making method based on large model

Abstract

The invention discloses an automatic log analysis and operation and maintenance decision-making method based on a large model, and relates to a data processing technology, and the method comprises the following steps: extracting a key entity in an unstructured log text by using a regular expression; and for the structured time sequence operation and maintenance data, extracting the time sequence operation and maintenance data by using a sliding window; inputting the unstructured log text into a text encoder; inputting the sliding time sequence operation and maintenance data into a time sequence encoder; adding marks for the log features and the time sequence index features by using the extracted key entities; realizing cross-modal feature alignment by using a contrast loss function; the aligned features are endowed with bidirectional attention weights based on cosine similarity, so that cross-modal context features are obtained; and inputting a pre-trained large model based on the cross-modal context features and the marks to output an operation and maintenance decision scheme. According to the method, the large model can understand the relationship between the log and the actual running state of the system, and the decision accuracy of the large model is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the fields of massive log analysis and data processing, and in particular to a log automatic analysis and operation and maintenance decision-making method based on a large model. BACKGROUND

[0002] At present, log anomaly detection technology mainly relies on machine learning and deep learning methods. Machine learning methods identify normal and abnormal log patterns by training models. Although log anomaly detection technology has made some progress, existing log anomaly detection still faces problems such as data instability, data imbalance, anomaly diversity, label availability, real-time requirements, big data processing, log parsing and feature extraction, model interpretability, unknown log emergence, and data enhancement methods.

[0003] Traditional time series prediction methods (such as linear regression) study the linear relationship of data, but cannot learn and display non-linear relationships such as periodicity in the prediction results; statistical prediction methods consider the periodicity of data and study the linear relationship between data points, but cannot capture non-linear relationships; deep learning prediction methods can capture non-linear relationships between data points, but the interpretability and robustness of the model are questionable. Therefore, it is necessary to select a suitable prediction method for index data with different characteristics to improve prediction accuracy and efficiency. SUMMARY

[0004] The embodiments of the present application provide a log automatic analysis and operation and maintenance decision-making method based on a large model, which aligns unstructured log text and structured time series operation and maintenance data across modalities, so that the large model can understand the relationship between logs and the actual running state of the system, and improve the decision-making accuracy of the large model.

[0005] The embodiments of the present application provide a log automatic analysis and operation and maintenance decision-making method based on a large model, which aligns unstructured log text and structured time series operation and maintenance data across modalities, so that the large model can understand the relationship between logs and the actual running state of the system, and improve the decision-making accuracy of the large model. Obtain unstructured log text and structured time series operation and maintenance data of a target system; Extract key entities in the unstructured log text using regular expressions, and for structured time series operation and maintenance data, extract time series operation and maintenance data using a sliding window; Input the unstructured log text into a text encoder to obtain log features, and input the extracted time series operation and maintenance data into a time series encoder to output time series index features; Add labels to the log features and time series index features using the extracted key entities; Use a contrastive loss function to minimize the cosine distance between log features and time series index features of the same timestamp, and maximize the distance between features of different timestamps, to achieve cross-modal feature alignment; The aligned features are given bidirectional attention weights based on cosine similarity to obtain cross-modal context features; Based on the cross-modal context features and the labels, a pre-trained large model is input to output an operation and maintenance decision scheme.

[0006] Optionally, it further comprises: Obtain system environment variables; Encode the obtained system environment variables into dynamic context features; Concatenate the dynamic context features with the cross-modal context features and input them into the large model.

[0007] Optionally, encoding the obtained system environment variables into dynamic context features comprises: Preconfigure a basic weight for each system environment variable; Process the obtained system environment variables using a Gated Recurrent Unit (GRU) to obtain dynamic context features, wherein the GRU is configured to trigger the fusion ratio relationship of the update gate and the reset gate of the GRU to update the environment state encoding of the GRU in the case that the system environment state changes or the change amount of the system environment feature is greater than a preset threshold.

