Mobile computing-oriented hierarchical log compression method and computer storage medium

Abstract

The invention discloses a mobile computing-oriented hierarchical log compression method. The method comprises the following steps of: a log understanding step: extracting domain knowledge and semantic context from a log data set; a value evaluation step: performing value evaluation on the log based on the domain knowledge and the semantic context extracted in the log understanding step to obtain a log value result; and a grading compression step: compressing the log according to the log value result. The method has the advantages that value evaluation and grading compression are performed on the logs, so that balance compression efficiency and key information retention are realized, and the compressed logs meet subsequent analysis and use.

Description

Technical Field

[0001] This invention relates to the field of log compression, and in particular to a lightweight LLM-driven hierarchical log compression method for mobile computing. Background Technology

[0002] Mobile devices generate a large amount of logs that are crucial for system maintenance and user experience optimization, but their storage and transmission are severely constrained by the limited resources of mobile devices. Existing compression methods either ignore the log structure or fail to address the significant value differences present in mobile logs, resulting in limited compression ratios and excessive resource consumption.

[0003] Logs are structured records generated by mobile applications and devices to capture runtime events such as application state, error messages, user interactions, and hardware performance metrics. They play an indispensable role in mobile application maintenance, troubleshooting, and user experience optimization. For example, log analysis helps developers track the root causes of application crashes, identify performance bottlenecks, and understand user behavior patterns. However, with the widespread use of feature-rich mobile applications, the amount of log data on mobile devices is growing rapidly. This growth trend, coupled with the inherent limitations of mobile devices, such as limited storage capacity, constrained network bandwidth, and battery-powered operation, puts enormous pressure on device resources and data transmission efficiency. Therefore, developing efficient log compression technologies specifically for mobile environments is urgently needed.

[0004] Existing log compression methods can be divided into two main categories: (1) General-purpose compression tools (such as Gzip and LZMA) utilize character frequency analysis but ignore the structured characteristics of logs, resulting in compression ratios typically below 10:1. (2) Log-specific compression methods (such as LogZip, LogShrink, and LogReducer) improve efficiency by extracting log templates (i.e., fixed structures) and separating dynamic parameters, achieving compression ratios between 15:1 and 50:1. Overall, these methods are primarily designed for server-side logs and effectively reduce storage overhead in traditional server environments.

[0005] Despite their numerous contributions, existing methods still face two major limitations when applied to mobile log compression. First, compression ratios remain insufficient in mobile scenarios. Mobile devices such as smartphones, wearables, and IoT devices have extremely limited storage space, thus demanding very high compression ratios. However, existing methods still generate compressed log files that consume excessive space, making them impractical. Second, these methods ignore the significant value differences inherent in mobile logs. The value of logs varies greatly across the mobile ecosystem. For example, in IoT devices, low-value logs (such as frequent heartbeat logs that simply indicate normal operation) constitute a large proportion, while high-value logs (such as fault logs crucial for diagnostics) are relatively scarce. Existing compression methods treat all logs equally and apply the same compression scheme to all logs. Therefore, even after compression, a large amount of low-value data still occupies a significant portion of storage capacity, inefficiently utilizing limited resources that could be allocated to storing high-value logs. This finding suggests that general log compression strategies are inefficient, and that value-based hierarchical compression is both necessary and feasible. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a lightweight LLM-driven hierarchical log compression method for mobile computing. By evaluating the value of the logs and performing hierarchical compression, a balance between compression efficiency and retention of key information is achieved, and the compressed logs meet the requirements for subsequent analysis.

[0007] To achieve the above objectives, the technical solution adopted by this invention is: a hierarchical log compression method for mobile computing, comprising the following steps: Log understanding steps: Extract domain knowledge and semantic context from the log dataset; Value assessment steps: The value of the logs is assessed based on the domain knowledge and semantic context extracted in the log understanding steps to obtain the log value results; Hierarchical compression steps: Compress logs based on their value.

[0008] The method further includes a secondary compression step: the log files after hierarchical compression are subjected to secondary compression using a general-purpose compressor.

[0009] In the hierarchical compression step, lossy and lossless compression methods are used to compress logs with different values. The compression method changes from lossy to lossless as the value of the log data decreases.

[0010] Value assessment steps: By semantically understanding the degree of impact, importance and downstream relevance, logs are classified into three levels: high, medium and low, each corresponding to a compression method.

[0011] In the hierarchical compression step, high-value logs are preserved losslessly through structured dictionary encoding, medium-value logs are partially compressed by discarding non-critical header information, and low-value logs are semantically abstracted to retain only the high-level pattern.

[0012] The log understanding process includes: analyzing the entire log corpus using Large Language Models (LLMs); the LLMs perform a comprehensive scan of the log dataset, identifying recurring components, relationships, and event types through batch processing of the raw logs; the LLMs then classify events based on their semantic and operational meanings, including identifying structural patterns in individual logs and categorizing them into coherent classes based on inferred meanings; and generating a preliminary grading plan based on the LLMs' analysis of event frequency and semantic weights.

[0013] The value assessment steps include: using a pre-trained large language model to classify logs into three levels—high, medium, and low—through cue engineering; the pre-trained large language model evaluates logs from three core dimensions—scope of impact, severity, and downstream relevance—and the level assessment is achieved by constructing cue words that match these dimensions.

[0014] Each prompt word includes a clear task definition, explicit scoring criteria, specific examples, and a structured output format. The large language model infers the value level from the log content through the prompt words.

[0015] In the tiered compression process, lossless compression is used to compress high-value logs. Medium-value logs are partially lossy compressed to preserve semantically relevant details while discarding redundant header information. The compression template and parameters reuse the dictionary of high-value logs to maintain consistency. Low-value logs are subjected to deep lossy compression through semantic abstraction, retaining only high-level event patterns; the original logs are summarized into general semantic templates, which are mapped to a semantic dictionary, and each template is assigned a unique identifier; the original low-value logs are replaced by the identifiers.

[0016] A computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program, when executed by a processor, implements the hierarchical compression method described above.

[0017] The advantages of this invention are: by evaluating the value of logs and performing hierarchical compression, a balance is achieved between compression efficiency and the retention of key information, and the compressed logs meet the requirements for subsequent analysis. Attached Figure Description

[0018] The following is a brief explanation of the contents of each of the accompanying drawings and the markings in the drawings: Figure 1 This is a schematic diagram of the hierarchical compression method of the present invention; Figure 2 This is a schematic diagram illustrating the principle of value assessment for the prompts in this invention. Detailed Implementation

[0019] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and the description of the preferred embodiments.

[0020] This embodiment provides a lightweight, large language model-driven hierarchical compression method (MobileLogZip) specifically designed for mobile environments. Specifically, logs are divided into three value levels (high, medium, and low), and different compression strategies are applied to each level: high-value logs are lossless compressed to preserve their complete structure; medium-value logs are partially lossy compressed, discarding header information while retaining the template and parameters; and low-value logs are subjected to deep lossy compression through semantic abstraction. Compression efficiency is further improved by integrating dictionary encoding and using a general-purpose compressor after encoding. Evaluations on multiple publicly available real-world log datasets show that MobileLogZip significantly improves compression efficiency compared to existing methods, with negligible impact on downstream tasks such as anomaly detection.

[0021] The hierarchical log compression method for mobile computing in this embodiment specifically includes the following steps: Log understanding steps: Extract domain knowledge and semantic context from the log dataset; Value assessment steps: Construct large language model prompts based on the domain knowledge and semantic context extracted in the log understanding steps, and use the large language model to assess the value of the logs to obtain the log value results; Hierarchical compression steps: Compress logs based on their value.

[0022] Secondary compression step: The log files after hierarchical compression are subjected to secondary compression using a general-purpose compressor.

[0023] In the tiered compression step, lossy and lossless compression methods are used to compress logs of different values. The compression method progresses from lossy to lossless, based on the log data value from high to low. High-value logs are preserved losslessly using structured dictionary encoding. Medium-value logs are partially compressed using structured dictionary encoding after discarding non-critical header information. Low-value logs undergo semantic abstraction to retain only the high-level schema.