[0008] Optionally, updating the environment state encoding of the GRU further comprises: Calculate the importance of the model parameters to lock the core parameters and update the associated parameters: wherein, the importance of the current model parameter is calculated from the diagonal elements of the Fisher information matrix, the previous optimal model parameter, i the model parameter ordinal number, the update coefficient; According to the calculated importance, only the parameters of the fully connected layer of the GRU are updated.

[0009] Optionally, the text encoder is implemented based on BERT, and the time series encoder adopts a one-dimensional convolution (1D-CNN) + Transformer encoder structure, wherein the 1D-CNN extracts local time series patterns and the Transformer encoder performs time series encoding.

[0010] Optionally, the contrast loss function satisfies: wherein, the contrast loss is used to make the model learn the semantic alignment of cross-modal, the cosine similarity, , log features and time series indicator features, hyperparameters, indicator features of different timestamps, and N is a batch size; based on the contrast loss function to perform cross-modal semantic alignment.

[0011] Optionally, the aligned features are assigned bidirectional attention weights based on cosine similarity, including: According to the aligned features, the cross-modal relationship is quantified by a cosine similarity matrix; The quantified cross-modal relationship is normalized based on softmax to assign bidirectional attention weights; Cross-modal feature fusion is completed through bidirectional attention weights to obtain cross-modal context features.

[0012] Optionally, the dynamic context features and the cross-modal context features are spliced and input into the large model, further including: The spliced features are assigned the labels as inputs of the pre-trained large model.

[0013] Optionally, it further includes: obtaining historical operation and maintenance decision schemes output by the large model; constructing decision nodes based on each of the historical operation and maintenance decision schemes; determining the decision nodes contained in any key entity, and clustering the corresponding log features and time series indicator features based on the decision frequency of each decision node; For any subsequent operation and maintenance decision of a key entity, the spliced features are assigned labels according to the clustering results to input the large model.

[0014] The method of the embodiments of the present application utilizes a contrast loss function to minimize the cosine distance between log features and time series indicator features of the same timestamp, and maximize the distance between features of different timestamps. The unstructured log text and structured time series operation and maintenance data are aligned and fused across modalities, so that the large model can understand the relationship between the log and the actual running state of the system, and improve the decision accuracy of the large model.

[0015] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the embodiments of the present application can be implemented according to the content of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0016] ​Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments with reference made to the accompanying drawings. The drawings are for purposes of illustration only and are not intended to limit the present application thereto, as the present application can have additional forms that fall within the scope of the same. Like reference numerals indicate like elements throughout the drawings. In the drawings: Figure 1 The basic flow of the log automatic analysis and operation and maintenance decision method based on a large model of the present embodiment is shown in the following figure. DETAILED DESCRIPTION

[0017] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are shown. It is to be understood that the present disclosure can assume various forms and should not be limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0018] The present embodiment proposes a log automatic analysis and operation and maintenance decision method based on a large model, as shown in the following figure, which includes the following steps. Figure 1 In step S101, unstructured log text and structured time sequence operation and maintenance data of a target system are obtained. For example, in some examples, the unstructured log text includes some description logs or error description logs, and the structured time sequence operation and maintenance data includes real-time CPU / memory indicators, etc.

[0019] In step S102, regular expressions are used to extract key entities in the unstructured log text, and sliding windows are used to extract time sequence operation and maintenance data. In some embodiments, the extracted key entities may, for example, include service names, error codes, etc., and specific reference can be made to Fluentd log parsing rules (Fluentd is an open source data collection and log aggregation tool with a series of rules to parse and process log data).

[0020] In step S103, the unstructured log text is input into a text encoder to obtain log features, and the extracted time sequence operation and maintenance data is input into a time sequence encoder to output time sequence indicator features. In some embodiments, the text encoder is implemented based on BERT, and the time sequence encoder adopts a one-dimensional convolution 1D-CNN+Transformer encoder structure, in which the 1D-CNN extracts local time sequence patterns and the Transformer encoder performs time sequence encoding. In a specific example, the extracted time sequence operation and maintenance data (such as CPU / memory) is standardized and then input into the time sequence encoder.