[0024] Value assessment steps: Through semantic understanding of impact, importance, and downstream relevance, logs are categorized into three levels: high, medium, and low, each corresponding to a compression method. A pre-trained large language model is used to classify logs into these levels through cue engineering. The pre-trained large language model evaluates logs from three core dimensions: impact scope, severity, and downstream relevance. Level assessment is achieved by constructing cue words that match these dimensions. Each cue word includes a clear task definition, explicit scoring criteria, specific examples, and a structured output format. The large language model infers the value level from the log content driven by these cue words.

[0025] The log understanding process includes: analyzing the entire log corpus using Large Language Models (LLMs); the LLMs perform a comprehensive scan of the log dataset, identifying recurring components, relationships, and event types through batch processing of the raw logs; the LLMs then classify events based on their semantic and operational meanings, including identifying structural patterns in individual logs and categorizing them into coherent classes based on inferred meanings; and generating a preliminary grading plan based on the LLMs' analysis of event frequency and semantic weights.

[0026] In the tiered compression process, lossless compression is used to compress high-value logs. Medium-value logs are partially lossy compressed to preserve semantically relevant details while discarding redundant header information. The compression template and parameters reuse the dictionary of high-value logs to maintain consistency. Low-value logs are subjected to deep lossy compression through semantic abstraction, retaining only high-level event patterns; the original logs are summarized into general semantic templates, which are mapped to a semantic dictionary, and each template is assigned a unique identifier; the original low-value logs are replaced by the identifiers.

[0027] The hierarchical compression method in this embodiment utilizes a large language model for semantic understanding of domain knowledge, aiming to balance compression efficiency and retention of key information, with a focus on maintaining the usability of high-value logs in downstream tasks. Specifically, it includes, for example... Figure 1 The four modules shown are: Log Understanding Module, which establishes comprehensive semantic understanding; Log Data Value Assessment Module, which classifies the value of each log based on semantic understanding; Tiered Compression Module, which applies tiered compression strategies to logs of different values; and Secondary Compression Module, which uses a general-purpose compressor to further improve the compression ratio.

[0028] (1) Log understanding Log understanding is the step of directly extracting domain-specific knowledge and semantic context from log datasets. This stage utilizes Large Language Models (LLMs) to analyze the entire log corpus, enabling the model to autonomously infer underlying system structure, operational patterns, and event semantics.

[0029] To achieve log understanding, the first challenge is constructing a log corpus. Since large language models require significant context length, and complete log datasets are substantial, using the entire log dataset as the corpus is clearly impractical. To address this, the framework employs a clustering tree approach, aggregating logs with character similarity exceeding 80% into a single class. By statistically analyzing the size of different log classes, the scarcity of each class is determined: the higher the number of logs in a class, the lower the scarcity, and vice versa. Specifically, a smaller number of log samples are extracted from the more scarce log classes, while a larger number are extracted from the less scarce log classes. Combining all extracted samples yields the complete log corpus. This process ensures that a smaller portion of the log corpus represents the characteristics of the complete log dataset.

[0030] After obtaining the complete log corpus, a large language model is used to perform a comprehensive scan of the corpus. Through batch processing of the raw logs, recurring components, relationships, and event types are identified. For example, when analyzing HDFS logs, the large language model identifies frequently occurring terms like "Namenode," "DataNode," and "block" as core system components and infers their roles through contextual patterns: "Namenode" is consistently associated with "block management" events, while "DataNode" appears in "heartbeat" and "replication" messages. By examining the log corpus, the large language model can deduce operational patterns, such as distinguishing between regular state updates and abnormal events, and correlate these patterns with implicit system behaviors.

[0031] Building upon this comprehensive corpus analysis, the Large Language Model (LLM) then categorizes different events based on their semantic and operational meaning. This event classification involves identifying structural patterns within individual log entries and grouping them into coherent categories based on the inferred meaning. For example, in the Spark log dataset, the LLM might cluster logs into "stage failure" events related to job interruptions, "resource warnings" events related to memory or disk thresholds, and regular, recurring "task completion" events. These classifications are entirely derived from the log content, with the LLM leveraging its ability to identify contextual similarities and semantic nuances across thousands of log entries.