[0021] ​In step S104, the extracted key entities are used to add labels to the log features and the time series indicator features. In a specific example, by adding the labels of the key entities, the key entities can be combined in subsequent applications to determine the decision-making situation under the corresponding key entities, thereby feeding back to the large model and improving decision-making efficiency.

[0022] In step S105, a contrastive loss function is used to minimize the cosine distance between the log features and the time series indicator features of the same timestamp, and to maximize the distance between the features of different timestamps, so as to achieve cross-modal feature alignment, thereby associating, for example, the "memory overflow" text with the real-time memory usage peak.

[0023] In step S106, the aligned features are given bidirectional attention weights based on cosine similarity to obtain cross-modal context features.

[0024] In step S107, the cross-modal context features and the labels are input into a pre-trained large model to output an operation and maintenance decision scheme. In some examples, the large model can be pre-trained, and basic log analysis and processing scheme decision knowledge can be input into the large model, so that the large model is adapted to the log analysis field.

[0025] The method of the embodiments of the present application uses a contrastive loss function to minimize the cosine distance between the log features and the time series indicator features of the same timestamp, and to maximize the distance between the features of different timestamps, to align and fuse the non-structured log text and the structured time series operation and maintenance data in a cross-modal manner, so that the large model can understand the relationship between the log and the actual operation state of the system, and improve the decision-making accuracy of the large model. The scheme of the present application is particularly suitable for massive log data analysis scenarios, can quickly give a decision scheme, and improves the operation and maintenance efficiency of the large system.

[0026] In some embodiments, the method further comprises: Obtaining system environment variables, in a specific example, the system environment variables can include service topology, resource quota, version number, etc. Such variables do not belong to non-structured logs or time series operation and maintenance data, but in actual system operation environment, there are also variables that may change.

[0027] The obtained system environment variables are encoded as dynamic context features. The prior art does not consider or associate system environment variables, and the present application encodes them as dynamic context features, so that the large model further considers the changes of the system environment variables in decision-making, and improves the consideration and pertinence of the large model to the system environment changes.

[0028] The dynamic context features and the cross-modal context features are concatenated and input into the large model.

[0029] Different from the time series operation data, the system environment variables are not always changing, but only change at some time. In some embodiments, the non-negligible change of the system environment variables is encoded into the dynamic context features, including: The base weight is configured for each system environment variable in advance. In a specific example, the system environment variable may have a range of influence, but the frequency of change is not high. This example integrates each system environment variable and configures the base weight according to the actual possible influence, and further cooperates with the update mode of GRU to effectively adapt to the change of such environment variables.

[0030] The obtained system environment variable is processed by a gated recurrent unit GRU, for example, a resource quota change sequence is processed by a GRU to obtain a dynamic context feature, wherein the GRU is configured to update the fusion ratio relationship of the update gate and the reset gate of the GRU when the system environment state changes, or the change amount of the system environment feature is greater than a preset threshold, for example, the system environment feature Δenv=||envnew-envold||2, if Δenv> threshold θ, the update of the environment state code of the GRU is triggered.

[0031] In some embodiments, updating the environment state code of the GRU further includes: Calculating the importance of the model parameter to lock the core parameter and update the associated parameter: Wherein, The importance of the current model parameter is calculated by the diagonal element of the Fisher information matrix, The previous optimal model parameter, i The model parameter ordinal, The update coefficient, in this way, the core variable of the system environment variable can be focused on, and the elastic weight solidification can be realized, which is especially suitable for the introduction of the system environment variable with low change frequency, thereby improving the comprehensiveness of the large model decision.

[0032] According to the calculated importance, only the parameters of the fully connected layer of the GRU are updated. In a specific example, the updated parameters only account for about 10% of the total parameters, avoiding full model retraining, which can greatly reduce the consumption of computing resources.