[0032] Finally, based on the analysis of event frequency and semantic weights using a large language model, a preliminary grading plan is generated. For example, rare but critical "system crash" logs are categorized as high-value events, while common "heartbeat" logs are categorized as low-value events. This data-driven plan ensures that subsequent value assessments and compression strategies are directly based on the inherent patterns of the log dataset, rather than external assumptions.

[0033] (2) Valuation The value assessment uses the preliminary grading plan obtained from the log understanding step as the basis for designing prompt words for the large language model. The logs are divided into three levels: high, medium and low using pre-trained large language models (LLMs), and zero-shot inference can be achieved without fine-tuning for specific tasks.

[0034] Similar to the log understanding step, since the complete log dataset is very large, directly using a large language model for value assessment is not only time-consuming but also very token-intensive. Therefore, this framework constructs a template cache tree in the value assessment step to solve this problem.

[0035] This structure is similar to a log parse tree, where logs are split into a log template and a variable number of log parameters after parsing. Within this framework, we use the log parameter information to construct a template cache tree. The first-level child nodes of the template cache tree represent the "total number of parameters after log parsing," the second-level child nodes represent the "number of parameter types after log parsing," and the third-level child nodes represent the "log template and its corresponding level."

[0036] For log datasets, instead of directly using the Big Oracle model for value assessment, the logs are first parsed into templates and parameters. Then, a breadth-first search algorithm is used to search the template cache tree based on the "total number of parameters after log parsing," the "number of parameter types after log parsing," and the "template and corresponding level after log parsing." Because the number of parameters, parameter types, and templates of the same type of log are often consistent, if the same template and value are found in the template cache tree, then that value can be directly used as the value of that log.

[0037] Only when the template and value corresponding to the log cannot be found in the template cache tree will the large language model be used for value assessment. The result of the value assessment is not only used in the next step, but is also returned to the template cache tree for storage to ensure the effectiveness of the template cache tree.

[0038] This framework leverages the inherent semantic understanding capabilities of large language models (such as Llama 3.2:3B) to evaluate logs from three core dimensions: impact scope, severity, and downstream relevance. By constructing cue words that match these dimensions, the framework ensures consistency and context awareness in classification.

[0039] Impact assessment is performed by determining whether an event affects the entire system, a specific module, or an isolated component. For example, logs indicating a "cluster failure" are categorized as system-level, while "actuator timeout" is module-specific. Severity assessment depends on the urgency of the required action, ranging from critical events requiring immediate intervention (e.g., "data corruption detected") to informative updates that do not require a response (e.g., "debug mode enabled"). The downstream relevance of logs is measured by their usefulness to compressed tasks such as anomaly detection or root cause analysis. Logs containing error stack traces or configuration mismatches are considered highly relevant, while regular status messages are not.

[0040] These prompts are carefully designed to be as follows: Figure 2 The method shown continuously guides the large language model. Each prompt word contains a clear task definition, a clear scoring criterion, a specific example, and a structured output format that is easy to automate. For example: (1) Task definition: "Classify logs into high / medium / low value based on impact, importance, and downstream relevance"; (2) Scoring criterion: "High value: Logs indicating critical events in the system, such as 'cluster initialization failed'"; (3) Output format: "Output: high / medium / low".

[0041] This cue-driven approach enables the Large Language Model (MLM) to infer value levels directly from log content, even without prior knowledge of a specific system. For example, when encountering a log from an unknown cloud service mentioning "auto-scaling group failed to start instance," the MLM identifies the keyword "failure," interprets the event in conjunction with the inferred system architecture context of "auto-scaling group," and assesses its potential impact on the system, classifying it as a high-value log. This cross-domain and cross-system generalization capability means the framework can be applied to a wide range of log sources, from traditional enterprise systems to emerging cloud architectures.

[0042] By integrating these dimensions into a unified evaluation framework, the value grading process matches compression strategies with log importance. High-value logs identified as critical to system health or downstream analysis are prioritized for lossless preservation, while medium- and low-value logs are compressed more aggressively. This semantically aware approach ensures that compression rates are maximized without compromising the logs' utility in critical tasks such as anomaly detection.