[0033] In some embodiments, the contrast loss function satisfies: Wherein, For the contrastive loss, to make the model learn the semantic alignment across modalities, For the cosine similarity, , are the log features and the time series indicator features, respectively, are hyperparameters, for controlling the smoothness of the similarity distribution, are the indicator features at different timestamps, and N is the batch size.

[0034] Based on the contrastive loss function, the cross-modal semantic alignment is performed.

[0035] In some embodiments, assigning the aligned features bidirectional attention weights based on the cosine similarity includes: quantifying the cross-modal relationship through a cosine similarity matrix based on the aligned features; normalizing the quantified cross-modal relationship based on softmax to assign bidirectional attention weights; completing cross-modal feature fusion through bidirectional attention weights to obtain cross-modal context features.

[0036] In a specific example, bidirectional cross-attention, which contains two directions: from log features to time series features and from time series features to log features. The weights are calculated based on cosine similarity, and the attention mechanism needs high similarity to correspond to high weights, which can be converted to similarity based on the aforementioned cosine distance. Define the cosine similarity: for any log feature vector Li and time series feature vector Tj , the cosine similarity is: where ⋅ denotes the dot product, and ||·||2 denotes the L2 norm.

[0037] Construct a similarity matrix A∈ , where each element . represents the similarity between the log feature at timestamp and the time series feature at timestamp . Based on the similarity matrix A, assign weights to each feature vector to generate a representation of the cross-modal context features.

[0038] In some embodiments, after concatenating the dynamic context features and the cross-modal context features, inputting the concatenated features into the large model further includes: assigning the concatenated features the labels as inputs of the pre-trained large model. The specific labels can be key entities or associated entities.

[0039] ​In some embodiments, further comprising: Obtaining historical operation and maintenance decision schemes of the large model output, that is, in specific examples, the historical operation and maintenance decision schemes of the large model output can be recorded.

[0040] Based on each of the historical operation and maintenance decision schemes, a decision node is constructed, in specific examples, one decision scheme can be used as one decision node, for nodes with certain association, edges can be used for connection, to construct a class undirected graph, and the labels of each key entity are added to the class undirected graph, so that the involved decision nodes are highlighted in the case that any key entity is selected.

[0041] Determine the decision nodes contained in any key entity, and cluster the corresponding log features and time series index features based on the decision frequency of each decision node. In specific examples, for nodes with certain association, edges can be used for connection, and the corresponding edges are used to represent the log features and time series index features commonly contained in the decision nodes, and through clustering, the main role features under the decision can be retained.

[0042] For any subsequent operation and maintenance decision of a key entity, the spliced features are labeled according to the clustering results, which are used as input to the large model. The first few features with the largest clustering proportion for any key entity can be taken as labels or prompts to input the large model, so as to prompt the analysis direction of the large model and improve the decision accuracy of the large model.

[0043] In addition, although the exemplary embodiments have been described herein, the scope thereof includes any and all embodiments having equivalent elements, modifications, omissions, combinations (for example, solutions cross various embodiments), adaptations, or alterations based on the disclosure. Not limited to the examples described in the specification or during the implementation of the application, the examples will be interpreted as non-exclusive.

[0044] The above description is intended to be illustrative rather than limiting. For example, the above examples (or one or more solutions thereof) can be used in combination with each other. For example, other embodiments can be used by those of ordinary skill in the art upon reading the above description.

[0045] The above embodiments are only exemplary embodiments of the disclosure, and those skilled in the art can make various modifications or equivalent replacements to the present application within the spirit and protection scope of the disclosure, and such modifications or equivalent replacements shall also be considered to fall within the protection scope of the present application.