[0043] (3) Staged compression The tiered compression strategy is tailored to the value hierarchy determined during the evaluation phase, applying a higher degree of lossy compression to logs with lower value. This tiered approach ensures that high-value logs retain their complete structural and semantic integrity, while medium- and low-value logs undergo targeted compression to balance efficiency and the preservation of critical information.

[0044] For high-value logs, such as those indicating system-level errors or critical configuration anomalies, lossless compression is employed to preserve all contextual details. These logs are first parsed into three distinct components: header information including timestamps, source node, and metadata; a fixed template such as "Error: Block id failed to replicate"; and a dynamic parameter like ID="12345". To minimize redundancy while maintaining integrity, three dictionaries are constructed: a header dictionary mapping header information to compact identifiers, a template dictionary encoding recurring structural patterns, and a parameter dictionary for dynamic values. The original log is then replaced with these identifier sequences (i.e., header ID + template ID + parameter ID), achieving a complete reconstruction of the original log while reducing storage overhead through dictionary-based encoding. This ensures that high-value logs remain fully available for downstream tasks such as root cause analysis or anomaly detection.

[0045] Medium-value logs, including warnings and non-critical status updates for specific modules, undergo partial lossy compression, prioritizing the preservation of semantically relevant details while discarding redundant header information. This means that no log header dictionary or corresponding index is generated; only the corresponding template and parameter dictionary, along with their respective indexes, are generated. Header information such as non-time-sensitive timestamps is intentionally omitted to reduce size, as these fields are considered non-critical for medium-value logs. Templates and parameters reuse the dictionary from high-value logs to maintain consistency.

[0046] Low-value logs, such as repetitive heartbeat messages, routine debugging entries, or irrelevant state updates, are subjected to deep lossy compression through semantic abstraction, retaining only high-level event patterns. This process first generalizes the raw logs into generic semantic templates that capture the essence of repetitive events while removing variable details. For example, thousands of heartbeat logs with different timestamps, such as "Node A active at 08:00," "Node A active at 08:05," are abstracted into a single template: "Node A periodic heartbeat." Similarly, general task completion information like "Task 5 finished," "Task 6 finished," is summarized as "general task completion." These semantic templates are then mapped to a semantic dictionary, with each template assigned a unique identifier. The original low-value logs are replaced by these identifiers, significantly reducing storage requirements while preserving the ability to infer high-level system behavior (e.g., confirming node uptime through heartbeat abstraction).

[0047] These tiered strategies ensure that compression intensity varies with log value: high-value logs retain full detail, medium-value logs strike a balance between detail and compression ratio, and low-value logs achieve maximum compression through targeted abstraction. This approach maximizes the overall compression ratio while ensuring that critical logs are usable for analytical tasks.

[0048] (4) Secondary compression After completing specific levels of compression, the encoded sequence undergoes a final compression step using a general-purpose compressor. This secondary compression leverages the inherent statistical redundancy in the encoded ID sequence, complementing the semantic and structural redundancy reduced in the earlier stages.

[0049] Although the length of the encoded sequence has been significantly reduced, it still retains recurring ID combination patterns that are well-suited to the performance of general-purpose compressors. For example, high-value logs may frequently co-occur with specific header IDs and template IDs, such as a combination of a "NameNode" header and a "Block Failure" template. On the other hand, low-value logs often generate recurring semantic template ID sequences, such as alternating "heartbeat" and "normal state" IDs. Although these patterns have been encoded and pre-processed in a structured manner, they still contain statistical regularities, such as recurring ID subsequences or skewed frequency distributions. Tools like Zstd, LZMA, or Gzip can efficiently compress them using entropy encoding and dictionary-based lookups. Notably, this secondary compression preserves the integrity of the encoded IDs. This ensures that understanding the compression process allows for the reconstruction of the exact sequences needed to recover specific levels of log detail, thus maintaining compatibility with downstream tasks.

[0050] This embodiment also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the hierarchical compression method described in the above embodiment. The implementation of this computer-readable storage medium can be referenced to memory implementation.

[0051] This application also provides a computer program product or computer program, which includes program code stored in a computer-readable storage medium. The chip's processor reads the program code from the computer-readable storage medium and executes the program code, causing the processor to perform the above-described hierarchical compression method.

[0052] In addition, this application also provides an apparatus, which may specifically be a chip, component or module. The apparatus may include a connected processor and a memory. The memory is used to store computer execution instructions. When the apparatus is running, the processor can execute the computer execution instructions stored in the memory to cause the apparatus to perform the hierarchical compression method in the above method embodiments.

[0053] The apparatus, device, computer-readable storage medium, computer program product or chip provided in this application are all used to perform the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects of the corresponding methods provided above, and will not be repeated here.

[0054] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state disk (SSD).

[0055] Obviously, the specific implementation of this invention is not limited to the above-described methods. Any non-substantial improvements made using the inventive concept and technical solution of this invention are within the protection scope of this invention.

Claims

1. A hierarchical log compression method for mobile computing, characterized in that: Includes the following steps: Log understanding steps: Extract domain knowledge and semantic context from the log dataset; Value assessment steps: The value of the logs is assessed based on the domain knowledge and semantic context extracted in the log understanding steps to obtain the log value results; Hierarchical compression steps: Compress logs based on their value.

2. The hierarchical log compression method for mobile computing as described in claim 1, characterized in that: The method further includes a secondary compression step: the log files after hierarchical compression are subjected to secondary compression using a general-purpose compressor.

3. The hierarchical log compression method for mobile computing as described in claim 1, characterized in that: In the hierarchical compression step, lossy and lossless compression methods are used to compress logs with different values. The compression method changes from lossy to lossless as the value of the log data decreases.

4. The hierarchical log compression method for mobile computing as described in claim 1 or 2, characterized in that: Value assessment steps: By semantically understanding the degree of impact, importance and downstream relevance, logs are classified into three levels: high, medium and low, each corresponding to a compression method.

5. The hierarchical log compression method for mobile computing as described in claim 4, characterized in that: In the hierarchical compression step, high-value logs are preserved losslessly through structured dictionary encoding, medium-value logs are partially compressed by discarding non-critical header information, and low-value logs are semantically abstracted to retain only the high-level pattern.

6. The hierarchical log compression method for mobile computing as described in claim 1, characterized in that: The log understanding process includes: analyzing the entire log corpus using Large Language Models (LLMs); the LLMs perform a comprehensive scan of the log dataset, identifying recurring components, relationships, and event types through batch processing of the raw logs; the LLMs then classify events based on their semantic and operational meanings, including identifying structural patterns in individual logs and categorizing them into coherent classes based on inferred meanings; and generating a preliminary grading plan based on the LLMs' analysis of event frequency and semantic weights.

7. The hierarchical log compression method for mobile computing as described in claim 6, characterized in that: The value assessment steps include: using a pre-trained large language model to classify logs into three levels—high, medium, and low—through cue engineering; the pre-trained large language model evaluates logs from three core dimensions—scope of impact, severity, and downstream relevance—and the level assessment is achieved by constructing cue words that match these dimensions.

8. The hierarchical log compression method for mobile computing as described in claim 7, characterized in that: Each prompt word includes a clear task definition, explicit scoring criteria, specific examples, and a structured output format. The large language model infers the value level from the log content through the prompt words.

9. The hierarchical log compression method for mobile computing as described in claim 1 or 5, characterized in that: In the tiered compression process, lossless compression is used to compress high-value logs. Medium-value logs are partially lossy compressed to preserve semantically relevant details while discarding redundant header information. The compression template and parameters reuse the dictionary of high-value logs to maintain consistency. Low-value logs are subjected to deep lossy compression through semantic abstraction, retaining only high-level event patterns; the original logs are summarized into general semantic templates, which are mapped to a semantic dictionary, and each template is assigned a unique identifier. The original low-value logs were replaced with identifiers.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium shown stores a computer program that, when executed by a processor, implements the hierarchical compression method as described in any one of claims 1-9.

Images