Claims

1. A large-scale model-based log automatic analysis and operation and maintenance decision-making method, characterized by: include: Obtain unstructured log text and structured time-series operation and maintenance data of the target system; Extracting key entities from the unstructured log text using regular expressions; And, for structured time series operation and maintenance data, use sliding windows to extract time series operation and maintenance data; Input the unstructured log text into the text encoder to obtain log features; and, inputting the sliding time series operation and maintenance data into a time series encoder to output time series indicator features; Use the extracted key entities to add tags to log features and time series indicator features; Using the contrast loss function, the cosine distance between the log features and the time series indicator features of the same timestamp is minimized, and the distance between the features of different timestamps is maximized to achieve cross-modal feature alignment; The aligned features are assigned bidirectional attention weights based on cosine similarity to obtain cross-modal context features; Based on the cross-modal context features and labels, a pre-trained large model is input to output an operation and maintenance decision plan.

2. The large model-based log automatic analysis and operation and maintenance decision-making method according to claim 1 is characterized in that: Also includes: Get system environment variables; Encode the obtained system environment variables into dynamic context features; The dynamic context features and cross-modal context features are concatenated and input into the large model.

3. The large model-based log automatic analysis and operation and maintenance decision-making method according to claim 2 is characterized in that: Encoding acquired system environment variables into dynamic context features includes: Pre-configure basic weights for each system environment variable; The acquired system environment variables are processed using a gated recurrent unit (GRU) to obtain dynamic context features, wherein the GRU is configured to trigger an update of a fusion ratio relationship between an update gate and a reset gate of the GRU when the system environment state changes or the change in the system environment features is greater than a preset threshold, so as to update the environment state encoding of the GRU.

4. The method for automatic log analysis and operation and maintenance decision-making based on a large model as claimed in claim 3 is characterized in that: Updating the environmental state encoding of the GRU further includes: Calculate the importance of model parameters to lock the core parameters and update the associated parameters: in, is the current model parameter The importance of is calculated by the diagonal elements of the Fisher information matrix, are the prior optimal model parameters, i is the ordinal number of the model parameter, is the update coefficient; Based on the importance of the calculation, only the parameters of the fully connected layer of the GRU are updated.

5. The method for automatic log analysis and operation and maintenance decision-making based on a large model according to claim 1, characterized in that: The text encoder is implemented based on BERT, and the temporal encoder adopts a one-dimensional convolution 1D-CNN+Transformer encoder structure, where 1D-CNN extracts local temporal patterns and the Transformer encoder performs temporal encoding.

6. The method for automatic log analysis and operation and maintenance decision-making based on a large model according to claim 3 is characterized in that: The contrast loss function satisfies: in, is the contrast loss, which is used to enable the model to learn cross-modal semantic alignment. is the cosine similarity, 、 They are log features and time series indicator features respectively. is a hyperparameter, For Indicator features at different timestamps, N is the batch size; Cross-modal semantic alignment is performed based on the contrastive loss function.

7. The method for automatic log analysis and operation and maintenance decision-making based on a large model according to claim 6, characterized in that: The aligned features are assigned bidirectional attention weights based on cosine similarity, including: Based on the aligned features, the cross-modal relationship is quantified using the cosine similarity matrix; Normalize the quantified cross-modal relationship based on softmax to assign bidirectional attention weights; Cross-modal feature fusion is accomplished through bidirectional attention weights to obtain cross-modal contextual features.

8. The method for automatic log analysis and operation and maintenance decision-making based on a large model according to claim 7, characterized in that: The concatenation of dynamic context features and cross-modal context features into a large model also includes: The concatenated features are assigned the labels to serve as inputs of the pre-trained large model.

9. The method for automatic log analysis and operation and maintenance decision-making based on a large model according to claim 2, characterized in that: Also includes: Obtain historical operation and maintenance decision plans output by large models; Constructing a decision node based on each of the historical operation and maintenance decision solutions; Determine the decision nodes contained in any key entity and cluster the corresponding log features and time series indicator features based on the decision frequency of each decision node; For any subsequent operation and maintenance decision of a key entity, the spliced ​​features are labeled according to the clustering results to be input into the large model.

Images